Error "Get-SPOUser : Access denied. You do not have permission to perform this action or access this resource"

_{Tuesday, May 15, 2018 4:42 PM}

Hi,

I am using SharePoint Online & I have used the following Powershell script to get list of Site Collections that are accessible to a user. I am able to connect correctly using Connect-SPOService. However, I get error "Get-SPOUser : Access denied. You do not have permission to perform this action or access this resource". Please let me know the solution to the problem.

$Creds = Get-Credential

$site = 'https://xxxxx-admin.sharepoint.com'

Connect-SPOService -Url $site -Credential $Creds

$AllSites = Get-SPOSite -Limit All

$users = @();

foreach ($Allsite in $AllSites)
{
$AllUsers = Get-SPOUser -Site $AllSite.Url -Limit all | select DisplayName, LoginName, IsSiteAdmin
$users += $AllUsers
$AllUsers = $null
#Write-Host $AllSite.Url "completed"
}

$users | Export-Csv -Path "C:\allusers.csv" -NoTypeInformation -Force

$Data = Import-Csv "C:\allusers.csv"

foreach($aUser in $Data)
{
  if ($aUser.IsSiteAdmin -eq "True")
  {
    Write-Host $aUser.DisplayName $aUser.LoginName
  }
}

_{Wednesday, May 16, 2018 6:47 AM}

Hi,

It requires a site collection administrator to run The “Get-SPOUser” cmd, as what listed in this documentation:

https://technet.microsoft.com/en-us/library/fp161385.aspx

One quick workaround is, you can use your CSP credential to create a user as “Global admin” in this tenant, then run the cmd with this account should also work.

Best regards,

Carl Zhou

Please remember to mark the replies as answers if they helped. If you have feedback for TechNet Subscriber Support, contact tnsf@microsoft.com.

Click here to learn more. Visit the dedicated forum to share, explore and talk to experts about Microsoft Teams.

_{Wednesday, May 30, 2018 2:35 PM}

Hi Carl,

I am Global admin and get the same error when I try to use Get-SPOUser

+ CategoryInfo          : NotSpecified: (:) [Get-SPOUser], ServerUnauthorizedAccessException
+ FullyQualifiedErrorId : Microsoft.SharePoint.Client.ServerUnauthorizedAccessException,Microsoft.Online.SharePoint.PowerShell.GetSPOUser

I read all global admins are in the group "Company Administrator". If in a site collection someone has deleted the group "company administrator", then there would be this error?

Best regards

Miriam

_{Monday, November 4, 2019 10:13 AM}

Did you get this to work with your Global Admin account?