SharePoint Online: Remove Site Collection Administrator using PowerShell

Requirement: Remove Site Collection Administrator using PowerShell in SharePoint Online.

How to remove site collection administrator(s) in SharePoint Online?

As a SharePoint Online administrator, You can remove a site collection administrator from a SharePoint Online site using SharePoint Admin Center or PowerShell. This blog post will demonstrate removing an individual user from the site collection administrator group. It also includes a step-by-step guide with screenshots for removing the Site collection Admin through the Admin center and shares script examples on removing the site collection administrator in SharePoint Online using PowerShell.

How do I delete a site collection admin in SharePoint Online? If you need to remove a site collection administrator from your SharePoint Online sites, you can use a few different methods.

  • The first is to use the web browser interface to remove the site collection admin from the site settings page.
  • The next method you can use to remove a site collection administrator is through the SharePoint Online admin center.
  • Finally, you can use Microsoft PowerShell to remove a site collection administrator.

Remove site collection administrator from through Site Settings

Site collection administrators in SharePoint Online have full control of the entire site collection, including the root site and all the subsites, lists, and libraries in the site collection. To remove a site collection admin, follow these steps:

  1. Login to the SharePoint Online site as a SharePoint Online Administrator or Site Collection Administrator.
  2. Click on the Settings gear icon >> Site information >> and then Site Settings.
  3. Click on the “Site Collection Administrators” link on the site settings page. Here you will see a list of all the users who are members of the site collection administrators group.
    SharePoint Online PowerShell to Remove Site Collection Administrator
  4. Remove unwanted users from the site collection administrators list by clicking the x icon on the user’s right side. Click on “OK” to save your changes.

Once you are done, they will no longer have site collection administrator privileges.

Remove a site owner from SharePoint Online Admin Center

You can also remove a site collection administrator from the SharePoint admin center.

  1. Login to SharePoint admin Center at https://<yourtenant>-admin.sharepoint.com as a SharePoint Administrator or Global Administrator.
  2. Expand Sites >> Active Sites >> Select the site from which you want to remove the site collection administrator.
  3. In the site properties panel, click on the “Permissions” tab >> Click on “Site admins” and click on Manage. (Or click on “Permissions” from the command bar and then Manage Group owners / Additional site Admins on group connected sites).
    remove site collection administrator powershell sharepoint online
  4. Now, you can remove any site collection administrator by clicking on the little x icon. Please note, that you can’t remove the primary admin of the site (and you have to make someone else as primary admin first to remove the existing site admin from the SharePoint Online site).
    PnP PowerShell to remove site collection administrator in sharepoint online

This is how we can remove the site collection admin from a SharePoint Online site. Please note, You can’t remove a SharePoint site owner or Primary Admin, until and unless you add some other user as site admin.

SharePoint Online: PowerShell to Remove a Site Collection Administrator

To remove a user from site collection administrator rights for a particular SharePoint Online site collection, use this PowerShell script in SharePoint Online Management Shell:

#Variables for processing
$AdminURL = "https://crescent-admin.sharepoint.com/"
$AdminAccount="salaudeen@crescent.com"

#Connect to SharePoint Online
Connect-SPOService -url $AdminURL -credential (Get-Credential)

#Get the Site Collection
$Site = Get-SPOSite "https://crescent.sharepoint.com/sites/marketing"

#Remove user from site collection admin
Set-SPOUser -site $Site -LoginName $AdminAccount -IsSiteCollectionAdmin $False 

This will remove the specified user $AdminAccount from the particular site collection’s administrators group. The advantage of using PowerShell is that you can script the process so that it can be easily repeated for multiple users or site collections.

Remove Site Collection Admin from All Site Collections:

Let’s scan and audit all site collections and remove a particular user from the SharePoint site collection administrator group using Windows PowerShell.

Import-Module Microsoft.Online.Sharepoint.PowerShell -DisableNameChecking

#Variables for processing
$AdminURL = "https://crescent-admin.sharepoint.com/" 
$AdminAccount="salaudeen@crescent.com"

#Connect to SharePoint Online
Connect-SPOService -url $AdminURL -credential (Get-Credential)

#Get All Site Collections
$Sites = Get-SPOSite -Limit ALL

#Loop through each site and remove site collection admin
Foreach ($Site in $Sites)
{
    Write-host "Scanning site:"$Site.Url -f Yellow
    #Get All Site Collection Administrators
    $Admins = Get-SPOUser -Site $site.Url | Where {$_.IsSiteAdmin -eq $true}

    #Iterate through each admin
    Foreach($Admin in $Admins)
    {
        #Check if the Admin Name matches
        If($Admin.LoginName -eq $AdminAccount)
        {
            #Remove Site collection Administrator
            Write-host "Removing Site Collection Admin from:"$Site.URL -f Green
            Set-SPOUser -site $Site -LoginName $AdminAccount -IsSiteCollectionAdmin $False
        }
    }
}

Remove user from Site Collection Administrator group using PowerShell – CSOM

Besides the SharePoint Online management shell, we can also use the CSOM script in PowerShell to remove a SharePoint Online site collection administrator.

