4

We have been working on a new sharepoint office 365 project. where our customer have already added a single site collection inside the root url. and we have created 5 site collections and grant users the related permissions (Read or Contribute). but i have this concern regarding office 365 permission:-

Now how i can prevent the global admin or other sharepoint admins from accessing our site collections? as our customer have send us the username which we used to create site collections. which means that our customer already have a global admin and maybe other sharepoint admins. and these admins can access our site collections and do some customizations (by mistake), regardless of the permision we grant inside the site collections security groups.

so can i restrict accessing our site collections to only users we have granted them inside the security groups? currently on all the site collections i grant users/group-of-users either Read or Contribute. and i grant our admin full control. but the only concern is if there are other admins defined inside office 365 , then these admins can do everything they want. so can i restrict this ?

7

You cannot prevent SharePoint or Global Admins from gaining access to a Site Collection.

  • so you mean if our customer have defined or will define sharepoint admins inside office 365 then these admin can access our site collection with full permissions??for example when our customer send us the sharepoint admin username, i was able to access the site collection they have , and i had full control on the site collection... so we can not prevent this? – john Gu Aug 8 '17 at 14:36
  • 1
    That's correct. While Global/SharePoint Admins do not have access by default, they can grant themselves access at any time. – Trevor Seward Aug 8 '17 at 14:37
  • but in my case they send us a new username which have permsion to create/delete site collections (i think the username was office 365 admin) and using this username i was able to access the site collection they have been working on and i have full control over the site, although i did not grant my self and permission.. – john Gu Aug 8 '17 at 14:38
  • 4
    It doesn't really matter either way. They can grant themselves access where needed. This is the point of administration. If you don't trust your admins, that's an HR problem, not a technology one. – Trevor Seward Aug 8 '17 at 14:39
  • 1
    John, I'm not sure what you're expecting here. If they're an admin, they're an admin and can do anything they want. Your original question has been answered. – Trevor Seward Aug 8 '17 at 14:49

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.