Office 365: Add accounts into the Site collection administrators list via PowerShell and CSOM

%3CLINGO-SUB%20id%3D%22lingo-sub-58186%22%20slang%3D%22en-US%22%3EOffice%20365%3A%20Add%20accounts%20into%20the%20Site%20collection%20administrators%20list%20via%20PowerShell%20and%20CSOM%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-58186%22%20slang%3D%22en-US%22%3E%3CP%3ETo%20add%20accounts%20(group%20or%20User)%20into%20the%20SPO%20SIte%20collection%20admin%20via%20code%2C%20there%20are%202%20possible%20solutions%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CSTRONG%3EVia%20PowerShell%20and%20SPO%20Admin%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3EReally%20simple%20case%20ideal%20for%20one%20shot%20action%2C%20you%20need%20to%20know%20the%20exact%20User%2Fgroup%20ID%20of%20the%20SPO%20account%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3ESet-SPOUser%20-Site%20https%3A%2F%2Ftenant.sharepoint.com%2Fsites%2FMyCollection%20-IsSiteCollectionAdmin%20%24true%20%E2%80%93LoginName%20%E2%80%9Cc%3A0-.f%7Crolemanager%7Cs-1-1-11-11111111-111111-111111-1111%E2%80%9D%3C%2FPRE%3E%3CP%3E%3CSTRONG%3EVia%20PowerShell%20and%20CSOM%3C%2FSTRONG%3E%3C%2FP%3E%3CP%3EThis%20script%20is%20more%20generic%20and%20can%20be%20added%20into%20a%20provisionning%20script%20you%20will%20have%20to%20use%20for%20your%20own%20needs%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%3E%5Bstring%5D%24username%20%3D%20%22AdminAccount%40tenant.onmicrosoft.com%22%20%0A%5Bstring%5D%24PwdTXTPath%20%3D%20%22D%3A%5CExportedPWD-%24(%24username).txt%22%20%0A%5Bstring%5D%24SPOSiteCollectionURLToSet%20%3D%20https%3A%2F%2Ftenant.sharepoint.com%2Fsites%2FMyCollection%0A%0A%23c%3A0-.f%7Crolemanager%7Cs-1-1-11-11111111-111111-111111-1111%20-%20Company%20Administrator%20%0A%5Bstring%5D%24CompanyAdministratorLogin%20%3D%20%22c%3A0-.f%7Crolemanager%7Cs-1-1-11-11111111-111111-111111-1111%22%0A%0A%23%20c%3A0-.f%7Crolemanager%7Cs-1-1-11-11111111-111111-111111-22222-%20SharePoint%20Service%20Administrator%20%0A%5Bstring%5D%24SharePointServiceAdministratorLogin%20%3D%20%22c%3A0-.f%7Crolemanager%7Cs-1-1-11-11111111-111111-111111-22222%22%0A%0Afunction%20Load-DLLandAssemblies%20%0A%7B%20%0A%20%20%20%20%5Bstring%5D%24defaultDLLPath%20%3D%20%22%22%0A%0A%20%20%20%20%23%20Load%20assemblies%20to%20PowerShell%20session%0A%0A%20%20%20%20%24defaultDLLPath%20%3D%20%22C%3A%5CProgram%20Files%5CSharePoint%20Online%20Management%20Shell%5CMicrosoft.Online.SharePoint.PowerShell%5CMicrosoft.SharePoint.Client.dll%22%20%0A%20%20%20%20%5BSystem.Reflection.Assembly%5D%3A%3ALoadFile(%24defaultDLLPath)%0A%0A%20%20%20%20%24defaultDLLPath%20%3D%20%22C%3A%5CProgram%20Files%5CSharePoint%20Online%20Management%20Shell%5CMicrosoft.Online.SharePoint.PowerShell%5CMicrosoft.SharePoint.Client.Runtime.dll%22%0A%20%20%20%20%5BSystem.Reflection.Assembly%5D%3A%3ALoadFile(%24defaultDLLPath)%0A%0A%20%20%20%20%24defaultDLLPath%20%3D%20%22C%3A%5CProgram%20Files%5CSharePoint%20Online%20Management%20Shell%5CMicrosoft.Online.SharePoint.PowerShell%5CMicrosoft.Online.SharePoint.Client.Tenant.dll%22%0A%20%20%20%20%5BSystem.Reflection.Assembly%5D%3A%3ALoadFile(%24defaultDLLPath)%20%0A%7D%0A%0A%0AFunction%20Add-Group-In-SiteCollectionAdmin()%20%0A%7B%20%0A%20%20%20%20Param(%20%0A%20%20%20%20%20%20%20%20%5BParameter(Mandatory%3D%24true%2CPosition%3D1)%5D%5BMicrosoft.SharePoint.Client.ClientContext%5D%24Context%2C%20%0A%20%20%20%20%20%20%20%20%5BParameter(Mandatory%3D%24true%2CPosition%3D2)%5D%5Bstring%5D%24SPUserOrGroupLogin%20%0A%20%20%20%20)%20%0A%20%20%20%20Write-Host%20%22%20---------------------------------------------------------%22%0A%0A%20%20%20%20%24MyspUser%20%3D%20%24Context.Web.EnsureUser(%24SPUserOrGroupLogin)%3B%20%0A%20%20%20%20%24MyspUser.IsSiteAdmin%20%3D%20%24true%3B%20%0A%20%20%20%20%24MyspUser.Update()%20%0A%20%20%20%20%24Context.Load(%24MyspUser)%20%0A%20%20%20%20%23send%20the%20request%20containing%20all%20operations