#Load SharePoint CSOM Assemblies
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.dll"
Add-Type -Path "C:\Program Files\Common Files\Microsoft Shared\Web Server Extensions\16\ISAPI\Microsoft.SharePoint.Client.Runtime.dll"
 
#Variables for Processing
$SiteURL = "https://crescent.sharepoint.com/Sites/marketing"
$UserAccount="i:0#.f|membership|Salaudeen@crescent.com"

#Setup Credentials to connect
$Cred = Get-Credential
$Cred = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($Cred.UserName,$Cred.Password)

#Setup the context
$Ctx = New-Object Microsoft.SharePoint.Client.ClientContext($SiteURL)
$Ctx.Credentials = $Cred

$User = $Ctx.Web.EnsureUser($UserAccount)
$User.IsSiteAdmin = $False
$User.Update()
$Ctx.ExecuteQuery()

Site Collection Administrator in SharePoint Online Modern Team sites and Groups

In SharePoint Online Modern team sites & Groups Sites, the “Site collection Administrators” link is hidden from the UI. However, you can access it by: Click on Settings >> Site Permissions >> Click on “Advanced permissions settings” >> Click on the “Site Collection Administrators” button in the ribbon. (Shortcut URL: https://tenant.sharepoint.com/sites/sitename/_layouts/15/mngsiteadmin.aspx) and remove the site collection admin or use PowerShell as given above!

PnP PowerShell to Remove Site Collection Admin

To remove a user from the site collection administrator’s permissions, use the Remove-PnPSiteCollectionAdmin cmdlet in PnP PowerShell:

#Connect to PnP Online
Connect-PnPOnline -Url "https://crescent.sharepoint.com/sites/marketing" -Interactive

#Remove Site Collection Administrator
Remove-PnPSiteCollectionAdmin -Owners "Charles@Crescent.com"

You can remove multiple Administrators from the site collection with an Array, as:

Remove-PnPSiteCollectionAdmin -Owners @("MargG@Crescent.com", "ThomasS@Crescent.com")

How about removing a user from the site collection admins group of all sites in the tenant?

#Parameters
$TenantAdminURL = "https://Crescent-Admin.SharePoint.com"
$LoginID = "i:0#.f|membership|Steve@Crescent.com"

#Get Credentials to Connect
$Cred = Get-Credential

#Connect to Tenant Admin
Connect-PnPOnline $TenantAdminURL -Credentials $Cred

#Loop through All Site Collections
Get-PnPTenantSite | ForEach-Object {
    Write-Host "Processing Site $($_.Url)..."
    Connect-PnPOnline $_.Url -Credentials $Cred
    $User = Get-PnPUser | Where { $_.LoginName -like $LoginID}
    If($User -ne $Null)
    {
        Remove-PnPSiteCollectionAdmin -Owners $LoginID
        Write-Host "`tRemoved user from Site Collection Administrator Group!" -f Green
    }
}

Please note that all these methods just remove a given user’s site collection administrator permissions from the SharePoint Online site(s). It doesn’t remove the other rights of the user (if he’s given with already). To remove the user or security group from a site collection, use the Remove-SPOUser cmdlet, as in How to Remove a User from SharePoint Online Site?

To add a new site collection administrator in SharePoint Online, use this article: SharePoint Online: Add Site Collection Administrator using PowerShell

How do I get all site collection administrators with PowerShell in SharePoint Online?

To get all site collection administrators: Log in to SharePoint Admin Center, expand “Sites” and “Active Sites”, Select the site from the list, Click on “Permissions” and then choose “Manage Admins”. You can also use PowerShell to get all site collection administrators.
More info: Get site collection administrator using PowerShell in SharePoint Online

How do I change ownership of a SharePoint Online site?

Login to SharePoint Admin center>> Select the site from the Active sites list >> Click on “Permissions” and then “Manage Admins” and then change the primary site collection administrator by assigning someone else as Primary Admin.
More info: How to Change the Site Owner in SharePoint Online?

Salaudeen Rajack

Salaudeen Rajack - Information Technology Expert with Two-decades of hands-on experience, specializing in SharePoint, PowerShell, Microsoft 365, and related products. He has held various positions including SharePoint Architect, Administrator, Developer and consultant, has helped many organizations to implement and optimize SharePoint solutions. Known for his deep technical expertise, He's passionate about sharing the knowledge and insights to help others, through the real-world articles!

5 thoughts on “SharePoint Online: Remove Site Collection Administrator using PowerShell

  • Hi Rajack,

    How can I remove site collection admin accounts that these accounts do not exist in our tenant?

    Much appreciated.
    RH

    Reply
  • Love your content, thank you so much! How would you remove multiple site collection admins from multiple sites?

    Reply
  • Hi, Sir

    How do I remove the Global Administrator and SharePoint Administrator via PowerShell? When I use the ObjectGUID or the DisplayName, it tells me “The user does not exist or is not unique” when attempting to execute via Set-SPOUser.

    When using Remove-SPOUser, I receive “Cannot complete this action”. The only way I can remove it is from the SharePoint Admin portal under Site Admins and via the Site Permissions withing Site Collection Admins. But then that’s both within the GUI. And I don’t want to do that because I have multiple sites being created on the daily. I’m sure you know what that’s like.

    The reason why I’m seeing this is because I’ve created a Service Account as my SharePoint admin and have given it ALL the Administrator access in the Manage Roles except for Global Administrator. And that’s because I just don’t know the bare minimum access I need to grant the account for it to run PnP commands. Please advise, sir.

    Thank you for your time and expertise!

    Reply
    • The account that runs the script must be a site collection Administrator, in order to remove any existing site collection admin. Global Admin doesn’t get site collection admin rights automatically.

      Reply

Leave a Reply

Your email address will not be published. Required fields are marked *