Can You Block a SharePoint Administrator from Accessing a Site?
Question details
The user is inquiring whether it is possible to permanently prevent a SharePoint Server 2019 administrator from accessing a confidential site after it has been created.
- Product
- SharePoint Server 2019
- Device & OS
- not provided
- Scenario
- Setting up a secure, highly confidential SharePoint site and attempting to restrict access from top-level IT administrators.
- Observed behavior
- By design, SharePoint administrators retain the ability to assign themselves access or use administrative controls, meaning their permissions cannot be reliably blocked.
Review your organization's data governance policies and understand that top-level IT administrators inherently possess the privileges required to manage and access all environments within the server.
Understand Administrative Permission Limits
Learn why a SharePoint administrator cannot be completely locked out of a site and how to seek further architectural guidance.
A SharePoint administrator has top-level permissions within the server environment. Even if you explicitly remove their permissions from a specific confidential site, they can use their administrative privileges to reassign themselves access or take ownership of the site collection.
Because of this architecture, removing an administrator's permissions does not serve as a reliable security barrier against a sufficiently privileged user.
Navigate to your SharePoint site, click on the Settings gear icon in the top right corner, and select 'Site permissions' to verify who currently has explicit access.
Since this involves SharePoint Server 2019 administration, navigate to the Microsoft Q&A website and post your specific security scenario using the 'SharePoint Server' tag to get guidance directly from Microsoft engineers.
Protect Confidential Documents with WPS Office
Since you cannot completely block a SharePoint administrator from accessing a site, the most secure approach is to password-protect your confidential documents before uploading them. WPS Office is a lightweight, free alternative to Microsoft Office that makes document encryption fast and easy.
- 1. Open your document: Launch WPS Office and open the confidential Word, Excel, or PDF document you intend to upload to SharePoint.
- 2. Access the encryption settings: Click on the 'Menu' button in the top-left corner, navigate to 'Document Encryption', and select 'Encryption'.
- 3. Set a secure password: Enter a strong password for opening the document, confirm the password, and click 'OK' to save the file before uploading it to your site.
Frequently Asked Questions
Can a Site Collection Administrator be removed from a specific site?
Yes, you can remove a Site Collection Administrator from a site's permission groups, but a Farm Administrator or anyone with Central Administration access can always add themselves back to the Site Collection Administrators group.
How can I secure confidential documents from IT administrators?
The most effective way to secure confidential documents from system administrators is to encrypt the files with a strong password before uploading them to SharePoint, using tools like WPS Office or Microsoft Office.
Does SharePoint Server 2019 have a 'deny' permission?
SharePoint generally relies on 'allow' permissions and does not have an explicit 'deny' permission that can override Farm Administrator or Site Collection Administrator access levels.