%20to%20the%20server%20%0A%20%20%20%20try%7B%20%0A%20%20%20%20%20%20%20%20%24context.executeQuery()%20%0A%20%20%20%20%20%20%20%20write-host%20%22%20%26gt%3B%26gt%3B%26gt%3B%20info%3A%20User%20or%20Group%20Name%20added%20in%20Site%20Collection%20admin%3A%20%5B%24(%24MyspUser.Title)%5D%22%20-foregroundcolor%20green%20%0A%20%20%20%20%7D%20%0A%20%20%20%20catch%7B%20%0A%20%20%20%20%20%20%20%20write-host%20%22info%3A%20%24(%24_.Exception.Message)%22%20-foregroundcolor%20red%20%0A%20%20%20%20%7D%0A%0A%20%20%20%20Write-Host%20%22%20---------------------------------------------------------%22%20%0A%7D%0A%0Afunction%20SetGroupAsAdministrator(%5Bstring%5D%24MyRootWebURL)%20%0A%7B%20%0A%20%20%20%20%5Bbool%5D%24CreateSGSDocLibList%20%3D%20%24false%20%0A%20%20%20%20%0A%20%20%20%20%24Myctx%20%3D%20New-Object%20Microsoft.SharePoint.Client.ClientContext(%24MyRootWebURL)%20%0A%20%20%20%20%24secureStringPwd%20%3D%20ConvertTo-SecureString%20-string%20(Get-Content%20%24PwdTXTPath)%20%0A%20%20%20%20%24creds%20%3D%20New-Object%20System.Management.Automation.PSCredential%20-ArgumentList%20%24username%2C%20%24secureStringPwd%20%0A%20%20%20%20%24Myctx.Credentials%20%3D%20New-Object%20Microsoft.SharePoint.Client.SharePointOnlineCredentials(%24creds.UserName%2C%24creds.Password)%0A%20%20%20%20%24Myctx.RequestTimeout%20%3D%201000000%20%23%20milliseconds%20%0A%20%20%20%20%24MyspoRootweb%20%3D%20%24Myctx.Web%20%0A%20%20%20%20%24Myctx.Load(%24MyspoRootweb)%20%0A%20%20%20%20%24Myctx.ExecuteQuery()%0A%0AWrite-Host%20%22%20%22%20%0AWrite-Host%20%22%20---------------------------------------------------------%22%20%0AWrite-Host%20%22%20%20%26gt%3B%26gt%3B%26gt%3B%26gt%3B%20%23%20Server%20Version%3A%22%20%24Myctx.ServerVersion%20%22%20%23%20%26lt%3B%26lt%3B%26lt%3B%26lt%3B%26lt%3B%26lt%3B%22%20-ForegroundColor%20Green%20%0AWrite-Host%20%22%20---------------------------------------------------------%22%20%0AWrite-Host%20%22%20%22%0A%0A%20%20%20%20Add-Group-In-SiteCollectionAdmin%20-Context%20%24Myctx%20-SPUserOrGroupLogin%20%24CompanyAdministratorLogin%20%0A%20%20%20%20Add-Group-In-SiteCollectionAdmin%20-Context%20%24Myctx%20-SPUserOrGroupLogin%20%24SharePointServiceAdministratorLogin%0A%0A%7D%20%0Acls%20%0ALoad-DLLandAssemblies%0A%0ASetGroupAsAdministrator%20%24SPOSiteCollectionURLToSet%3C%2FPRE%3E%3CP%3EFabrice%20Romelard%20%5BMVP%5D%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CEM%3EOriginal%20article%20(in%20French)%3A%3C%2FEM%3E%3C%2FP%3E%3CUL%3E%3CLI%3E%3CEM%3E%3CA%20title%3D%22Office%20365%3A%20Ajouter%20un%20utilisateur%20ou%20groupe%20dans%20la%20liste%20des%20Site%20collection%20Administrator%20d%E2%80%99un%20site%20SharePoint%20Online%20via%20PowerShell%20et%20CSOM%22%20href%3D%22http%3A%2F%2Fblogs.developpeur.org%2Ffabrice69%2Farchive%2F2017%2F02%2F24%2Foffice-365-ajouter-un-utilisateur-ou-groupe-dans-la-liste-des-site-collection-administrator-d-un-site-sharepoint-online-via-powershell-et-csom.aspx%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3EOffice%20365%3A%20Ajouter%20un%20utilisateur%20ou%20groupe%20dans%20la%20liste%20des%20Site%20collection%20Administrator%20d%E2%80%99un%20site%20SharePoint%20Online%20via%20PowerShell%20et%20CSOM%3C%2FA%3E%3C%2FEM%3E%3C%2FLI%3E%3C%2FUL%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%3CEM%3EAssociated%20WebPages%3A%3C%2FEM%3E%3C%2FP%3E%3CUL%3E%3CLI%3E%3CEM%3E%3CA%20href%3D%22http%3A%2F%2Fsharepoint.stackexchange.com%2Fquestions%2F114421%2Fcan-i-use-set-spouser-to-set-an-o365-security-group-as-a-secondary-site-collecti%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttp%3A%2F%2Fsharepoint.stackexchange.com%2Fquestions%2F114421%2Fcan-i-use-set-spouser-to-set-an-o365-security-group-as-a-secondary-site-collecti%3C%2FA%3E%3C%2FEM%3E%3C%2FLI%3E%3CLI%3E%3CEM%3E%3CA%20href%3D%22https%3A%2F%2Fblogs.msdn.microsoft.com%2Fmimorr%2F2014%2F01%2F22%2Fadding-site-collection-admin-in-csom-in-a-sharepoint-2013-app%2F%