Office 365 - Enable admin to access to all students OneDrive documents

[bassnote]

Can I globally set a Site Collection Administrators?

 

 

Has anyone got any idea of how to I globally set the "Site Collection Administrators" to individual users profiles so I can to enable admin access to all students OneDrive documents?

 

 

What I want to achieve is to, as an admin, access my all of my students documents that they put in there OneDrive.

 

 

The only way that I have been able to find to do this so far is doing the following steps:

 

 

1) Log in as an admin

2) Goto Sharepoint Management

3) In "User Profiles" click "Manage User Profiles"

4) Search for my test user

5) Click on test user and goto to "Manage Site Collection Owners"

6) Add admin account in "Site Collection Administrators"

 

 

Now you can see that users files from the OneDrive by selecting the user again and this time clicking 'Manage Personal Site' then you can click on their 'Documents'

 

 

Is there:

1) any easy way to automate this?? or preference to enable this by default?

2) a simple solution that I can't find!!

 

 

Thanks for any help / advice / hints!

 

 

Peter

[bassnote]

I have also posted this on the Office365 forum - Enable admin to access to all students OneDrive documents - Can I globally set a Site Collection Administrators? | Manage Office 365 | Microsoft Office 365 Community

 

Someone from Microsoft have given an answer, confirming that it is only possible to do user by user. Or detailed a way to get users to add admin to there accounts.

 

I'm not alone in wanting access to my students OneDrive's?? True PolicyCentral will pick issues up issues.

 

I do hope everyone will appreciate the change to Office365 when its rolled out!

 

[Bongo]

peter did you find a solution to this issue. I too would really like to access the pupils onedrive and manually doing 1400 is

[bassnote]

Not yet I'm afraid, I haven't had a change to look into it further yet either.

[Bongo]

I have just managed to find a script that someone cleverer than me wrote ;

 

This script assigns all 'Company Administrators' as Owners on every user's personal site I have changed the script so that the Company domain is 'YourDomain.com'. Also, if your Admins' email addresses aren't the same as their UPNs, you'll need to amend the script accordingly... ########### $objCreds = Get-Credential Connect-SPOService -Url https://yourdomain-admin.sharepoint.com -credential $objCreds Connect-MSOLService -credential $objCreds $objRole = Get-MsolRole -RoleName "Company Administrator" $colAdmins = Get-MsolRoleMember -RoleObjectId $objRole.ObjectId | Select EmailAddress $colUsers = Get-MSOLUser -All | Select UserPrincipalName foreach ($objUser in $colUsers){ $strUser = $objUser.userprincipalname $intPos = $strUser.IndexOf("@") $strUser = $strUser.SubString(0, $intPos) $strSite = "https://yourdomain-my.sharepoint.com/personal/" + $strUser $strSite = $strSite + "_yourdomain_com" foreach ($objAdmin in $colAdmins){ Set-SPOUser -Site $strSite -LoginName $objAdmin.EmailAddress -IsSiteCollectionAdmin $true } } Write-Host "Press any key to continue ..." $x = $host.UI.RawUI.ReadKey("NoEcho,IncludeKeyDown") ############

 

I have tried putting my school domain in but am not getting any joy and not having delved too deep into PowerShell it is just confusing me! Maybe one of the many guys who is more familiar with the scripting of PS can get it working?

 

Simon

[Achandler]

Did anyoen ever get this to work, I've used a different script today with limited success.

[halbaradkenafin]

Did anyoen ever get this to work, I've used a different script today with limited success.

I had a script to do this, I'll try to dig it out when I get to a real PC.

[Achandler]

I think the script I have works, as it worked on most users, the ones it didn't work on I suspect is because they don't have a personal onedrive yet (basically they haven't clicked on OneDrive, so I need to find a way to force the creation of them for everyone

[pete]

I think the script I have works, as it worked on most users, the ones it didn't work on I suspect is because they don't have a personal onedrive yet (basically they haven't clicked on OneDrive, so I need to find a way to force the creation of them for everyone

 

From here (you need the prerequisites, maximum of 200 at a time (and leave it a while in-between runs): https://technet.microsoft.com/en-us/library/dn800987.aspx

 

$loadInfo1 = [system.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client")
$loadInfo2 = [system.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.Runtime")
[system.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.UserProfiles")

