SharePoint & OneDrive · Content & Permissions
Microsoft 365 Group Owner
Owners of a Microsoft 365 group automatically become site collection administrators of the connected SharePoint team site.
Scope: Microsoft 365 group and connected resources
Permissions
- SharePoint site - Site collection administrator rights
- Group membership - Add and remove group members and owners
- Teams - Manage connected Microsoft Teams (if any)
- Mailbox - Access group mailbox and calendar
- Planner - Access group Planner plans
Common use cases
- Team collaboration spaces
- Cross-service resource management
- Modern team sites
- Teams-connected sites
Best practices
- Assign 2+ owners for continuity
- Understand that owner changes flow to SharePoint
- Use group settings for membership policies
Security considerations
- Permissions flow from group to SharePoint, not reverse
- Adding someone to SharePoint Owners doesn't make them a group owner
- Review group ownership regularly
- Group owners can delete the entire group including site
Common questions
When should I assign the Microsoft 365 Group Owner role?
Assign Microsoft 365 Group Owner when you need to: Team collaboration spaces; Cross-service resource management; Modern team sites; and Teams-connected sites. It is part of SharePoint & OneDrive and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Microsoft 365 Group Owner role do?
The Microsoft 365 Group Owner role grants permissions including: SharePoint site - Site collection administrator rights; Group membership - Add and remove group members and owners; Teams - Manage connected Microsoft Teams (if any); Mailbox - Access group mailbox and calendar; and Planner - Access group Planner plans. See the Permissions section above for the full list.
What are the security risks of the Microsoft 365 Group Owner role?
Key considerations when assigning Microsoft 365 Group Owner: Permissions flow from group to SharePoint, not reverse; Adding someone to SharePoint Owners doesn't make them a group owner; Review group ownership regularly; and Group owners can delete the entire group including site. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.