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fblogs.msdn.microsoft.com%2Fmimorr%2F2014%2F01%2F22%2Fadding-site-collection-admin-in-csom-in-a-sharepoint-2013-app%2F%3C%2FA%3E%3C%2FEM%3E%3C%2FLI%3E%3C%2FUL%3E%3C%2FLINGO-BODY%3E%3CLINGO-LABS%20id%3D%22lingo-labs-58186%22%20slang%3D%22en-US%22%3E%3CLINGO-LABEL%3EAdmin%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPermissions%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3EPowerShell%3C%2FLINGO-LABEL%3E%3CLINGO-LABEL%3ESharePoint%20Online%3C%2FLINGO-LABEL%3E%3C%2FLINGO-LABS%3E%3CLINGO-SUB%20id%3D%22lingo-sub-175800%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%3A%20Add%20accounts%20into%20the%20Site%20collection%20administrators%20list%20via%20PowerShell%20and%20CSOM%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-175800%22%20slang%3D%22en-US%22%3EIf%20you%20get%20the%20Site%20object%20of%20the%20site%2C%20you%20can%20then%20get%20the%20group%20id%20from%20the%20.GroupId%20property.%3CBR%20%2F%3E%3CBR%20%2F%3Evar%20site%20%3D%20context.Site%3B%3CBR%20%2F%3Econtext.Load(site%2C%20s%3D%26gt%3Bs.GroupId)%3B%3CBR%20%2F%3Econtext.ExecuteQuery()%3B%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-175796%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%3A%20Add%20accounts%20into%20the%20Site%20collection%20administrators%20list%20via%20PowerShell%20and%20CSOM%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-175796%22%20slang%3D%22en-US%22%3E%3CP%3EIs%20it%20possible%20to%20retrieve%20the%20Group%20ID%20using%20CSOM%20%3F%26nbsp%3BI%20dont%20find%20any%20attribute%20in%20the%20Group%20class%20for%20the%20same.%20There%20is%20id%20attribute%20however%2C%20it%20is%20just%20number.%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-59061%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%3A%20Add%20accounts%20into%20the%20Site%20collection%20administrators%20list%20via%20PowerShell%20and%20CSOM%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-59061%22%20slang%3D%22en-US%22%3EAs%20i%20said%20you%2C%20it's%20another%20way%3CBR%20%2F%3ESo%20thank%20you%3CBR%20%2F%3EFab%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-59049%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%3A%20Add%20accounts%20into%20the%20Site%20collection%20administrators%20list%20via%20PowerShell%20and%20CSOM%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-59049%22%20slang%3D%22en-US%22%3EAnything%20PnP%20is%20close%20to%20the%20model%2C%20as%20it%20uses%20CSOM...just%20removes%20plumbing%20for%20you%20in%20many%20scenarios%20with%20extension%20methods.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-59035%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%3A%20Add%20accounts%20into%20the%20Site%20collection%20administrators%20list%20via%20PowerShell%20and%20CSOM%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-59035%22%20slang%3D%22en-US%22%3EThanks%20for%20this%20comment%3CBR%20%2F%3EIt's%20another%20way%2C%20but%20from%20my%20side%20i%20prefer%20to%20be%20closed%20to%20the%20csom%20object%20model%3CBR%20%2F%3EFab%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-58736%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%3A%20Add%20accounts%20into%20the%20Site%20collection%20administrators%20list%20via%20PowerShell%20and%20CSOM%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-58736%22%20slang%3D%22en-US%22%3EOr%20use%20the%20PnP%20commandlets%20%3A)%3C%2Fimg%3E%20%3CA%20href%3D%22https%3A%2F%2Fgithub.com%2FSharePoint%2FPnP-PowerShell%2Fblob%2Fmaster%2FDocumentation%2FSetPnPTenantSite.md%22%20target%3D%22_blank%22%20rel%3D%22noopener%20noreferrer%22%3Ehttps%3A%2F%2Fgithub.com%2FSharePoint%2FPnP-PowerShell%2Fblob%2Fmaster%2FDocumentation%2FSetPnPTenantSite.md%3C%2FA%3E%20-owners%20param%20to%20set%20site%20collection%20admins.