3

I have started working on a new Office 365 project (license is Office 365 Business Essentials). and i got a username who is defined as the Global admin for the office 365. now our customer inform us to clean the security settings for the Office 365. to make sure users do not have and will not have extra permission on the SP sites.

so now i wanted to check mainly who are the users who will have full permission on the site collections. and per my understanding all "Global admins" + "sharepoint online admins" will have a full control on all the site collections.

so to check the current user setting, i did the following steps:-

  1. i login to office 365.
  2. under "Users" >> "Active Users" >> i got a list of views as follow:-

enter image description here

now i have the following 2 concerns/questions about the current settings:-

  1. inside the "Views" list i can not find the "sharepoint online admin" role. so i can not check which users have this role? as users with this role will have full control on the site collections.
  2. while i find roles such as "Password admins","Service admins","User management admins" and "Billing admins" inside the Views list. so will users who are defined under those roles got full control on the site collection? or users inside these roles will not get full control on the site collection unless they have been added as site collections admins and/or are defined under the global admin group ??

Thanks

Improve this question

1 Answer 1

Reset to default
3

There are other admin roles which are not provided in the dropdown e.g. Exchange administrator, Sky for Business administator, PowerBI Service, Dynamic 365, etc.

You can write a powershell script to retrieve all the users assigned SharePoint administrator role. 

Connect-MsolService
$role = Get-MsolRole -RoleName "SharePoint Service Administrator"
Get-MsolRoleMember -RoleObjectId $role.ObjectId | Export-CSV c:\temp\filename.csv

More details here

Just to mention that SharePoint administrator role doesn't only give full control to one site collection but all the site collections. Full description of this role here

Improve this answer
17
  • 1
    Updated the answer with the actual script.
    – SharePointer
    Commented Aug 25, 2017 at 13:05
  • 1
    Ensure that PowerShell is 64bit and modules are installed. stackoverflow.com/questions/43252813/…
    – SharePointer
    Commented Aug 25, 2017 at 13:32
  • 1
    Yes looks valid you might have install app which required Company Administrator permission. Have you tried this with SharePoint Administrator role?
    – SharePointer
    Commented Aug 25, 2017 at 14:55
  • 1
    Please use the script provided in my answer it should be 'SharePoint Service Administrator'
    – SharePointer
    Commented Aug 25, 2017 at 15:19
  • 1
    You need to review my answer and the first link provided which provides all the roles. Only SharePoint Service Administrator and Company Admin gets the full control to site collections
    – SharePointer
    Commented Aug 25, 2017 at 15:26

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.