SharePoint Online: Add Site Collection Administrator using PowerShell

Requirement: Add Site Collection Administrator in SharePoint Online.

Site Collection Administrator in SharePoint Online

SharePoint site collection administrators have full access rights to manage all sites under a site collection. When creating a site collection, a Global Administrator or SharePoint Online Administrator specifies the primary site collection administrator for the site. Unlike SharePoint on-premises, a SharePoint Online site collection can have several administrators but only one primary administrator.

It is possible to add multiple site collection admins for any SharePoint site collection. To add another site collection administrator in SharePoint Online, you must have one of the Global Administrator, SharePoint Online administrator, or Site Collection Administrator roles of the particular site.

How to add a site collection administrator in SharePoint Online?

How do I add a collection admin in SharePoint Online? There are a few different ways that you can add a site collection administrator to your SharePoint Online environment. The easiest way is to use the SharePoint Admin site:

Grant Site Collection Administrator Rights through SharePoint Admin Center

To add a user to the site collection administrator in SharePoint Online through SharePoint Admin Center, do the following:

1. Navigate to your SharePoint Admin Center >> Click on Active Sites (E.g., https://Crescent-admin.sharepoint.com/_layouts/15/online/AdminHome.aspx)
2. Select the site collection and click on the “Membership” button from the command bar. Click on “Site admins” tab and then click on “Add site admins” button.

   

3. This brings you to the “Add site Admins” page, where you can add multiple site collection administrators and change the primary site collection administrator. From there, you can add administrators as needed.

   

4. Once you have added the new user, press Save to commit the changes, and any new Site Collection Administrator will have full control to the root site and any subsite within that Site Collection.

On Group site collections, The Office 365 Group owners are set as site collection administrators by default. You can add a new site collection Admin to the group owner or under additional site owners.

Add user as site collection administrator via site settings

How to add a user to the site collection administrator in SharePoint Online? When you create a new SharePoint Online site, You’ll be entering the “Primary Administrator” or the SharePoint site owner, who’ll automatically become a site collection admin. Once the site collection is created, You can also navigate to the site >> Click on the Settings gear icon >> Site Settings >> Site collection administrators link to add additional site collection administrators. Direct link: https://tenant.sharepoint.com/sites/siteurl/_layouts/15/mngsiteadmin.aspx

Enter the name or email address of the person you want to add as a secondary site collection administrator. Once you’ve added the administrator, they will be able to access all site collection content, features, and settings. If you need to add multiple administrators, you can separate their names or addresses with a semicolon. Click on “OK” once done.

Relatively easy, isn’t it? Well, It’s easy for one single-site collection. However, there is a problem when you have a large number of site collections. Say you have 100s of SharePoint Online site collections; you can’t simply select all of your site collections and add a site collection administrator to all of them in one shot! So, let’s see how to add a site collection administrator in SharePoint Online using PowerShell.

What is the difference between a site collection administrator and a site owner?

• The site owner may have full control only over a specific site, whereas the site collection administrator will have full control to all the sites and subsites of the site collection.
• The primary site collection administrator receives administrative email alerts, such as storage notifications for the site collection.
• Site collection Admins will have access to site collection level features, such as site collection recycle bin, site collection features, etc.
• A site owner cannot remove a site collection administrator, whereas the opposite is possible.
• Site Collection Admin can access any item with unique permission. But the site owner can’t do so.

Add Site Collection Administrator in Modern / Group Connected SharePoint Online Sites:

The “Site Collection Administrators” link in the site settings page is hidden in group-connected modern team sites. By default, the Office 365 Group Owner is configured as the site collection administrator. You can add any user to the Office 365 group’s owners group to make them site collection administrators, or use the below steps to add additional site collection admins.

1. Click on Settings gear >> Site Permissions >> Click on “Advanced permissions settings”
2. Click on the “Site Collection Administrators” button in the ribbon.

   

Anyway, In SharePoint Online, site collection administrators are to be added on a site collection-by-site collection basis, as there are no web application level user policies that can be set from Central Administration as we do in SharePoint on-premises. So, the solution is: Use PowerShell to add a site collection administrator in SharePoint Online!

PowerShell Script to Add Site Collection Administrator in SharePoint Online

How do I add a site collection administrator in SharePoint online using PowerShell? Here is the PowerShell for SharePoint Online to add a site collection administrator using the Set-SPOUser cmdlet with SharePoint Online Management Shell:

#Variables for processing
$AdminURL = "https://crescent-admin.sharepoint.com/"
$AdminName = "salaudeen@crescent.onmicrosoft.com"
$SiteCollURL = "https://crescent.sharepoint.com/sites/Sales/"
$SiteCollectionAdmin = "mark@crescent.onmicrosoft.com"

#User Name and Password to connect 
#$SecurePWD = read-host -assecurestring "Enter Password for $AdminName" 
$SecurePWD = ConvertTo-SecureString "Password1" -asplaintext -force  
$Credential = new-object -typename System.Management.Automation.PSCredential -argumentlist $AdminName, $SecurePWD
 
#Connect to SharePoint Online
Connect-SPOService -url $AdminURL -credential $Credential

#Add Site collection Admin
Set-SPOUser -site $SiteCollURL -LoginName $SiteCollectionAdmin -IsSiteCollectionAdmin $True

This PowerShell also works when you want to add a group as a site collection administrator in SharePoint Online.

