Forum Discussion
SP Admin role cannot modify O365 groups programmatically
I have a customer where we only have SP Admin role. We don't have global admin rights. Recently MS granted SP Admin role the privileges to create/modify/delete O365 groups and add/remove their owners...
Why would you expect a SharePoint role to get access to additional Exchange cmdlets? The way I understand it, they've granted permissions on Azure AD and possibly the Graph API, which is what's executed from the O365 Admin center anyway. If you want to perform those tasks with the Exchange cmdlets, add the relevant roles (Mail Recipients is sufficient).
- It does have the privilege to do that. If it can do it using the UI, it should be able to do it thru the APIs as well. This might have been overlooked when SP Admin role was given additional privileges for O365 groups recently.
The O365 Admin center UI does NOT use Exchange PowerShell cmdlets to execute group-related tasks though, and having permissions in one tool/API doesn't necessarily mean you should get the corresponding permissions across all. You can always open an uservoice item or leave feedback on the documentation, or just add the relevant permissions yourself.
VasilMichev Thanks. Obviously the UI doesn't use the Powershell but both the UI and Powershell are probably hitting the same backend APIs, probably Graph. Unfortunately, we're limited to SP Admin role and can't be granted additional permissions at this time. Ideally, the New-PnPSite or New-PnpTenantSite could take in an Owners parameter and make them O365 Group Owners if the new site is an O365 Group connected site.
