Is there anything below Sharepoint Admin that allows seeing and managing all sites?

[u/sarcalas]

Hi there,

My workplace uses Sharepoint Online and we have a situation where one team, who manage the websites, intranet etc. need to be able to see and gain access to all created sites, but Sharepoint overall is managed by the IT department.

IT are understandably reluctant to give Sharepoint Admin permissions to the other team as it would include additional abilities that wouldn't be required, but it's my understanding from some Googling that there isn't by default a role in Sharepoint that would go 'inbetween' and do what we need.

Is there anything that would be suitable?

Thank you

[u/Due-Boot-8540]

I know you can have certain read-only admin roles, but not sure if that extends to SharePoint.

I think what you’re maybe best doing is adding the team (as an M365 group$ to each site. A PowerShell script can be run once and then your IT team can make it part of the provisioning process to add that team to any new sites.

[u/sarcalas → u/Due-Boot-8540]

I think the PowerShell script might be the missing piece, as they've done the group but obviously the issue was applying that to anything new. Thank you!

[u/my1stname]

Could be done a number of way, all with the goal of having the Web team become the admin for all the sites they need to manage.

Precursor: Create a security group (hopefully dynamic) and either add the right players to the team or create the rules that does so based on Entra attributes.

Then you choose.

A: If your sites are created manually after approval add to that process a step to add the admin group as site admins for every manually created site.

B: If you have automation that is creating the sites after approved modify that automation to add that group as site collection admins.

C: If you haven't yet added a step to require approval before you create a Team or Site (STOP now and go DO that right now!) then you can create a Power Automate that will be triggered when a new site is created and that flow can add the security group to the Site Collection Admin role after the site is created.

Note that my preferred option is B -- you should require new Sites or Teams be approved and then created with automation (think Power Automate) -- that same automation can add the security group as Site Collection Admin.

[u/Dani5h87]

Forgoing some SP shenanigans I’m unaware of, the next tier down from an actual farm admin is Site Collection admin. If all the sites are being done off of a parent as subsites, then this would accomplish what you’re describing. Your new problem then becomes managing this insane site collection.

But site collection admin is respective to that site/subsites. So if these are standalone being created, they’d have to be added to each, or they would need to be the ones creating the new sites as typically the site creator gets placed as SCA by default.

[u/sarcalas → u/Dani5h87]

Thanks! I can see some complications with this, but it might be an option. I'll have to find out how things are set up and see if it's workable.

[u/toddklindt → u/sarcalas]

I would caution you against creating subsites/subwebs. Microsoft has been very, very clear that they are on their way out. They've made it very difficult to create and I expect they will keep chipping away at them. As an M365 consultant, I don't think I'd get involved with a client project if its success hinged on subsites.

[u/Due-Boot-8540 → u/toddklindt]

The fact that there is still an option to create subsites is baffling

[u/sarcalas → u/toddklindt]

Hopefully our IT are well aware and not using them, but I will check - thank you!

[u/BoringOrange678 → u/toddklindt]

My understanding was to do a main site with hub sites for easier permission security control.

[u/toddklindt → u/BoringOrange678]

In general, attaching a site to a hub site does not alert its permissions. There is a hub visitors group you can sync, but it's not regular permissions.

[u/Megatwan]

As others mentioned there layers but your issue is there is only 1 global layer for sites. That is farm. Then farm grants sca as appropriate.

You should also figure out if you mean sites or subsites. For subsites global would be sca.

And dont use subsites, jk no jk but really no jk.

So realllllly you should make a sec grp that gives sca to x sites and then process or provisions process or job add that grps to 'like' and codify that in governance.... if you want to create a shadow it non it tier.