ShareGate added me everywhere as Site Collection Administrator - how to undo?

[Ivan Unger]

Hi,

So I've tried out ShareGate because I wanted to test their file migration solution.

While doing this it prompted me to add myself as Site Collection Administrator, which I accepted, since I'm already the Global Administrator.

Now I've come to realized that this had an unintended consequence, namely that I'm seeing all documents in Delve from everyone.

I've already removed myself from all classic site collections, but how do I do this for Sites that are connected to Office 365 Groups? 

I've tried connecting with powershell and using

Get-SPOSite -Identity https://tenant.sharepoint.com/sites/groupsitename

but I'm not getting anything. 

[#2]

You should be seeing Group-based sites via PowerShell, which version of the module are you using?

If you have been explicitly added as SC admin, the familiar

Set-SPOUser -LoginName user@domain.com -IsSiteCollectionAdmin $false -Site https://blalba.sharepoint.com/sites/blabla

should work, or just adjust the membership of the Owners group.

[#3 · Accepted solution]

Or, if you want to do it manually for each group, you can go to https://<tenant>.sharepoint.com/sites/<group>/_layouts/15/mngsiteadmin.aspx

[#4]

Thanks Salvatore. I'll do it manually for my groups. 

@Vasil Michev I did remove myself from the group owner/members but that didn't help in case of the sharepoint site collections. I've only lost permission for exchange, but sp remained.

Doing it manually with Salvatores link works.

[#5]

Adding @Benjamin Niaulin from Sharegate to see if he can help with this.

[#6]

I've already received information from ShareGate Support on how to undo this.

Looks like you could undo this with ShareGate, but only if another account (possibly service account) has the permission to change the affected site collections.

I already undid my few group site permissions manually, since I didn't want any other account to have access, except the "Company Administrator" group.

[#7]

Did they send it to you directly, or did they send you a link to a KB?   If so could you post, I want to head  the same problem off at the pass.

[#8]

directly:

All you need to do is to go to the Reporting tool (wrong, it's the Explorer Section), select your environment that you wish to remove the permissions and click on the right-handside of the screen feature ''Remove Permissions''

In the next window, pick your user and select ''Remove Explicit Permissions'' and finally select ''Site Collection Administrator''. Once applied, you have just removed those access to your user account accross your environment.

Keep in mind that you won't have sufficient access rights to run reports in Sharegate anymore nor structural migration as expected.

[#9]

Hi Ivan!

I just wanted to chip in on this since I'm a part of the Sharegate team.

As you mentioned, you can directly run the Remove Permissions operation by right-clicking on the individual site collections from the Explorer view. However depending on the number of site collections you'll want to run the operation on, this can sometimes be more easily achieved using the reporting tool.

It can be used to pull up the list of site collections that fit your desired criteria, select them and then run the Remove Administrators operation on the selection for your desired user account.

In case anyone else in the thread was wondering why we'd add your account to the list of site collection administrators despite it already being a global admin, this is because quite a few of our client-side operations require the SCA permission level explicitly to be run.

Finally, if you want to avoid the addition of your global admin account as a site collection admin by Sharegate, this option can also be toggled on/off from the Settings section of the reporting tool.

[#10]

All good. If Delve hadn't shown everything I shouldn't see I wouldn't have cared. It just took me a while to trace it back to my ShareGate trial.

[#11]

Is there a way via PowerShell to add/remove a user as a Site Collection Administrator on all OneDive personal sites?

[#12]

Yes...here you have a partial solution (only you need to work how to get all the ODFB sites): https://www.petri.com/4-ways-add-secondary-administrator-onedrive-business

[#13]

Hi Rene, Full disclosure I work for Sharegate. You can check out this documentation page, it should help you out :) https://support.share-gate.com/hc/en-us/articles/115000647528-Can-I-remove-myself-as-an-administrato...