1

Using the office 365 admin center and the office 365 admin username i created a new MS Teams as follow, and i name it "TestTeam123":-

enter image description here

now this have created a new Office 365 group + sharepoint modern team site. I also realized the following:-

  1. adding a member to the MS-Teams or Office 365 group will automatically grant the member user Edit permission on the sharepoint site. now this behavioure is understandable as inside the SharePoint site, we can find that inside the sharepoint member group >> there is an office 365 group's member added by default (which have the same name as the sharepoint members group) as follow:-

enter image description here

and most importantly, if i remove the above office 365 group's member from the sharepoint members group (i did this for testing purposes only, as on reality we should not do so), the Office 365 group's members will not longer have access to sharepoint site.

  1. But what i did not understand is that if we add an owner to the MS Teams/Office-365-group then the owner will have full control permission on the sharepoint site. so i thought that similar to the members case, i will find that the office 365 group's owner is added inside the sharepoint owner group, but this is not the case. but on the other hand i checked the SharePoint's site collection admins section, and i found this group is added by default:- enter image description here

now based on the above case, i have the following 3 questions:-

  1. for the above "TestTeam123 Owner" group added inside the site collection admins section, is this the sharepoint owner group? or it is the office 365 group's owners?

  2. Why did Microsoft add the office 365 group's member inside the sharepoint member group, while it did not add the office 365 group's owner inside the sharepoint owner group?

  3. for testing purposes i remove the "TestTeam123 Owner" group from the site collection admins section, but still the office 365 group's owners users have full control on the sharepoint site.. so what is going behind the scenes ? i did the remove around 20 hours ago, so i do not think it is a sync or timing issue...

Improve this question

2 Answers 2

Reset to default
1
  1. It is a auto generated SharePoint group containing all O365 group owners. This is by design. Anyone who is an Owner of the Group is also a Site Collection Administrator on the SharePoint site.

2.Please do permission check on the user in Owner Group, they shall be granted full control permission in the group Connected team site.

3.You can do permission check and see which group grant the user Full control permission. According to your description, the TestTeam 123 owner group shall still be there and grant the user full control permission.(And you cannot change that group) If you want to remove their permission, change the role of that member in teams. The permission will automatically change in the team site.

Improve this answer
3
  • Ok thanks for your reply. for point-1ok noted. for point-2 i did not get what you exactly mean, can u explain it in more details(when u say group are referring to sharepoint group or office 365 group?).. for point -3, so in general even if i remove the "TestTeam123 Owner" group from the site collection admins section (as i did before), the office 365 group's owners users will still have full control on the sharepoint site? and if this is the case then why Microsoft added the "TestTeam123 Owner" group inside the site collection admin section?
    – John John
    Commented Jun 24, 2019 at 12:30
  • @SharePointTestDev For the first question, just as i have said, first you have an O365 group, and then in SharePoint, corresponding SharePoint groups are created and contains O365 group owners. It is an automatic process SPO does for you so that you do not need to configure SharePoint groups by your self.
    – Jerry_MSFT
    Commented Jun 25, 2019 at 5:36
  • @@SharePointTestDev 3rd question, 123 Owner group is a group which automatically granted full control permission. You can have different groups of full control while some or none of them are SCA , it doesn't matter whether they are SCA or not. And similarly, it awards end-users an easier life to handle sp sites
    – Jerry_MSFT
    Commented Jun 25, 2019 at 5:42
0

Regarding your 3rd question. The group-owners were not only added to the SCA list. That group is also added to the permission group [Site]-owners. It seems to be hidden from the GUI. But it's still there. That's why the owners still have full-control. See also: https://www.netwoven.com/2020/03/24/permissions-in-office-365-group-connected-modern-team-site/

Improve this answer

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.