What you need to know about SharePoint Administration

“SharePoint Administration” covers a wider scope than most overviews of it actually describe — it’s not one role but a delegated Entra ID role with a specific, bounded scope, a dedicated admin center, and, as of 2026, a genuinely current governance layer on top of both that most administrators haven’t fully explored yet. This post skips the generic best-practices list and goes straight to the parts worth knowing concretely: what the role can and can’t do, and what SharePoint Advanced Management actually adds.

In this post: The SharePoint Administrator role, specifically · Connecting to the tenant admin context · SharePoint Advanced Management: the current governance layer · A practical oversharing check · Site lifecycle and storage governance · When would you actually use this? · Related reading

The SharePoint Administrator role, specifically

SharePoint Administrator is a delegated Entra ID role, not a synonym for Global Administrator — worth being precise about the boundary rather than treating the two as interchangeable. It grants access to the SharePoint admin center, site creation and management, sharing-policy configuration, and Microsoft 365 group management (create, delete, restore, change owners). Global Administrator already includes every one of those permissions plus everything outside SharePoint — Exchange, Entra ID, Azure, tenant-wide security policy — which is exactly why assigning SharePoint Administrator specifically, rather than defaulting people to Global Administrator for SharePoint-only work, is worth doing deliberately: it’s the least-privilege boundary that actually exists for this scope, not just a naming convention.

Connecting to the tenant admin context

Tenant-level cmdlets need a connection to the `-admin` URL specifically, not a regular site — a common source of a confusing “access denied” for someone who’s genuinely a SharePoint Administrator but connected to the wrong endpoint:

Connect-PnPOnline -Url "https://yourtenant-admin.sharepoint.com" -Interactive

# List every site in the tenant, including ones the connecting account isn't a member of
Get-PnPTenantSite | Select-Object Url, Template, StorageUsageCurrent, LastContentModifiedDate

`-Interactive` (not `-UseWebLogin`, removed entirely from `Connect-PnPOnline`) handles MFA correctly for interactive tenant-admin sessions; certificate-based app-only auth is the current recommendation for anything unattended at this scope, given how much tenant-wide access a SharePoint Administrator connection carries.

Worth auditing who actually holds this role periodically, separately from the site-level permission audits covered elsewhere — Entra ID role membership doesn’t show up in a SharePoint permissions report at all, so it’s easy for it to drift unnoticed. Microsoft Graph PowerShell is the current way to check it directly:

Connect-MgGraph -Scopes "RoleManagement.Read.Directory","User.Read.All"

$role = Get-MgDirectoryRole | Where-Object { $_.DisplayName -eq "SharePoint Administrator" }
Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id |
    ForEach-Object { Get-MgUser -UserId $_.Id -Property DisplayName, UserPrincipalName }

Worth running this alongside the same check for Global Administrator — a person holding both is a common, low-visibility case of someone with unnecessarily broad access, since the narrower role was likely assigned first and Global Administrator added later without the SharePoint-specific one ever being removed.

SharePoint Advanced Management is built around three pillars — sprawl control, oversharing control, and lifecycle management — and Microsoft has been actively expanding it through 2026, not treating it as a finished add-on.

SharePoint Advanced Management: the current governance layer

Worth knowing this exists as a real, current, licensed add-on (bundled into some E5/Copilot-adjacent plans, purchasable standalone otherwise) rather than assuming the base admin center covers everything: SharePoint Advanced Management adds Data Access Governance (DAG) reports, automated site lifecycle policies, OneDrive access controls, sensitivity-label-based conditional access, and PowerShell-based download restrictions. Verified as an active, ongoing 2026 expansion rather than a static feature set — a new catalog-management area for organizing sites into categories and scoping policies/reports/Copilot rollout to that structure, plus a dedicated SharePoint Admin Agent, have both been added this year on top of the original three pillars.

A practical oversharing check

Without SharePoint Advanced Management’s DAG reports, a reasonable manual first pass for a specific site collection is checking for “Everyone” or “Everyone except external users” sharing links directly, since those are the highest-exposure links worth surfacing before a full governance rollout:

Connect-PnPOnline -Url "https://yourtenant.sharepoint.com/sites/yoursite" -Interactive

Get-PnPList | ForEach-Object {
    Get-PnPFileSharingLink -List $_.Title -ErrorAction SilentlyContinue |
        Where-Object { $_.Link.Scope -eq "anonymous" -or $_.Link.Scope -eq "organization" }
}

This is a real, workable stopgap for a single site or a handful of them — it doesn’t scale to a full tenant inventory the way DAG’s reports do, since it needs a connection and a loop per site rather than a single tenant-wide report, but it’s worth having as a manual option when the add-on license isn’t in place yet.

Site lifecycle and storage governance

Worth checking the two real, current numbers that constrain any lifecycle-policy decision before setting one: the tenant-wide site collection cap (2 million per tenant) and the per-site-collection storage ceiling (25TB), both current tenant limits. An inactive-site sweep is worth running before committing to an automated archival policy, so the policy targets sites that genuinely haven’t been touched rather than ones that just look quiet:

$cutoff = (Get-Date).AddMonths(-12)
Get-PnPTenantSite | Where-Object { $_.LastContentModifiedDate -lt $cutoff } |
    Select-Object Url, StorageUsageCurrent, LastContentModifiedDate |
    Sort-Object StorageUsageCurrent -Descending

Sorting by storage descending surfaces the sites doing the most damage to the “content sprawl” problem specifically — a large, stale site is a better first candidate for an archival or lifecycle policy than a small one, since it’s returning more storage and more oversharing surface area per action taken.

When would you actually use this?

Assigning tenant-scoped access to someone who only needs SharePoint — the SharePoint Administrator role, not Global Administrator, is the actual least-privilege boundary that fits.
Auditing oversharing risk without a SharePoint Advanced Management license yet — the manual `Get-PnPFileSharingLink` sweep above covers individual sites in the meantime.
Justifying a SharePoint Advanced Management purchase — the DAG reports and automated lifecycle policies genuinely replace the kind of manual per-site scripting shown here at tenant scale, which is worth knowing before dismissing the license as unnecessary.
Prioritizing which stale sites to review first — sorting by storage usage, not just inactivity, surfaces the sites where cleanup returns the most value.

SharePoint Permissions: A Comprehensive Guide — the access-control layer this administration overview sits on top of.
How to Avoid List Throttling in SharePoint — the performance side of the same governance problem.

The role boundary and the admin center are the stable parts of this picture. The governance layer on top of them genuinely isn’t — SharePoint Advanced Management has been actively expanding through 2026, and worth checking its current feature set directly rather than assuming whatever was true when a tenant last reviewed its licensing is still the complete picture.