Add Site Collection Admin to All SharePoint Online Sites using PowerShell

SharePoint Online PowerShell to add a site collection administrator for all site collections.

#Variables for processing
$AdminURL = "https://Crescent-admin.sharepoint.com/"

#Connect to SharePoint Online
Connect-SPOService -url $AdminURL

$Sites = Get-SPOSite -Limit ALL

Foreach ($Site in $Sites)
{
    Write-host "Adding Site Collection Admin for:"$Site.URL
    Set-SPOUser -site $Site -LoginName $AdminName -IsSiteCollectionAdmin $True
}

How about adding a site collection administrator to multiple sites in bulk? Sure! You can use a CSV file input and add site admin to multiple sites: How to Add Site Collection Admin to Multiple Sites from a CSV using PowerShell?

Change Primary Site Collection Administrator using PowerShell

Here is the SharePoint Online PowerShell to set site collection administrator using the Set-SPOSite cmdlet.

#Variables for processing
$AdminURL = "https://crescent-admin.sharepoint.com/"
$AdminName = "salaudeen@crescent.onmicrosoft.com"
$SiteCollURL = "https://crescent.sharepoint.com/sites/Sales"
$NewSiteAdmin = "mark@crescent.onmicrosoft.com"

#User Names Password to connect 
$SecurePWD = ConvertTo-SecureString "Password1" -asplaintext -force  
$Credential = new-object -typename System.Management.Automation.PSCredential -argumentlist $AdminName, $SecurePWD
 
#Connect to SharePoint Online
Connect-SPOService -url $AdminURL -credential $Credential

#Change Site Collection Primary Admin
Set-SPOSite -Identity $SiteCollURL -Owner $NewSiteAdmin -NoWait

Add Site Collection Administrator to Group/Modern Sites

Here is the script to use in “SharePoint Online Management Shell” to add site collection admins to all sites, including Modern Team sites.

#Variables for processing
$AdminURL = "https://crescent-admin.sharepoint.com/" 
$AdminName="SPAdmin@crescent.com"

#Connect to SharePoint Online
Connect-SPOService -url $AdminURL -credential (Get-Credential)

#Get All Site Collections
$AllSites = Get-SPOSite -Limit ALL

#Loop through each site and add site admins
Foreach ($Site in $AllSites)
{
    Write-host "Adding Site Collection Admin for:"$Site.URL
    Set-SPOUser -site $Site.Url -LoginName $AdminName -IsSiteCollectionAdmin $True
}

You can apply a filter to site collections to get all site collections of a specific type. E.g., To get all communication sites, use:

Get-SPOSite -Template SITEPAGEPUBLISHING#0

Similarly, you can filter site collections and add site collection admins as:

$Sites = Get-SPOSite -Limit All | Where {$_.Url -like 'https://crescent.sharepoint.com/sites/Project*'}

Add Site Collection Administrator using PowerShell CSOM

Besides SharePoint Online Management Shell, we can also use the PowerShell CSOM method to add a user to the site collection administrator group. Here is how:

#Load SharePoint CSOM Assemblies
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"
 
#Variables for Processing
$SiteURL = "https://crescent.sharepoint.com/Sites/marketing"
$UserAccount="i:0#.f|membership|Salaudeen@crescent.com"

#Setup Credentials to connect
$Cred = Get-Credential
$Cred = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($Cred.UserName,$Cred.Password)

#Setup the context
$Ctx = New-Object Microsoft.SharePoint.Client.ClientContext($SiteURL)
$Ctx.Credentials = $Cred

#sharepoint online powershell set site collection administrator
$User = $Ctx.Web.EnsureUser($UserAccount)
$User.IsSiteAdmin = $True
$User.Update()
$Ctx.ExecuteQuery()

In this example, We have used the “EnsureUser” method to ensure the site collection admin user is already added to the site, as the IsSiteAdmin property applies to only an existing user.

