3 ways to make a user a Site Collection Administrator

Today I want to explain how to make a user a Site Collection Administrator. Just to be clear, we are talking about Site Collection administrators, not site owners/administrators. To make sure we are on the same page, please reference this post to understand the difference between sites and site collections. So we are talking about pretty serious stuff here – Site Collection Admins by default have access to all sites within a site collection and can pretty much do whatever they wish (without being explicitly added to any site security groups)

Why you need to assign someone Site Collection Administrative privileges

There could be several reasons. First, you might need a backup (in case you are away on vacation or win a lottery). Second, in case if you have multiple site collections,  in your tenant/environment, you might have one user in charge of one site collection (i.e. Project Portal) and another in charge of another (Intranet Portal). So might be a good way to separate administrative responsibilities. Or, you might be a multi-company environment all under the same tenant/domain and would like to split the duties among different business entities.

How to make a user a Site Collection Administrator?

Whatever the reason is, there are a few ways to do this. Each option has its pros and cons which I will outline below.

Option 1: Via Office 365 User Role in Office 365 Admin Center

The easiest way to make a user a site collection admin is to assign him or her a SharePoint Administrator User Role in Office 365. To do this:

1. Make sure you are a Global Office 365 Administrator yourself
2. From Office 365 App Launcher, click on Admin Tile
3. Under Users, click on Active Users
4. Click a checkbox next to user you want to make a Site Collection Admin
5. In the user pop-up screen, under Roles, click Edit
6. In the next window, click on Customized administrator, then SharePoint Administrator. Very important: do not click Global Administrator radio button. This will assign a user Global Office 365 Admin rights, which means the user will have same Admin privileges just like you and will have Global Admin access to not just SharePoint, but also other Office 365 assets like Mail (Exchange), Yammer, Skype, Azure Ad and so on.
7. Click Save

This option will grant a user Admin Access to the whole SharePoint Admin Center. Though initially, the user might not have access to all the custom site collections, he/she can easily grant access himself/herself using the steps outlined in Option 2 below. So in case you want to make someone an admin with access to ALL the site collections this very option is the one to choose. By the way, by granting user SharePoint Admin access using this option, will add the user to special domain group/role called SharePoint Service Administrator. I explained this group in a previous blog post.

If you truly want to split admin responsibilities and only give user Admin access to a given site collection, keep reading.

Option 2: Via SharePoint Admin Center

If you want to grant named users unique access to specific site collections, then you need to grant unique access to the Site Collection via SharePoint Admin Center. To do this:

1. Navigate to SharePoint Admin Center, by clicking on SharePoint under Admin Centers
2. Click on checkbox next to the site collection and then Owners button
3. In the pop-up, under Site Collections Administrators section, type the name of the individual and then click OK.

Unlike Option 1, this option above will give a user Admin access to just this one site collection and not all of them. Use this option if you want to give a user admin access to just the specific site collection without access to the SharePoint Admin Center itself.

Option 3: Via Site Settings at the root of a Site Collection

This other option is no different than Option 2, just a different way to assign site collection admin privileges. Instead of going through the SharePoint Admin Center via Office 365, you can assign admin privileges via Site Settings inside of a site collection. To do this:

1. Navigate to the root of a site collection (the most top level site)
2. Click on Gear Icon > Site Settings
3. Under Users and Permissions, click on Site collection administrators
4. Add users in the window, click OK

Once again, this option is same as Option 2, just a different way to achieve the same thing.

Best Practices

1. Don’t grant more access than you should. If I were to ask for $10, would you give me $5,000? Unless you just smoked weed, you probably would not. Don’t make someone a Site Collection Administrator if all they need is Admin access to just one subsite. I have seen situations where an admin assistant for a CEO for one of my clients had been assigned Site Collection Admin privileges and as a result, had full Admin access to 100+ subsites within a site collection just because she needed to manage one little site for Executives. A pretty dangerous lady in my books!
2. Understand the difference between Site Collection Administrator and SharePoint Administrator. Option 1 above is quite different from Options 2 and 3 in terms of the admin coverage a user would get – so make an informed decision! If a user needs Admin access to just a specific site collection, use Options 2 and 3, do not use Option 1 and give a user Admin access to the whole SharePoint farm (all the site collections)!
3. Less is better. Sometimes, when I do SharePoint assessments for my clients, I check the number of Administrators for a given site collection, and it looks like Black Friday sale at Walmart®. I have seen 5-6 and in one instance 10 users being Site Collection administrators of a single site collection! There is absolutely no reason for this unless you don’t care about your Intellectual Property. 1-2 Admins for a site collection is more than enough in many instances.