In the Onedrive admin panel, you are able to specify a group when using "Enable My Site Secondary Admin" - this should make that group secondary admin on all newly created Onedrive sites. In this case, the group is our IT security team that does lots of data compliance checks.

Now, I need to retroactively set this group as a secondary admin on thousands of pre-existing Onedrive sites.

Set-SPOUser has the -issitecollctionadmin flag that can set this for an individual user - but what command would be needed to do the same for a group?

I have attempted variations on the below...but it gives "group cannot be found" and access denied errors despite the fact I am a global admin. I have been using the "domain\group" format for $secondaryadmin.

Function Add-OnedriveSecondaryAdmin($AdminURL,$SecondaryAdmin)
    #connect Spo service.
    Connect-SPOService -Url $AdminURL
    #Get all Onedrive URL's.
    $OneDriveURLs = Get-SPOSite -IncludePersonalSite $true -Limit All -Filter "Url -like '-my.sharepoint.com/personal/'"
    foreach($OneDriveURL in $OneDriveURLs)
        #Add Secondary administrator to Onedrive Site.
        Set-SPOSiteGroup -Site $OneDriveURL.URL -Identity $SecondaryAdmin -PermissionLevelsToAdd "Full Control" -ErrorAction SilentlyContinue
        Write-Host "Added secondary admin to the site $($OneDriveURL.URL)" 

I'd appreciate any suggestions on how to accomplish this.


  • As an aside, access to the site itself should be unnecessary with the eDiscovery/DLP/etc. in M365.
    – user6024
    Commented Mar 25, 2021 at 17:36
  • Our security team is using Varonis DSP to do a lot of automated scanning / alerting in our environment. While the Varonis service account can scan everything in One Drive, the security teams can't actually use some of the analysis functions unless their own user accounts are secondary admins to all the sites. Commented Mar 25, 2021 at 18:29

1 Answer 1


As far as I know, Set-SPOUser also works for a group. You could do the same for a group as for an individual user:

Set-SPOUser -Site $OneDriveURL.URL -LoginName $SecondaryAdmin -IsSiteCollectionAdmin $true
  • When I try to run set-spouser against a group, I get "The user does not exist or is not unique". I have tried with both an O365 security group, as well as an on-prem sync'd AAD security group. I have seen some places state that set-spouser is only valid for users, not groups, but it'd be great if there were a way to make it work... Commented Mar 26, 2021 at 15:20
  • What the parameter LoginName did you use for the group? Commented Mar 30, 2021 at 8:03

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.