Why don't O365 Groups (SharePoint) respect Global Admin / SharePoint Admin settings?

Silver Contributor

We have a team of Global SharePoint Admins that support SharePoint across the board.  If the user is a Global Admin or a  SharePoint Admin, why can they not access an O365 SharePoint Site without being assigned as a direct member of the group?

10 Replies

No clue, I've also learned, that I have to be Member to see content, as Owner doesn't seem to be enough of a priviledge.

The workaround could be to assign those users to Groups sites as Site Collection Administrators using PowerShell

Confirmed it worked

Even things like changing regional settings from the UI get access denied as a SCA. Lots of work to rationalize what "really" is this restricted Group SharePoint site versus an actual SharePoint site

Mmm...weird, I'm not having this problem...there are some other folks seeing this same problem ( @Salvatore Biscari) I have just done an experiment consisting on adding as site collection admin a user that it's not event a member of the group and It worked like a charm...I think we are missing here a practical guidance of what can / should be done in regards of security in Groups...it's not enough to hide administrative options for people like us cc @Christophe Fiessinger

Please, can you share how did you confirm it worked, exactly?

I am under the impression that it appears to work but t doesn't actually work...

Just started a session in Office 365 with the user that previously could not access to the Group site and once the user is granted as a site collection administrator, he/she can browse the site with no problems
I mean it gave the user access to the SharePoint site, but it is a limited admin capability. Like you have mentioned, some things you can do, and others you can't, which doesnt make sense to me. An admin should be an admin.
So just confirmed on another tenant and another Group the same behavior you are seeing: not able to modify regional settings no matter if I'm a Site Collection Admin or not...the only differences I can think between the Group where it's working and the one where it's not working are clearly two:
(1) Different tenants, so maybe different versions (at least in SharePoint)
(2) Groups were created at very different time...the one where it's working was created when Groups were launched and the one where it's not working was created two months ago

Confirmed that Get-SPOUser does not work with Group Sites...and I think it can be something expected due to the "special" nature of Group sites (as happens with Office 365 Video channels)...remember that in the beginning Get-SPOSite and Set-SPOSite didn't work too, but Office 365 Video fixed them to be able to update site properties and these same changes where also right for Groups

Juan, thank you very much for your testing: now we have an authoritative statement about this problem!

What now? Are these kind of things going to be fixed?

Frankly, I really don't get the purpose of this ambiguous and partial "weakening" of the administrative capabilities for Groups...