What it works with
Module: PnP.PowerShell
Context: PowerShell 7.4+ · SharePoint Online · PnP.PowerShell
Compatibility: PowerShell 7.4+ is required by current PnP.PowerShell releases.
POWERSHELL / SHAREPOINT
ProAdvancedChanges dataMedium
Bulk manage SharePoint site collection administrators from CSV
Validates, previews and then optionally applies CSV-driven add/remove site collection administrator changes with ShouldProcess and read-back verification.
Pro generation after license validation · Review before running · No tenant access
What this PowerShell script does
Validates, previews and then optionally applies CSV-driven add/remove site collection administrator changes with ShouldProcess and read-back verification.
Requirements
- SharePoint admin URL - Tenant administration URL used for preflight and add operations.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- Input CSV path - CSV schema: SiteUrl;User;Action where Action is Add or Remove.
- Execution mode - Preview is the safe default. Apply performs real changes only after all rows pass preflight.
- Apply confirmation - When Execution mode is Apply, enter APPLY exactly. ShouldProcess confirmation is still used during execution.
- Result CSV path - Use a new absolute Windows CSV path. A result file is written for preview and apply modes.
Environment
- Module: PnP.PowerShell
- Runtime: PowerShell 7.4+
- Authentication: Interactive PnP with your own client ID/default
- Permissions: SharePoint Administrator and/or Site Collection Administrator rights plus the least-privileged SharePoint write permission set required by the current PnP cmdlets.
- Risk: Medium
Review before you runRun Preview first. Apply changes only after reviewing every planned row and target.
OPS / WORKSPACE
Ready to generate
Configure Bulk manage SharePoint site collection administrators from CSV in the Builder, review the generated PowerShell and run it in your own environment.
When to use this template
Use this controlled bulk workflow to add or remove secondary site collection administrators from an explicit CSV after a full preview.
Important limitations
- CSV contract is SiteUrl, User, Action(Add|Remove). Primary-owner replacement is deliberately outside v1.
- Removing the last known site collection administrator is blocked.
- Removal is also blocked when the requested identity matches the tenant Owner property used during preflight.
- A SharePoint Administrator may use tenant-site owner operations for additions; removals still require sufficient rights on the target site.
- No automatic retry is performed for writes because repeating a partially completed mutation can be unsafe.
PowerShell and PnP requirements
Current PnP.PowerShell releases require PowerShell 7.4 or later. Interactive authentication requires your own Entra application/client ID, or a configured PnP default client ID. This script changes SharePoint configuration. Preview is the default and real changes require explicit Apply confirmation plus ShouldProcess approval.
Opselith does not connect to your tenant or execute the script on your behalf. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation. Template source remains server-side.
Generate the script
- Open this template in the PowerShell Builder.
- Enter the required scope, safety and output values.
- Generate and review the PowerShell before running it in your own environment.
OPS / SCRIPT DETAILS
Script details
Validates, previews and then optionally applies CSV-driven add/remove site collection administrator changes with ShouldProcess and read-back verification. Review these details before generating or running the script.
Permissions and impact
Permissions: AllSites.Manage · SharePoint Administrator · Site Owner / Site Collection Administrator
Risk: Medium
Execution impact: Changes data. Preview/WhatIf is the default. Apply mode validates the full file first, requires the literal APPLY confirmation, uses ShouldProcess, isolates row failures and verifies each attempted change.
Parameters
- SharePoint admin URL - Tenant administration URL used for preflight and add operations.
- Entra app client ID - Your PnP app client ID. Leave empty only when a PnP default client ID is already configured.
- Input CSV path - CSV schema: SiteUrl;User;Action where Action is Add or Remove.
- Execution mode - Preview is the safe default. Apply performs real changes only after all rows pass preflight.
- Apply confirmation - When Execution mode is Apply, enter APPLY exactly. ShouldProcess confirmation is still used during execution.
- Result CSV path - Use a new absolute Windows CSV path. A result file is written for preview and apply modes.
Output
Output: CSV result with InputRow, SiteUrl, User, Action, PreflightState, Preview, Changed, Verified, Result and Error.
This template is part of the Pro library. The full Pro script is generated by Opselith after server-side license validation; only the configuration values needed by this template are sent for generation. No tenant connection is required. When you generate a Pro script, only the configuration values needed for that template are sent to Opselith after license validation.
Example use
Validates, previews and then optionally applies CSV-driven add/remove site collection administrator changes with ShouldProcess and read-back verification.
Enter the required values in the Builder, review the generated script and confirm the output before running it.
Before you run: Run Preview first. Inspect every row, confirm the CSV targets, then choose Apply only when ready. Never use this script to replace the primary site owner; that workflow is intentionally excluded.
Opselith quality checks
- Included in the current Opselith PowerShell quality suite
- Full CSV validation before any write
- Duplicate/conflicting rows rejected
- Preview/WhatIf default
- Literal APPLY gate for real changes
- SupportsShouldProcess with no Confirm suppression
- Last-known-admin and owner-field removals blocked
- No automatic write retries
- Post-change read-back verification
Was this useful?One click. No email.