Microsoft Entra ID · M365 Workloads & Services
SharePoint Embedded Administrator
Manages all aspects of SharePoint Embedded containers using PowerShell, Graph API, or SharePoint admin center.
Scope: Administration of SharePoint Embedded containers for ISV applications
Permissions
- Manage SharePoint Embedded containers
- Configure container settings
- Manage container permissions
- Manage container storage
- Apply compliance policies
Common use cases
- ISV application storage management
- Container governance
- Storage quota management
- Compliance configuration
Best practices
- Monitor container usage
- Apply governance policies
- Document container purposes
Security considerations
- Manages ISV app storage
- Can affect third-party app data
Common questions
When should I assign the SharePoint Embedded Administrator role?
Assign SharePoint Embedded Administrator when you need to: ISV application storage management; Container governance; Storage quota management; and Compliance configuration. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the SharePoint Embedded Administrator role do?
The SharePoint Embedded Administrator role grants permissions including: Manage SharePoint Embedded containers; Configure container settings; Manage container permissions; Manage container storage; and Apply compliance policies. See the Permissions section above for the full list.
What are the security risks of the SharePoint Embedded Administrator role?
Key considerations when assigning SharePoint Embedded Administrator: Manages ISV app storage; and Can affect third-party app data. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.