Create a Flow to change Site Collection Admin assignment

[JuanSimon]

Hi all,

I need to solve this puzzle:

When an employee leaves the company, he has a OneDrive account with a SharePoint site linked to it.

The idea is to create a Flow to make the Manager the new SharePoint site collection admin.

This way he has the option to either delete it or take ownership of it. Wondering if I would be able to do that with the SharePoint trigger: Grant access to an item or a folder?

Will it work for our manager in this case since he does not have the access to the SharePoint site, to begin with? or should I use PowerShell for this requirement?

Thank you,

JS

[abm]

Hi @JuanSimon 

Grant access to an item or a folder is giving permission to a specific folder or item. In your case you need to add a user to give full permission of the list or library. For that you need to use Send an HTTP trigger to SharePoint action step. Please see below. 

How to manage permissions on a SharePoint List Item using Microsoft Flow – Add Contribute permission...

[JuanSimon]

Hi, your link does not provide the solution to change the Collection Admin.

You can manually reassign the employee's OneDrive: Step 4 - Give another employee access to OneDrive and Outlook data - Microsoft 365 admin | Microsoft... 

I wonder if it is possible through Azure AD (where we have a group with a manager attached to it.)?

Has anyone automated it this?

Is this a desktop flow/PowerShell job only due to security concerns?

Thanks,

Juan Simon

[Anonymous]

Flow is possible.

Steps to complete this in flow are:
1. Create an action to ensure the user can be added to the site collection.

Action:Send an HTTP request to SharePoint
Site Address: OneDrive user files in default form of http://$domain-my.sharepoint.com/personal/[myuser_stuff_com
The SiteAddress: onedrive url can be obtained from M365 Admin center -> Active users -> OneDrive -> get access to files
Method: POST
URI: _api/web/ensureuser
Headers:
content-type: application/json;odata=verbose
accept:application/json;odata=verbose
Body:
{
"logonName":"BarrySwitzer@DallasCowboys.com"
}
2. Insert action of parse json 
3. Compose action
Inputs: ID from Parse json action
4. Action: Send an HTTP request to SharePoint 2
SiteAddress: url obtained from m365admin center
Method:POST
URI:
_api/web/getuserbyid([ID from compose action above]) - Note: this is inside parentheses without 's or "s
Headers:
content-type: application/json;odata=verbose
accept:application/json;odata=verbose
{
'__metadata': {
'type': 'SP.User'
},
'IsSiteAdmin': true
}

Using out of the box commands with powershell gallery library microsoft.sharepoint.online, one can use:

 Set-SPOUser -Site $fnOneDriveSiteUrl -LoginName "BarrySwitzer@DallasCowboys.com" -IsSiteCollectionAdmin $True

[Anonymous]

Apologies:
Permission role requirements are:
sharepoint.sites.fullcontrol.
NOTE: Beware!!!
Ref: https://github.com/pnp/powershell/issues/2568
Certain graph roles can collide with SharePoint.sites.fullcontrol
>>> Get it together with MGGRaph !