%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1099170%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%3A%20Add%20accounts%20into%20the%20Site%20collection%20administrators%20list%20via%20PowerShell%20and%20CSOM%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1099170%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F41498%22%20target%3D%22_blank%22%3E%40Gabriel%20Smoljar%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESorry%20for%20that%2C%20but%20as%20you%20can%20see%20into%20that%20publication%20created%20long%20time%20ago.%3C%2FP%3E%3CP%3E%26gt%3B%20Microsoft%20is%20changing%20the%20SharePoint%20management%20way%20and%20CSOM%20is%20probably%20not%20anymore%20the%20best%20approach%20to%20manage%20Administrative%20permission.%3C%2FP%3E%3CP%3E%26gt%3B%20Site%20Collection%20administrator%20is%20also%20now%20out%20of%20vision%20defined%20with%20TEAMS%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESo%20all%20that%20strategical%20change%20define%20by%20Microsoft%20since%20years%20could%20explain%20why%20this%20kind%20of%20command%2Fscript%2Fcode%20could%20be%20not%20usable%20anymore.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ECan%20you%20check%20with%20PnP%20instead%20of%20%3F%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3ESorry%20for%20that%3C%2FP%3E%3CP%3EFab%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1098401%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%3A%20Add%20accounts%20into%20the%20Site%20collection%20administrators%20list%20via%20PowerShell%20and%20CSOM%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1098401%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F41125%22%20target%3D%22_blank%22%3E%40Fabrice%20Romelard%3C%2FA%3E%26nbsp%3BThis%20method%20fails%20for%20me%20with%20the%20error%20%22The%20user%20does%20not%20exist%20or%20is%20not%20unique%22.%20Same%20with%20Set-PnPTenantSite%20and%20Set-SPOUser%20as%20suggested%20by%26nbsp%3B%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F34%22%20target%3D%22_blank%22%3E%40Mikael%20Svenson%3C%2FA%3E.%20I%20tested%20this%20on%20two%20tenants%2C%20one%20that%20automatically%20assigns%20these%20roles%20as%20site%20admins%20for%20new%20sites%20and%20one%20that%20don't%20and%20the%20behavior%20is%20the%20same.%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EExample%20code%3A%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CPRE%20class%3D%22lia-code-sample%20language-csharp%22%3E%3CCODE%3EConnect-PnPOnline%20%3CA%20href%3D%22https%3A%2F%2Fcontoso-admin.sharepoint.com%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcontoso-admin.sharepoint.com%3C%2FA%3E%0ASet-PnPTenantSite%20-Url%20%3CA%20href%3D%22https%3A%2F%2Fcontoso.sharepoint.com%2Fproject%22%20target%3D%22_blank%22%20rel%3D%22nofollow%20noopener%20noreferrer%22%3Ehttps%3A%2F%2Fcontoso.sharepoint.com%2Fproject%3C%2FA%3E%20-Owners%20%22c%3A0-.f%7Crolemanager%7Cs-1-1-11-11111111-111111-111111-1111%22%3C%2FCODE%3E%3C%2FPRE%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3C%2FLINGO-BODY%3E%3CLINGO-SUB%20id%3D%22lingo-sub-1114448%22%20slang%3D%22en-US%22%3ERe%3A%20Office%20365%3A%20Add%20accounts%20into%20the%20Site%20collection%20administrators%20list%20via%20PowerShell%20and%20CSOM%3C%2FLINGO-SUB%3E%3CLINGO-BODY%20id%3D%22lingo-body-1114448%22%20slang%3D%22en-US%22%3E%3CP%3E%3CA%20href%3D%22https%3A%2F%2Ftechcommunity.microsoft.com%2Ft5%2Fuser%2Fviewprofilepage%2Fuser-id%2F41125%22%20target%3D%22_blank%22%3E%40Fabrice%20Romelard%3C%2FA%3E%26nbsp%3B%3C%2FP%3E%3CP%3E%26nbsp%3B%3C%2FP%3E%3CP%3EI%20did%20some%20digging%20and%20found%20that%20the%20login%20names%20are%20no%20longer%20applicable.%20Now%20they%20are%20in%20the%20form%20%22c%3A0t.c%7Ctenant%7C32e1b7a8-foob-are8-8fb7-827c407110c0%22%20where%20the%20guid%20at%20the%20end%20is%20the%20object%20id%20of%20the%20directory%20role%20you%20want%20to%20add.%20You%20can%20find%20these%20using%20Get-AzureADDirectoryRole%20PowerShell%20command.%20They%20are%20different%20for%20each%20tenancy%20unfortunately.%3C%2FP%3E%3C%2FLINGO-BODY%3E
Regular Contributor