PnP PowerShell to Add Site Collection Administrator in SharePoint Online

You need to give yourself access to every site collection individually to access it. If there are hundreds of them, rather than adding to each site, you can use the PowerShell cmdlet Add-PnPSiteCollectionAdmin to do that. Here is how to add a user as a site collection administrator using PnP PowerShell:

#Set Variables
$SiteURL = "https://crescent.sharepoint.com/sites/Marketing"

#Connect to PnP Online
Connect-PnPOnline -Url $SiteURL -Credentials (Get-Credential)

#add user as site collection administrator powershell sharepoint online
Add-PnPSiteCollectionAdmin -Owners "Salaudeen@crescent.com"

Existing site collection admins stay as is! To add more than one site collection admin, use:

Add-PnPSiteCollectionAdmin -Owners "Salaudeen@crescent.com", "Charles@crescent.com"

You can also add site collection admin using the PnP PowerShell cmdlet Set-PnPTenantSite as:

#Set Runtime Parameters
$AdminSiteURL="https://crescent-admin.sharepoint.com"
$SiteUrl="https://crescent.sharepoint.com/sites/jackson"
$SiteCollAdmin="salaudeen@crescent.is"
 
#Connect to PnP Online
Connect-PnPOnline -Url $AdminSiteURL -Interactive

#Add Site collection Admin user permission
Set-PnPTenantSite -Url $SiteUrl -Owners $SiteCollAdmin

Add Site Collection Administrator to All SharePoint Sites in the Tenant

To Add a SharePoint Site Collection Administrator to All Site Collections in the tenant, use

#Parameters
$TenantAdminURL = "https://crescent-admin.sharepoint.com"
$SiteCollAdmin="salaudeen@crescent.com"
  
#Connect to Admin Center
Connect-PnPOnline -Url $TenantAdminURL -Interactive

#Get All Site collections and Iterate through
$SiteCollections = Get-PnPTenantSite
ForEach($Site in $SiteCollections)
{ 
    #Add Site collection Admin
    Set-PnPTenantSite -Url $Site.Url -Owners $SiteCollAdmin
    Write-host "Added Site Collection Administrator to $($Site.URL)"
}

Add Site Collection Admin to All OneDrive Sites using PnP PowerShell

Similarly, to add a site collection administrator to all OneDrive sites, use:

#Variables for processing
$AdminURL = "https://crescent-admin.sharepoint.com"
$AdminName = "Salaudeen@crescent.com"
  
#Connect to SharePoint Online Admin Center
Connect-PnPOnline -url $AdminCenterURL -Interactive
  
#Get all OneDrive Site colections
$OneDriveSites = Get-PnPTenantSite -IncludeOneDriveSites -Filter "Url -like '-my.sharepoint.com/personal/'" 

Foreach ($Site in $OneDriveSites)
{
    Write-host "Adding Site Collection Admin for:"$Site.URL
    Set-PnPTenantSite -Url $Site.Url -Owners $AdminName
}

Have you added someone by mistake? Want to remove an existing site collection admin from SharePoint Online? Well, You can remove site collection administrator either from a single site or all sites: SharePoint Online: Remove Site Collection Administrator using PowerShell

Best Practices for adding Site Collection Admins

When adding a site collection administrator, it’s essential to consider the following best practices:

• Assign site collection administrator permissions judiciously and only to trusted individuals who require full control over the site collection.
• Follow the principle of least privilege and grant site collection administrator permissions only when necessary.
• Regularly review and audit the list of site collection administrators to ensure that the permissions align with the current organizational structure and security requirements.
• Provide proper training and guidance to newly assigned site collection administrators to ensure they understand their responsibilities and can effectively manage the site collection.
• Implement a governance plan that outlines the policies, procedures, and guidelines for managing site collection administrators in SharePoint Online.

By following these best practices and utilizing the appropriate methods, you can efficiently add and manage site collection administrators in SharePoint Online, ensuring the smooth operation and security of your site collections.

Conclusion

In this blog post, we explored the process of adding a site collection administrator in SharePoint Online. Site collection administrators play a vital role in managing and governing SharePoint Online site collections, and it’s crucial to ensure that the right individuals are assigned this responsibility.

We discussed three main methods for adding a site collection administrator:

1. Using the SharePoint Online User Interface: This method is straightforward and suitable for adding administrators to individual site collections through the site settings page.
2. Using PowerShell: PowerShell provides a powerful and flexible approach to add site collection administrators programmatically. With the Set-SPOUser cmdlet or Add-PnPSiteCollectionAdmin / Set-PnPTenantSite, you can automate the process and perform bulk operations efficiently.
3. Using the SharePoint Online Admin Center: For SharePoint Administrators, the SharePoint Admin Center offers an interface to add site collection administrators.

In conclusion, adding site collection administrators is a critical task that requires careful consideration and planning. By understanding the available methods, following best practices, and implementing a governance framework, you can empower your team to effectively collaborate, share knowledge, and achieve business goals using SharePoint Online.

Related Articles:

• Change Owner/Add Site Collection Administrator to OneDrive for Business Site using PowerShell
• Site Collection Administrators Report for All SharePoint Sites
• Remove site collection administrator in SharePoint 2016 using PowerShell
• Change Site Collection Primary, Secondary Administrators in SharePoint