How to list site administrators in SharePoint Online

Before you start

Use an account with the SharePoint Administrator role, for PowerShell and for the admin centre. To read a site with Get-SPOUser, Microsoft says the account must also be a site collection administrator of that site. Site administrators, called site admins on Microsoft's current pages, have Full Control and can reach everything in the site.

The lists are read live, so each is a snapshot. The script leaves out OneDrives and sites in the recycle bin. The examples read and export and change nothing. In PowerShell 7 the module must be loaded through Windows PowerShell, which the last line of the install block does.

Option 1

List site administrators with PowerShell

Install the module once, then connect, list the sites and read each site's users for the site administrators. The connection prompts you to sign in, so the script holds no password. Replace contoso with your tenant's name.

# Install once, if the module is not already installed.
Install-Module Microsoft.Online.SharePoint.PowerShell -Scope CurrentUser
# In PowerShell 7 only: load the module through Windows PowerShell.
Import-Module Microsoft.Online.SharePoint.PowerShell -UseWindowsPowerShell

$ErrorActionPreference = 'Stop'
Connect-SPOService -Url 'https://contoso-admin.sharepoint.com'
try {
    $sites = @(Get-SPOSite -Limit All)
    if ($sites.Count -eq 0) {
        Write-Output 'No sites were returned.'
    } else {
        $file = './sharepoint-site-admins.csv'
        $notRead = @()
        $report = @(foreach ($site in $sites) {
            try {
                $users = @(Get-SPOUser -Site $site.Url -Limit All)
            } catch {
                $notRead += $site.Url
                continue
            }
            $admins = @($users | Where-Object { $_.IsSiteAdmin })
            foreach ($admin in $admins) {
                [pscustomobject]@{
                    Site = $site.Title
                    Url = $site.Url
                    Administrator = $admin.DisplayName
                    LoginName = $admin.LoginName
                }
            }
        })
        if ($report.Count -eq 0) {
            Write-Output 'No site administrators were found.'
        } else {
            $report | Export-Csv -Path $file -NoTypeInformation -Encoding utf8
            Write-Output "$($report.Count) site administrators written to $file."
        }
        foreach ($url in $notRead) { Write-Warning "Not read: $url" }
    }
} finally {
    Disconnect-SPOService
}

The CSV has 1 row for each site and administrator. A site the account cannot read is named in a warning at the end; the rest are still exported. To narrow the run, add -Template GROUP#0 to the site list for group sites only; to include OneDrives, add -IncludePersonalSite $true.

Check a single site

Reconnect with Connect-SPOService, then read 1 site. The export above disconnects when it finishes.

# Replace the example address.
Get-SPOUser -Site 'https://contoso.sharepoint.com/sites/research' -Limit All |
    Where-Object { $_.IsSiteAdmin } |
    Select-Object DisplayName, LoginName

Option 2

Review a site's administrators in the admin centre

1. Sign in to the SharePoint admin centre as a SharePoint Administrator.
2. Go to Sites > Active sites and select the site.
3. Select Membership on the command bar to open the details panel.
4. Read the names under Site admins. On a site connected to a Microsoft 365 group, the group's Owners are site admins too.
5. Close the panel without adding or removing anyone, so nothing changes.

This suits 1 site, such as before you change its administrators. It does not suit a whole tenant, since the panel shows 1 site at a time.

Common questions

Why does the script pass -Limit All twice?

Without it Get-SPOSite stops at 200 sites and Get-SPOUser at 500 users, so a site or an administrator can be missed. Microsoft also says that with -Limit some site properties, such as SharingCapability, are not populated; the script uses only each site's address and title. For sharing settings, see how to check external sharing settings in SharePoint Online.

Why does a site show a group, not a person, as its administrator?

Microsoft says the owners of a Microsoft 365 group or team connected to a site are automatically site admins. Altivane shows them as 1 row with the Type Microsoft 365 group owners. To see who they are, read Owners on the site's Membership panel in the admin centre.

Why did a site come back as not read?

Microsoft says Get-SPOUser needs a SharePoint administrator who is also a site collection administrator of the site read. The script names each site it could not read in a warning and exports the rest; Altivane marks the table Partial. Read that site's Membership panel in the admin centre instead.