OneDrive Management Without GA

[foofighterjim]

I have been looking at this off and on for a while now, but just can't seem to crack it.

 

I have a technician who uses admin.microsoft.com for day to day management of users, we leverage PIM if they need to do anything more than password management. What I would like to do is, allow them to access to the OneDrive tab (and the URL) for user accounts.

 

Initial reading suggested that granting the SharePoint Administrator role was what was required, but unfortunately they still get access denied when navigating to the OneDrive tab. After delving a little deeper, it looks like with the SharePoint administrator role, they can search for the account within SharePoint Admin and then modify the accounts OneDrive permissions to grant themselves access, but this doesn't scale well if they need to do this several times a day, not to mention making sure the permissions are removed again afterwards. From what I can see, it only appears to be GA's that have the ability I am looking for, I have reviewed the GA permission set, but I can't see the specific Role permission (or combination of) that actually makes this work, as I could then add this into a custom role to keep the level of privilege down.

 

Just to clarify, this is what I would like the technician to be able to access:

 

[Olliedawg]

Following

[psydii]

Rather than access to this tab, you might be able to achieve a self-service access to a user's one drive with some groups and a one-off script

 

Have the GA greate one group per user onedrive, something lines of

od_SiteCollectionAdministrator_USERNAME

For each user grant the appropriate group admin rights to the user's mysite collection (onedrive)

 

Then the helpdesk tech can add themselves to the appropriate group to get access and remove themselves afterwards as necessary.  The GA or whoever oversees the tech can run another script daily to check the memberships of the od_...SCA ..._username groups is as expected (in general empty!)

 

 

DANGER LURKS BELOW:

You might be able to have these groups set up as Time-Based (Temporary) Group Membership in Active Directory | Windows OS Hub, but there are two caveats 1) in certain scenarios enabling this feature can absolutely hammer your DCs -  so test  it in a replica of your domain first. 2) I don't know whether current membership of these groups is sync'd into Entra.

 

[foofighterjim]

11 minutes ago, psydii said:

Rather than access to this tab, you might be able to achieve a self-service access to a user's one drive with some groups and a one-off script

 

Have the GA greate one group per user onedrive, something lines of

od_SiteCollectionAdministrator_USERNAME

For each user grant the appropriate group admin rights to the user's mysite collection (onedrive)

 

Then the helpdesk tech can add themselves to the appropriate group to get access and remove themselves afterwards as necessary.  The GA or whoever oversees the tech can run another script daily to check the memberships of the od_...SCA ..._username groups is as expected (in general empty!)

 

Not a bad idea, although that would involve a lot of groups for us, come September we are will have over 4,000 students and 500 staff on our tenancy. Still, it is something to think about and we can possibly automate creating some of this with Salamander. As for the time based groups, we're cloud only.