Understanding the Administrator Role in SharePoint Online

When you sign up for an Office 365 account, you automatically become an Office 365 global administrator and a SharePoint Online Administrator. This global administrator is added to the team site that is automatically created for you during your Office 365 account setup (for example, https://yourcompany.sharepoint.com), and is assigned the site collection administrator role.

One very important point to make here – and this is one of the most common questions on the communities – is that you cannot separate the roles of Office 365 global administrator and SharePoint Online Administrator.

In other words – you being the the Office 365 global administrator (aka the Tenant Admin) cannot redelegate the role of SharePoint Online Administrator  (aka SPO Admin) to another person. What you being the SPO Admin in an E plan *can* do delegation wise, is to delegate the admin rights for a site collection to another person besides yourself. This person in turn can delegate admin rights to sites in the site collection to other persons. But the Tenant Admin cannot delegate the SPO Admin role to someone else.

A site collection is the root of permissions for all the sites (known as subsites) underneath it.

Site collection administrators have permissions to manage SharePoint Online at the site collection level (or top level) of a SharePoint Online site, meaning that their permissions extend to all the content in the site collection that they administer. Also, those permissions are inherited down through all the subsites underneath the site collection, by default. This means changes that site collection administrators make at https://www.contoso.com/ are inherited in subsites like https://www.contoso.com/InformationTechnology.

It’s important to note that a new site collection is its own permissions root. For example, a new top-level site collection created at https://www.contoso.com/sites/Marketplace does not have the same permissions as https://www.contoso.com/.

For more info see the wiki post Permissions in Office 365 FAQ

See also