Recently create Global Admin account is now showing in all SharePoint/One Drive

Josh Stokes 20

Hello everyone,

I have recently created a new GA account in our tenant. It is not assigned to any Azure Roles, Devices, Licenses or groups.

The odd thing is, is that this new GA account has assigned itself against everyone's OneDrive 'Site Collection Admin' and also as 'Site Admin' under all our SharePoint sites...

I have not ran any scripts since adding this GA account, and our IT team is only small (5 of us) and not all have GA access.

Is there a way this has happened automatically? Or something a staff member could have done without meaning too?

Any feedback/support on this would be great thank you.

I am within the IT Dept. so have access to troubleshoot etc.

Sunil Dahiya 1 Reputation point

2024-07-09T06:16:27.8933333+00:00

Please check Audit logs in Microsoft Entra

1 answer

RaytheonXie_MSFT 36,091 Reputation points Microsoft Vendor

2024-07-08T02:42:43.7266667+00:00

Hi @Josh Stokes,

Per my research, this might be someone assigned the permission. By default, Global Administrators and SharePoint Administrators don't have automatic access to all sites and each user's OneDrive, but they can give themselves access to any site or OneDrive. They can also use Microsoft PowerShell to manage SharePoint and OneDrive. For more details, you could refer to following document

https://learn.microsoft.com/en-us/sharepoint/sharepoint-admin-role#site-management

If the answer is helpful, please click "Accept Answer" and kindly upvote it. If you have extra questions about this answer, please click "Comment".

Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread.
Please sign in to rate this answer.
Josh Stokes 20 Reputation points

2024-07-09T06:02:00.6166667+00:00

Thanks for the reply. I have found that this is from a recent Application we have started using, ShareGate. Where it has allowed the GA account to have access and be added to everyone's Site Collection, and is listed under the Admin section of this.

Do you know if there is an easy way to remove the GA account from everyone's Site Collection??

Thank you in advance for your help with this one!

RaytheonXie_MSFT 36,091 Reputation points Microsoft Vendor

2024-07-11T07:37:57.0133333+00:00

Hi @Josh Stokes,

You can scan and audit all site collections and remove a particular user from the SharePoint site collection administrator group using Windows PowerShell.

Import-Module Microsoft.Online.Sharepoint.PowerShell -DisableNameChecking #Variables for processing $AdminURL = "https://xxx-admin.sharepoint.com/" $AdminAccount="xxx@yyyy.com" #Connect to SharePoint Online Connect-SPOService -url $AdminURL -credential (Get-Credential) #Get All Site Collections $Sites = Get-SPOSite -Limit ALL #Loop through each site and remove site collection admin Foreach ($Site in $Sites) { Write-host "Scanning site:"$Site.Url -f Yellow #Get All Site Collection Administrators $Admins = Get-SPOUser -Site $site.Url | Where {$_.IsSiteAdmin -eq $true} #Iterate through each admin Foreach($Admin in $Admins) { #Check if the Admin Name matches If($Admin.LoginName -eq $AdminAccount) { #Remove Site collection Administrator Write-host "Removing Site Collection Admin from:"$Site.URL -f Green Set-SPOUser -site $Site -LoginName $AdminAccount -IsSiteCollectionAdmin $False } } }

RaytheonXie_MSFT 36,091 Reputation points Microsoft Vendor

2024-07-16T01:37:40.78+00:00

Hi @Josh Stokes,

Would you tell me whether your issue has been resolved or have any update? If you have any questions or progress, you can contact me in time.
Sign in to comment

Use comments to ask for clarification, additional information, or improvements to the question.

Share via

Recently create Global Admin account is now showing in all SharePoint/One Drive

1 answer

Your answer