I have a document library in which I have a folder called sharepoint and with in that folder it has some important data. Now I want to access the above folder and it content only to a specific group. I have stopped inhertiance from parent and provided access to that particular group.

Problem is for this folder I can see that site collection owners have permissions. I want to remove even the site collection owners accessing thi s folder

3 Answers 3


Agree with the @CarlF's answer. Just adding my 2 cents here.

  • Site collection administrators will always have access to all subsites, lists, libraries, folders and documents with no restrictions whatsoever.
  • Site collection admins should ideally be a small group of people. For example, limit them to the Service Desk AD group. Depends on the size of your organization, of course.
  • Review your current Office 365 / SharePoint Online governance: Who is the Global Admin? Who are the SharePoint Admins? Who are site collection administrators? You can create separate service AD Accounts that will be Site collection administrators. Change their passwords often and share these only when it's requested for a specific purpose.
  • Password protect your sensitive Word, Excel and PDF documents. Or, setup IRM or Azure Information Protection (not free).
  • Consider using OneDrive for Business for these types of documents. By default, there will be only one Site Collection administrator (owner of the OneDrive site in question) SharePoint Admin will be able to add himself, but at least the number of people will be limited to one person.
  • Thanks Denis. Ours is a small organization. As you said governance what is the best practice for governance in sharepoint. Like first level is Global admin, Tenant admin, site collection admin, right?? Apr 14, 2020 at 1:27
  • Governance is a list of rules and policies that every organization develops on their own. I usually help the with an introductory framework. It's too long to fit in a small comment textbox. The main principles are: limit access to the privileged roles, change credentials regularly, introduce separate service admin accounts, turn on audit etc. Strict security takes real effort, but every organization chooses their own sweet spot that fits them. In any case, we need to start with the review of the current state. Apr 14, 2020 at 2:50

You can't. Even if you could, the Site Collection Administrators could just add themselves back.

The only actual way to keep documents secret from administrators, in almost any system, is to encrypt them on a different system before uploading, and only share the keys with the team you want to have access.


Consider using a different site collection (or modern team site) for storing these documents.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.