No way to set Site Admins with PnP PowerShell or SPO PowerShell

[LenCardinal]

There seems to be no way to add site collection admins with either of the PowerShell libraries(PnP or SPO). Both libraries have versions of Set-SPO[Tenant]Site which allow setting many site collection properties, but not the admins.

Scenario is separation of duty of "site provisioners" and site owners/admins. A person who creates a site should not be the "owner" of the site. in SPO admin center, the creator can create a site with a designated owner, and then add SC admins, such as a Support group. This cannot be automated using POSH with the existing libraries (Feb 2016 build).

Hopefully I missed something, and perhaps I need to look at referencing the CSOM DLL's within POSH directly?

[KoenZomers]

Not sure what exactly you're trying to accomplish, but couldn't you achieve it by using Add-SPOUserToGroup to add members to the site owners group and perhaps tweaking the rights of that group using Set-SPOGroupPermissions?

[LenCardinal]

Goal is to write a provisioning script that includes an Azure AD group in site collection administrators.

CSOM has an API for adding AD groups to site collection administrators, but neither of the POSH libraries do.

[KoenZomers]

Then it would be really easy to add it to the POSH library :) How handy are you with coding yourself? Will you be able to make a fork and add the functionality?

[LenCardinal]

Getting up to speed...I've already identified where to put it in OfficeDevPnP.PowerShell.Commands.csproj, a peer to the "SetTenantSite" class in project . Still looking for the CSOM API, which I thought I had.... Should I give it a shot? :-)

[KoenZomers]

Sure who not, live and learn ;-) Feel free to post back here in case you need help or would like me to add it for you.

[erwinvanhunen]

It's a relative minor change. I can do it, but if you want to give it a try yourself, go ahead :-)

I propose to add another parameter to the Set-SPOTenantSite cmdlet (https://github.com/OfficeDev/PnP-PowerShell/blob/dev/Commands/Admin/SetTenantSite.cs). If you add a parameter of type List<string>called Owners then you can check if that variable is not null. If not null, make a call to Tenant.AddAdministrators() which is located in the Core component: https://github.com/OfficeDev/PnP-Sites-Core/blob/master/Core/OfficeDevPnP.Core/AppModelExtensions/TenantExtensions.cs#L488

[ibondy]

I like the Set-SPOTenantSite cmdlets approach, easy and clean. Definitely got my vote.

[LenCardinal]

I would have voted for that too, but the pattern in the CSOM and SPO POSH libraries, for some reason, is to separate the two. In CSOM, the API ultimately is "SetSiteAdmin". in SPO POSH, there is a Set-SPOUser which has a parameter of "IsSiteCollectionAdmin"....

I just realized that my issue is that Set-SPOUser takes a LoginName, and I'm trying to find the format when trying to pass it an AD Group. The LoginName returned by Get-SPOUser is an IID, which Set-SPOUser does not like... If I figure out Set-SPOUser, maybe we do not need this new function, though a wrapper that accepts a _name _ instead of IID would be desirable, I would think.

[LenCardinal]

Holy smokes...he group's full claims-encoded format (i.e. 'c:0-.f|rolemanager|s-1-5-21-631661150-2199996492-2488949705-31628748') is needed to pass an AD group to Set-SPOUser.

What's more...one does not need to add the group first to the site via one of the variants of "Add-SPOUser"...

Now to find out how to generically get the claims-encoded name for any Azure AD group by name, when the group is not already in a site.

I'm taking a break...will consider forking the code, but still prototyping what needs to get done here. Thanks for listening to me whine.

[LenCardinal]

FYI, I forked...I compiled. Running into some questions around Erwin's suggestion. First, AddAdministrators() takes a collection of Core.Entities.UserEntity objects. Should I expose that as a cmdlet parameter, or convert from an array of strings? Second, as a _user _of this new parameter...I'm not sure if the core extensions will accept groups specified by display name, or require the claims-encoded format that Set-SPOUser seems to require, also used by provisioning template (i.e, 'c:0-.f|rolemanager|s-1-5-21-631661150-2199996492-2488949705-31628748'). Is there any cmdlet that resolve an Azure AD group name to the SPO claims format? If not, I'm not sure how useful this will be.

    [Parameter(Mandatory = false)]
    public System.Collections.Generic.List<Core.Entities.UserEntity> Owners = null;

    protected override void ExecuteCmdlet()
    {
        Tenant.SetSiteProperties(Url, title:Title, sharingCapability: Sharing, storageMaximumLevel: StorageMaximumLevel, allowSelfServiceUpgrade: AllowSelfServiceUpgrade, userCodeMaximumLevel: UserCodeMaximumLevel, userCodeWarningLevel: UserCodeWarningLevel);
        if (Owners!=null)
        {
            Tenant.AddAdministrators(adminLogins:Owners, siteUrl:Url);
        }
    }

[B0tmaster]

This should help; https://msdn.microsoft.com/en-us/library/azure/jj151815.aspx

[bryonchan]

Hi,
Just adding this comment to help others looking for this:
The OOTB Powershell cmdlet Set-SPOUser llets you add a user as a site collection administrator, just do this:

Set-SPOUser -Site 'https://www.contoso.com/sites/intranet' -LoginName 'user@contoso.com' -IsSiteCollectionAdmin $true

I assume tenant administrator level is needed.

[LenCardinal]

Yeah, the challenge was with adding an Azure AD group. The API would not take the group name initially; it wanted the group's UID. What ended up working was to first create the SPOUser using the group name, and then getting the LoginName property:

           $adminGroup = New-SPOUser -LoginName $SiteCollectionAdministrators
            $u = Set-SPOUser -Site $targetSiteURL -LoginName $adminGroup.LoginName -IsSiteCollectionAdmin $true

Does that look like overkill?

[bryonchan]

In my experience with Sharepoint so far, whatever works!

I had trouble finding the powershell way of setting the SCA even just for one user, so just thought I'd put that snippet in this thread in case it helped someone else.

[LenCardinal]

Yeah, thanks for posting the update; I think I updated Yammer but forgot to circle back here.

As for the issue here, this could be changed to a feature request - add to the PnP POSH command to automatically perform the group name resolution I posted above