Skip to content
Browse

/commands/sharepoint-online/set-spouser-site-collection-admin

Set-SPOUser -IsSiteCollectionAdmin: add a site collection admin in SharePoint Online or OneDrive

verified onenvironmentlocal · windows 10.0.26200 arm64 · GNU bash 5.3.15 (Git Bash)updated
tool
SharePoint Online PowerShell
versions
Microsoft.Online.SharePoint.PowerShell 16.0.27709.12000
os
windows

To make someone a site collection administrator of a SharePoint Online site or a OneDrive, connect to the admin URL and run Set-SPOUser -Site SITE-URL -LoginName UPN -IsSiteCollectionAdmin $true. Use $false to remove the right again. The cmdlet is in the SharePoint Online Management Shell module (Microsoft.Online.SharePoint.PowerShell) and needs the SharePoint Administrator role or higher.

powershell
Connect-SPOService -Url https://contoso-admin.sharepoint.com
Set-SPOUser -Site https://contoso.sharepoint.com/sites/finance -LoginName adele@contoso.com -IsSiteCollectionAdmin $true
Get-SPOUser -Site https://contoso.sharepoint.com/sites/finance -LoginName adele@contoso.com | Select-Object LoginName, IsSiteAdmin

Replace contoso, the site URL and the UPN with your own. The last line confirms the change: IsSiteAdmin is True.

The parameter is a Boolean, not a switch

-IsSiteCollectionAdmin takes $true or $false. The block checks the parameter types in module version 16.0.27709.12000 and shows the binding error you get when the value is missing, which PowerShell raises before it contacts SharePoint. A word such as yes fails too, with Cannot convert 'System.String' to the type 'System.Boolean':

powershell
Import-Module Microsoft.Online.SharePoint.PowerShell -DisableNameChecking
$p = (Get-Command Set-SPOUser).Parameters
'Site', 'LoginName', 'IsSiteCollectionAdmin' | ForEach-Object { '{0,-22} {1}' -f $_, $p[$_].ParameterType.Name }
'Get-SPOUser output IsSiteAdmin: ' + [Microsoft.Online.SharePoint.PowerShell.SPOUser].GetProperty('IsSiteAdmin').PropertyType.Name
$site = 'https://contoso.sharepoint.com/sites/finance'
try { Set-SPOUser -Site $site -LoginName adele@contoso.com -IsSiteCollectionAdmin -ErrorAction Stop } catch { $_.Exception.Message }
try { Set-SPOUser -Site $site -LoginName adele@contoso.com -IsSiteCollectionAdmin $true -ErrorAction Stop } catch { $_.Exception.Message }

Output

Site                   SpoSitePipeBind
LoginName              String
IsSiteCollectionAdmin  Boolean
Get-SPOUser output IsSiteAdmin: Boolean
Missing an argument for parameter 'IsSiteCollectionAdmin'. Specify a parameter of type 'System.Boolean' and try again.
No connection available. Use Connect-SPOService before running this CmdLet.

The last message is what every SharePoint Online cmdlet prints before Connect-SPOService has run; see No connection available.

Common tasks

TaskCommand
Add a site collection adminSet-SPOUser -Site URL -LoginName UPN -IsSiteCollectionAdmin $true
Remove itSet-SPOUser -Site URL -LoginName UPN -IsSiteCollectionAdmin $false
Access a OneDriveSame command with -Site https://contoso-my.sharepoint.com/personal/user_contoso_com
Add a guest-LoginName in the #ext# form, for example adelev_fabrikam.com#ext#@contoso.onmicrosoft.com
List the admins of a siteGet-SPOUser -Site URL -Limit All | Where-Object IsSiteAdmin
Change the primary adminSet-SPOSite -Identity URL -Owner UPN

Add one admin to every site

powershell
Get-SPOSite -Limit All | ForEach-Object {
  Set-SPOUser -Site $_.Url -LoginName helpdesk@contoso.com -IsSiteCollectionAdmin $true | Out-Null
}

Get-SPOSite leaves OneDrive sites out by default; add -IncludePersonalSite $true to include them. Granting one account admin rights on every site is broad access, so prefer a dedicated account and remove it when the task is done.

Pitfalls

  • -Site must be the full site URL, not the admin URL and not a library or page URL. Other strings fail with a SpoSitePipeBind conversion error; see Cannot convert value to type SpoSitePipeBind.
  • Connect-SPOService must target https://TENANT-admin.sharepoint.com; a site URL produces Current site is not a tenant administration site.
  • Microsoft states that Set-SPOUser is not supported with granular delegated admin privileges (GDAP), so partners administering a customer tenant through GDAP need another route.
  • The module is for Windows PowerShell 5.1. In PowerShell 7 on Windows, import it with -UseWindowsPowerShell.

FAQ

How do I give an admin access to a departed user's OneDrive?

Run Set-SPOUser with -Site set to the OneDrive URL (https://TENANT-my.sharepoint.com/personal/USER_contoso_com), -LoginName set to the admin's UPN and -IsSiteCollectionAdmin $true. Remove the access afterwards with $false.

Does Set-SPOUser change the site owner?

No. It adds or removes a secondary site collection administrator. The primary administrator (Owner) is changed with Set-SPOSite -Identity URL -Owner UPN.

Why does -IsSiteCollectionAdmin without a value fail?

It is a Boolean parameter, not a switch. Write -IsSiteCollectionAdmin $true or $false; on its own it fails with 'Missing an argument for parameter IsSiteCollectionAdmin'.

Sources

Related pages

errors · sharepoint-onlineNo connection available. Use Connect-SPOService before running this CmdLet.SharePoint Online Management Shell cmdlets like Get-SPOSite and Set-SPOTenant need a session. Run Connect-SPOService with your tenant's -admin URL first.errors · sharepoint-onlineGet-SPOSite: Cannot bind parameter 'Identity'. Cannot convert value to type "SpoSitePipeBind"SPO cmdlets such as Get-SPOSite and Set-SPOSite take only the full site URL in -Identity. A title, a /sites/ path, a URL without https or an object fails.errors · sharepoint-onlineConnect-SPOService : Current site is not a tenant administration site.Connect-SPOService needs the admin center URL, https://TENANT-admin.sharepoint.com, not a site or the root URL. Use the -admin host and a SharePoint admin.commands · sharepoint-onlineGet-SPOSite storage usage: StorageUsageCurrent and StorageQuota for every siteGet-SPOSite -Limit All lists each site's StorageUsageCurrent and StorageQuota in MB. Add -IncludePersonalSite for OneDrive; set quotas with Set-SPOSite.