Understanding the Administrator Role in SharePoint Online

When you sign up for an Office 365 account, you automatically become an Office 365 global administrator and a SharePoint Online Administrator. This global administrator is added to the team site that is automatically created for you during your Office 365 account setup (for example, https://yourcompany.sharepoint.com), and is assigned the site collection administrator role.

One very important point to make here – and this is one of the most common questions on the communities – is that you cannot separate the roles of Office 365 global administrator and SharePoint Online Administrator.

In other words – you being the the Office 365 global administrator (aka the Tenant Admin) cannot redelegate the role of SharePoint Online Administrator  (aka SPO Admin) to another person. What you being the SPO Admin in an E plan *can* do delegation wise, is to delegate the admin rights for a site collection to another person besides yourself. This person in turn can delegate admin rights to sites in the site collection to other persons. But the Tenant Admin cannot delegate the SPO Admin role to someone else.

A site collection is the root of permissions for all the sites (known as subsites) underneath it.

Site collection administrators have permissions to manage SharePoint Online at the site collection level (or top level) of a SharePoint Online site, meaning that their permissions extend to all the content in the site collection that they administer. Also, those permissions are inherited down through all the subsites underneath the site collection, by default. This means changes that site collection administrators make at http://www.contoso.com/ are inherited in subsites like http://www.contoso.com/InformationTechnology.

It’s important to note that a new site collection is its own permissions root. For example, a new top-level site collection created at http://www.contoso.com/sites/Marketplace does not have the same permissions as http://www.contoso.com/.

For more info see the wiki post Permissions in Office 365 FAQ

See also

Comments (9)

  1. Wayne says:

    I don't understand what is "AKA  the Tenant Admin" mean. What is "AKA"? Is global administrator a tenant admin or not?

  2. Daniel says:

    Wayne, AKA means Also Known As.

  3. pankaj says:

    This is a bg concern in a large size enterprise. The tenant admin rights caa ot be given to a SharePoint admin.
    What is the solution. Is this a bug or short sightedness of MS design team

  4. Rob Head says:

    I completely agree with Pankaj. The role of SharePoint Administrator should not mean you are also a Global Admin. That is ludicrous in a large organisation. Am I missing something?

  5. Kjetil says:

    This is so strange. They keep saying go for Office 365, but SharePoint Online is extremely limiting in so many important ways!

  6. LesIsMore says:

    This is not true for the MySites site collection

  7. Macathulus Kaid says:

    This is stupid. There is no technical reason for this limitation.

  8. KaL EL says:

    There’s a workaround, you can use the powershell cmdlet below:

    Set-SPOUser -Site https://YourDomain-admin.sharepoint.com -LoginName SharePointAdminUser@YourDomain.com -IsSiteCollectionAdmin $true