To add accounts (group or User) into the SPO SIte collection admin via code, there are 2 possible solutions:

 

Via PowerShell and SPO Admin

Really simple case ideal for one shot action, you need to know the exact User/group ID of the SPO account:

 

Set-SPOUser -Site https://tenant.sharepoint.com/sites/MyCollection -IsSiteCollectionAdmin $true –LoginName “c:0-.f|rolemanager|s-1-1-11-11111111-111111-111111-1111”

Via PowerShell and CSOM

This script is more generic and can be added into a provisionning script you will have to use for your own needs:

 

[string]$username = "AdminAccount@tenant.onmicrosoft.com" 
[string]$PwdTXTPath = "D:\ExportedPWD-$($username).txt" 
[string]$SPOSiteCollectionURLToSet = https://tenant.sharepoint.com/sites/MyCollection

#c:0-.f|rolemanager|s-1-1-11-11111111-111111-111111-1111 - Company Administrator 
[string]$CompanyAdministratorLogin = "c:0-.f|rolemanager|s-1-1-11-11111111-111111-111111-1111"

# c:0-.f|rolemanager|s-1-1-11-11111111-111111-111111-22222- SharePoint Service Administrator 
[string]$SharePointServiceAdministratorLogin = "c:0-.f|rolemanager|s-1-1-11-11111111-111111-111111-22222"

function Load-DLLandAssemblies 
{ 
    [string]$defaultDLLPath = ""

    # Load assemblies to PowerShell session

    $defaultDLLPath = "C:\Program Files\SharePoint Online Management Shell\Microsoft.Online.SharePoint.PowerShell\Microsoft.SharePoint.Client.dll" 
    [System.Reflection.Assembly]::LoadFile($defaultDLLPath)

    $defaultDLLPath = "C:\Program Files\SharePoint Online Management Shell\Microsoft.Online.SharePoint.PowerShell\Microsoft.SharePoint.Client.Runtime.dll"
    [System.Reflection.Assembly]::LoadFile($defaultDLLPath)

    $defaultDLLPath = "C:\Program Files\SharePoint Online Management Shell\Microsoft.Online.SharePoint.PowerShell\Microsoft.Online.SharePoint.Client.Tenant.dll"
    [System.Reflection.Assembly]::LoadFile($defaultDLLPath) 
}


