Forum Discussion
Restrict acces to Admins to some sites / libraries
I asked this in the regular community, my mistake.
We are a smaller company committed to Teams on the front end with Sharepoint on the back end. We have three people set up as Admins for Office 365 for Business. I need to restrict access to the content created and managed by a couple of Teams and their libraries from my other two admins, specifically the Leadership private team and the HR team. As it stands, while the admins are not members or owners of these teams / libraries, they can make themselves members and gain access to the restricted data in the libraries. THey are doing good work overall, so I want to be able to selectively remove their Admin capabilities. I have been told that this is not possible which makes no sense in the context of a really large company, let alone a small one.
Can someone please direct me to how to do this?
6 Replies
- It is not possible and this has always been true of IT since the concept of systems administration was a thing decades ago. Systems administrators can grant themselves access or otherwise gain access to underlying data because they're administrators of the system.
Imagine if you had a bad actor and the administrator couldn't take control of that resource...
This is an HR problem, not an IT one. You can look at the Unified Audit Log (or an administrator can/delegated user can) to see if an admin has granted themselves access to a particular resource but you can't prevent it from occurring.I'm going to respectfully disagree Trevor Seward
Having spent more than 40 years in Information and Communication Tech, you don't need to tell me how to boil water. Stratified administration rights are not unusual and have existed in other systems for decades.
I now understand that while Sharepoint does offer multiple levels of admin, there is no clarity in the documentation about who can do what with the data. That's a missing element and bad design.
Checking the audit logs works. It is identical to the old concept of locking the barn door after the horse is gone. And thus, of dubious and limited value.
- When we look at Microsoft/UN*X systems design, this is a universal truth that the sysadmin/root has full control over the system and all data over it. Global Admins are the equivalent (with SharePoint Admin role being scoped to ODfB/SPO).