#Must be SharePoint Administrator URL
$webUrl = "https://domain-admin.sharepoint.com"
$ctx = New-Object Microsoft.SharePoint.Client.ClientContext($webUrl)

$web = $ctx.Web
$username = "[email protected]"
write-host "Please enter your password"
$password = read-host -AsSecureString

$ctx.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($username,$password )

$ctx.Load($web)
$ctx.ExecuteQuery()

$loader =[Microsoft.SharePoint.Client.UserProfiles.ProfileLoader]::GetProfileLoader($ctx)

#To Get Profile
$profile = $loader.GetUserProfile()
$ctx.Load($profile)
$ctx.ExecuteQuery()
$profile 

#To enqueue Profile
$loader.CreatePersonalSiteEnqueueBulk(@("[email protected]","[email protected]","[email protected]")) 
$loader.Context.ExecuteQuery()

Write-Host "COMPLETED" 

[ITAdmin]

I think the script I have works, as it worked on most users, the ones it didn't work on I suspect is because they don't have a personal onedrive yet (basically they haven't clicked on OneDrive, so I need to find a way to force the creation of them for everyone

 

Do you mind sharing the script?

[Achandler]

Of course, I now have two scripts. One similar to the above that sorts permissions but also a second one that pre-creates the drives. So basically you can create everyone's onedrive and then add an account as an administrator.

 

I'll upload them on Monday, I've been off today.

[Achandler]

Similar to what @pete posted up there, there will be laods of errors though if people don't have a "personal" sharepoint yet, e.g they have never clicked on "OneDrive" when accessing their Offic365 accounts.

 

You can sort out the first issue, and bascially create peoples OneDrive using the below code, there are a couple of pre-requisites as you will imagine,. such as you need to know people email addresses first (there might be an automatic way to get them from Office365), but I used Excel to create a comma delimited list of them and copied and pastes it in, I've capitalised what needs changing:

 

$loadInfo1 = [system.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client")
$loadInfo2 = [system.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.Runtime")
[system.Reflection.Assembly]::LoadWithPartialName("Microsoft.SharePoint.Client.UserProfiles")

#Must be SharePoint Administrator URL
$webUrl = "https://YOURSHAREPOINTDOMAIN-admin.sharepoint.com"
$ctx = New-Object Microsoft.SharePoint.Client.ClientContext($webUrl)

$web = $ctx.Web
$username = "[email protected]"
write-host "Please enter your password"
$password = read-host -AsSecureString

$ctx.Credentials = New-Object Microsoft.SharePoint.Client.SharePointOnlineCredentials($username,$password )

$ctx.Load($web)
$ctx.ExecuteQuery()

$loader =[Microsoft.SharePoint.Client.UserProfiles.ProfileLoader]::GetProfileLoader($ctx)

#To Get Profile
$profile = $loader.GetUserProfile()
$ctx.Load($profile)
$ctx.ExecuteQuery()
$profile 

#To enqueue Profile

$loader.CreatePersonalSiteEnqueueBulk(@("[email protected]", "[email protected]", "[email protected]")) 
$loader.Context.ExecuteQuery()

Write-Host "COMPLETED" 

 

Then to add permissions to each home drive you can use:

 

$objCreds = Get-Credential

Connect-SPOService -Url https://YOURSHAREPOINTDOMAIN-admin.sharepoint.com -credential $objCreds

$colUsers = Get-SPOUser -Site https://YOURSHAREPOINTDOMAIN-my.sharepoint.com/ | Where-Object {$_.LoginName -like '*YOURDOMAIN.COM*'}

$colUsers = $colUsers.LoginName | ForEach-Object { $_.TrimEnd("YOURDOMAIN.COM") } | ForEach-Object { $_.TrimEnd("@") }

$colUsers | ForEach-Object { Set-SPOUser -Site https://YOURSHAREPOINTDOMAIN-my.sharepoint.com/personal/"$_"_YOURDOMAIN_COM/ -LoginName [email protected] -IsSiteCollectionAdmin $true }

 

 

One of the key bits that I kept getting the wrong way round was some require your sharepoint domain, and some require your email address domain etc. This is also limited to 200 people as @pete stated earlier, I'm going to attempy to do it to my students at some point, which means I'll need to adjsut what I used appropiately.