Function Add-Group-In-SiteCollectionAdmin() 
{ 
    Param( 
        [Parameter(Mandatory=$true,Position=1)][Microsoft.SharePoint.Client.ClientContext]$Context, 
        [Parameter(Mandatory=$true,Position=2)][string]$SPUserOrGroupLogin 
    ) 
    Write-Host " ---------------------------------------------------------"

    $MyspUser = $Context.Web.EnsureUser($SPUserOrGroupLogin); 
    $MyspUser.IsSiteAdmin = $true; 
    $MyspUser.Update() 
    $Context.Load($MyspUser) 
    #send the request containing all operations to the server 
    try{ 
        $context.executeQuery() 
        write-host " >>> info: User or Group Name added in Site Collection admin: [$($MyspUser.Title)]" -foregroundcolor green 
    } 
    catch{ 
        write-host "info: $($_.Exception.Message)" -foregroundcolor red 
    }

    Write-Host " ---------------------------------------------------------" 
}

function SetGroupAsAdministrator([string]$MyRootWebURL) 
{ 
    [bool]$CreateSGSDocLibList = $false 
    
    $Myctx = New-Object Microsoft.SharePoint.Client.ClientContext($MyRootWebURL) 
    $secureStringPwd = ConvertTo-SecureString -string (Get-Content $PwdTXTPath) 
    $creds = New-Object System.Management.Automation.PSCredential -ArgumentList $username, $secureStringPwd 
    $Myctx.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($creds.UserName,$creds.Password)
    $Myctx.RequestTimeout = 1000000 # milliseconds 
    $MyspoRootweb = $Myctx.Web 
    $Myctx.Load($MyspoRootweb) 
    $Myctx.ExecuteQuery()

Write-Host " " 
Write-Host " ---------------------------------------------------------" 
Write-Host "  >>>> # Server Version:" $Myctx.ServerVersion " # <<<<<<" -ForegroundColor Green 
Write-Host " ---------------------------------------------------------" 
Write-Host " "

    Add-Group-In-SiteCollectionAdmin -Context $Myctx -SPUserOrGroupLogin $CompanyAdministratorLogin 
    Add-Group-In-SiteCollectionAdmin -Context $Myctx -SPUserOrGroupLogin $SharePointServiceAdministratorLogin

} 
cls 
Load-DLLandAssemblies

SetGroupAsAdministrator $SPOSiteCollectionURLToSet

Fabrice Romelard [MVP]

 

Original article (in French):

 

Associated WebPages:

9 Replies
Thanks for this comment
It's another way, but from my side i prefer to be closed to the csom object model
Fab
Anything PnP is close to the model, as it uses CSOM...just removes plumbing for you in many scenarios with extension methods.
As i said you, it's another way
So thank you
Fab

Is it possible to retrieve the Group ID using CSOM ? I dont find any attribute in the Group class for the same. There is id attribute however, it is just number.

If you get the Site object of the site, you can then get the group id from the .GroupId property.

var site = context.Site;
context.Load(site, s=>s.GroupId);
context.ExecuteQuery();

@Fabrice Romelard This method fails for me with the error "The user does not exist or is not unique". Same with Set-PnPTenantSite and Set-SPOUser as suggested by @Mikael Svenson. I tested this on two tenants, one that automatically assigns these roles as site admins for new sites and one that don't and the behavior is the same.

 

Example code:

 

Connect-PnPOnline <a href="https://contoso-admin.sharepoint.com" target="_blank">https://contoso-admin.sharepoint.com</a>
Set-PnPTenantSite -Url <a href="https://contoso.sharepoint.com/project" target="_blank">https://contoso.sharepoint.com/project</a> -Owners "c:0-.f|rolemanager|s-1-1-11-11111111-111111-111111-1111"

 

@Gabriel Smoljar 

Sorry for that, but as you can see into that publication created long time ago.

> Microsoft is changing the SharePoint management way and CSOM is probably not anymore the best approach to manage Administrative permission.

> Site Collection administrator is also now out of vision defined with TEAMS

 

So all that strategical change define by Microsoft since years could explain why this kind of command/script/code could be not usable anymore.

 

Can you check with PnP instead of ?

 

Sorry for that

Fab

@Fabrice Romelard 

 

I did some digging and found that the login names are no longer applicable. Now they are in the form "c:0t.c|tenant|32e1b7a8-foob-are8-8fb7-827c407110c0" where the guid at the end is the object id of the directory role you want to add. You can find these using Get-AzureADDirectoryRole PowerShell command. They are different for each tenancy unfortunately.