Grant someone "View only admin" access to SharePoint config?

Question

Someone else in my organization is conducting an audit of the configuration/settings for our SharePoint Online service. For them to get all the config information they need for the audit, I want them to be able to access my SharePoint administrative settings i.e. everything in mydomain-admin.sharepoint.com and everything available through the Get-SPOXXX commands in SharePoint Online PowerShell, on a view-only basis.

I gave them a user account with Global Reader and Security Reader access in M365 core, and View Only everything in Exchange to conduct similar audits, but see no equivalent setting for SharePoint. They get a 401 Access Denied error when they try to log into SharePoint Admin.

What would be the best way to grant them View access to all of our SharePoint config without giving them an overly permissive role like Global Admin or Sharepoint Admin?

Answer 1

The Global reader role should support the SPO admin center now, but it doesnt support OneDrive yet. I dont believe it grants you access to PowerShell though.

Answer 2

The Global Reader role does not support the SharePoint Admin Center/SharePoint Online PowerShell currently (as I confirm from testing).
Users will need SharePoint Admin role assigned to have access to the SharePoint Admin Center for the time being, referring to the document here: About the SharePoint admin role in Microsoft 365.

You can see another open issue related: Global Reader Role doesn't work with SharePoint Online nor PowerShell #57508.

In addition, a new feature named “SharePoint: Administration - Azure Active Directory Global Reader role” is currently in the status of “Rolling out”, which should fix this issue by the time it finishes launching: https://www.microsoft.com/en-us/microsoft-365/roadmap?filters=&searchterms=Global%2CReader

---

If an Answer is helpful, please click "Accept Answer" and upvote it.
**Note: Please follow the steps in our documentation to enable e-mail notifications if you want to receive the related email notification for this thread. **

Answer 3

Global Reader is the only "view only" role available. If it doesn't provide the necessary access, then your only other option is the SharePoint Admin role.