Block owners in OneDrive

Here a working enforcement script (with reporting to CSV) that you can run weekly or on-demand to automatically strip out extra OneDrive admins and keep track of who was removed.

Ensure each OneDrive has only the licensed user as Site Collection Admin.

Removes any additional site collection admins.

Exports a CSV log showing what was changed.

# ======================================================================
# Script: Enforce-OneDriveOwnerOnly.ps1
# Purpose: Ensure only the OneDrive owner is site collection admin
# Author: [Nikolino]
# ======================================================================

# Connect to SharePoint Online Admin Center
$AdminUrl = "https://YOURTENANT-admin.sharepoint.com"   # <-- change YOURTENANT
Connect-SPOService -Url $AdminUrl

# Output CSV log
$ReportPath = "C:\OneDriveAdminAudit.csv"
$Results = @()

# Get all OneDrive sites in the tenant
$OneDriveSites = Get-SPOSite -IncludePersonalSite $true -Limit All | Where-Object { $_.Url -like "*-my.sharepoint.com/personal/*" }

foreach ($site in $OneDriveSites) {
    Write-Host "Checking OneDrive: $($site.Url)" -ForegroundColor Cyan

    # Get current site admins
    $Admins = Get-SPOUser -Site $site.Url -Limit All | Where-Object { $_.IsSiteAdmin -eq $true }

    foreach ($admin in $Admins) {
        # If admin is not the site Owner, remove them
        if ($admin.LoginName -ne $site.Owner) {
            try {
                Write-Host " - Removing admin $($admin.LoginName) from $($site.Url)" -ForegroundColor Yellow
                Set-SPOUser -Site $site.Url -LoginName $admin.LoginName -IsSiteCollectionAdmin $false -ErrorAction Stop

                # Log result
                $Results += [PSCustomObject]@{
                    SiteUrl    = $site.Url
                    Owner      = $site.Owner
                    RemovedAdmin = $admin.LoginName
                    Action     = "Removed"
                    Timestamp  = (Get-Date)
                }
            }
            catch {
                Write-Host " ! Error removing $($admin.LoginName) from $($site.Url): $_" -ForegroundColor Red
                $Results += [PSCustomObject]@{
                    SiteUrl    = $site.Url
                    Owner      = $site.Owner
                    RemovedAdmin = $admin.LoginName
                    Action     = "Error: $($_.Exception.Message)"
                    Timestamp  = (Get-Date)
                }
            }
        }
    }
}

# Export results to CSV
$Results | Export-Csv -Path $ReportPath -NoTypeInformation -Encoding UTF8

Write-Host "`n=== Completed. Report saved to $ReportPath ===" -ForegroundColor Green

Run this script as a SharePoint Admin or Global Admin.

This does not stop global admins from re-adding themselves later — Microsoft designed it that way.

You can schedule this script (Task Scheduler / Azure Automation) to enforce regularly.

For compliance, enable audit logs in Microsoft Purview to track admin access.

You can extend this script so it emails you a report after it runs (so you don’t have to manually check the CSV).

I hope I have understood (or translated) your request correctly and that this message will help you🙂.