Microsoft Entra ID · M365 Workloads & Services
SharePoint Advanced Management Administrator
Performs all SharePoint Administrator actions plus advanced management capabilities like viewing file metadata and removing permissions.
Scope: Full SharePoint administration with advanced content management capabilities
Permissions
- All SharePoint Administrator permissions
- View file/folder names, paths, URLs
- Remove permissions from files/folders
- View document metadata
- Manage SharePoint advanced settings
Common use cases
- Content governance
- Permission cleanup
- Site restructuring
- Compliance investigations
Best practices
- Use for governance scenarios
- Document permission changes
- Audit usage regularly
Security considerations
- Can see file metadata (not content)
- Can remove permissions
- Powerful governance role
Common questions
When should I assign the SharePoint Advanced Management Administrator role?
Assign SharePoint Advanced Management Administrator when you need to: Content governance; Permission cleanup; Site restructuring; and Compliance investigations. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the SharePoint Advanced Management Administrator role do?
The SharePoint Advanced Management Administrator role grants permissions including: All SharePoint Administrator permissions; View file/folder names, paths, URLs; Remove permissions from files/folders; View document metadata; and Manage SharePoint advanced settings. See the Permissions section above for the full list.
What are the security risks of the SharePoint Advanced Management Administrator role?
Key considerations when assigning SharePoint Advanced Management Administrator: Can see file metadata (not content); Can remove permissions; and Powerful governance role. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.