Forum Discussion

Copper Contributor

Sep 30, 2019

SP Admin role cannot modify O365 groups programmatically

I have a customer where we only have SP Admin role. We don't have global admin rights. Recently MS granted SP Admin role the privileges to create/modify/delete O365 groups and add/remove their owners...

groups

Office 365 Groups

ErkanCh

Copper Contributor

Oct 01, 2019

It does have the privilege to do that. If it can do it using the UI, it should be able to do it thru the APIs as well. This might have been overlooked when SP Admin role was given additional privileges for O365 groups recently.

VasilMichev

MVP

Oct 01, 2019

The O365 Admin center UI does NOT use Exchange PowerShell cmdlets to execute group-related tasks though, and having permissions in one tool/API doesn't necessarily mean you should get the corresponding permissions across all. You can always open an uservoice item or leave feedback on the documentation, or just add the relevant permissions yourself.

ErkanCh
Copper Contributor
Oct 03, 2019
VasilMichev Thanks. Obviously the UI doesn't use the Powershell but both the UI and Powershell are probably hitting the same backend APIs, probably Graph. Unfortunately, we're limited to SP Admin role and can't be granted additional permissions at this time. Ideally, the New-PnPSite or New-PnpTenantSite could take in an Owners parameter and make them O365 Group Owners if the new site is an O365 Group connected site.
- VasilMichev
  MVP
  Oct 03, 2019
  They aren't hitting the same APIs. Don't expect the different teams at Microsoft to talk to each other 🙂
  
  Eventually all should be moved to the Graph, but currently we have zero support for any Exchange-related cmdlet there. So if you want to leverage Exchange cmdlets, make sure you have the necessary permissions in Exchange Online.
  
  I'm not sure about the PnP cmdlets, as I'm more of an Exchange guy.