Forum Discussion

ErkanCh's avatar
ErkanCh
Copper Contributor
Sep 30, 2019

SP Admin role cannot modify O365 groups programmatically

I have a customer where we only have SP Admin role. We don't have global admin rights. Recently MS granted SP Admin role the privileges to create/modify/delete O365 groups and add/remove their owners...
groups
Office 365 Groups
VasilMichev's avatar
VasilMichev
MVP
Oct 01, 2019

Why would you expect a SharePoint role to get access to additional Exchange cmdlets? The way I understand it, they've granted permissions on Azure AD and possibly the Graph API, which is what's executed from the O365 Admin center anyway. If you want to perform those tasks with the Exchange cmdlets, add the relevant roles (Mail Recipients is sufficient).

ErkanCh's avatar
ErkanCh
Copper Contributor
Oct 01, 2019
It does have the privilege to do that. If it can do it using the UI, it should be able to do it thru the APIs as well. This might have been overlooked when SP Admin role was given additional privileges for O365 groups recently.
  • VasilMichev's avatar
    VasilMichev
    MVP
    Oct 01, 2019

    The O365 Admin center UI does NOT use Exchange PowerShell cmdlets to execute group-related tasks though, and having permissions in one tool/API doesn't necessarily mean you should get the corresponding permissions across all. You can always open an uservoice item or leave feedback on the documentation, or just add the relevant permissions yourself.

    • ErkanCh's avatar
      ErkanCh
      Copper Contributor
      Oct 03, 2019

      VasilMichev Thanks. Obviously the UI doesn't use the Powershell but both the UI and Powershell are probably hitting the same backend APIs, probably Graph. Unfortunately, we're limited to SP Admin role and can't be granted additional permissions at this time. Ideally, the New-PnPSite or New-PnpTenantSite could take in an Owners parameter and make them O365 Group Owners if the new site is an O365 Group connected site. 

      • VasilMichev's avatar
        VasilMichev
        MVP
        Oct 03, 2019

        They aren't hitting the same APIs. Don't expect the different teams at Microsoft to talk to each other 🙂

         

        Eventually all should be moved to the Graph, but currently we have zero support for any Exchange-related cmdlet there. So if you want to leverage Exchange cmdlets, make sure you have the necessary permissions in Exchange Online.

         

        I'm not sure about the PnP cmdlets, as I'm more of an Exchange guy.