Admin overview

Applies to: Consuming tenant admin — SharePoint Embedded admin / Global admin / Compliance admin / Security admin

SharePoint Embedded is an API-only document platform built on Microsoft 365.

Organizations use SharePoint Embedded apps to store files and documents in containers that inherit Microsoft 365 security, compliance, and administration controls.

Administrators manage those apps and containers through the SharePoint admin center and SharePoint Online Management Shell.

Use this overview to decide which administrator role and management surface to use.

Then follow the linked how-to articles for app creation, installation, billing, container lifecycle, and compliance operations.

Important

Assign the SharePoint Embedded Administrator role before delegating SharePoint Embedded administration.

Global Administrators already have the permissions of this role, but should use least-privileged delegation for daily operations.

Admin roles

SharePoint Embedded administration commonly involves the following roles.

Role	Use it for
Global Administrator	Assign the SharePoint Embedded Administrator role and perform any SharePoint Embedded admin task when needed.
SharePoint Embedded Administrator	Manage SharePoint Embedded apps and containers through SharePoint admin center and supported SharePoint PowerShell cmdlets.
Tenant administrator	Manage apps and settings in the consuming Microsoft 365 tenant.
Compliance administrator	Configure Microsoft Purview audit, retention, DLP, eDiscovery, and related policies.
Security administrator	Configure security policies and investigate security events that apply to SharePoint Embedded content.

The SharePoint Embedded Administrator role is available in Microsoft Entra and the Microsoft 365 admin center.

It is dedicated to SharePoint Embedded administration.

It doesn't grant regular SharePoint site management access.

For example, a SharePoint Embedded Administrator doesn't see the Active sites or Deleted sites pages in the SharePoint admin center and cannot run site-specific SharePoint PowerShell cmdlets.

Likewise, the SharePoint administrator role doesn't administer SharePoint Embedded apps or containers.

Assign the SharePoint Embedded Administrator role

A Global Administrator assigns the SharePoint Embedded Administrator role in either Microsoft Entra or the Microsoft 365 admin center.

Microsoft Entra

Sign in to Microsoft Entra as a Global Administrator.
Select Users, then select All users.
Select the user to assign the role to.
Select Assigned roles.
Select Add assignments, then search for SharePoint Embedded.
Select SharePoint Embedded Administrator, then select Add.

Microsoft 365 admin center

Sign in to the Microsoft 365 admin center as a Global Administrator.
Select Users, then select Active users.
Select the user to assign the role to.
Under Roles, select Manage roles.
Select Admin center access, then under Collaboration, select SharePoint Embedded Administrator.
Select Save changes.

Developer tenant and consuming tenant responsibilities

SharePoint Embedded administration differs depending on whether the tenant owns the app or consumes the app.

A developer tenant owns or builds the SharePoint Embedded application.

Developer tenant admins can create container types, configure billing for standard billing scenarios, and manage container type properties.

A consuming tenant uses a SharePoint Embedded application in its Microsoft 365 tenant.

Consuming tenant admins manage installed applications, containers, sharing settings, sensitivity labels, deleted containers, and compliance controls. A Global Administrator sets up billing for pass-through apps.

For the consuming tenant admin model, see Install a SharePoint Embedded app.

What admins can do

Administrators can perform these SharePoint Embedded management tasks.

App administration

View SharePoint Embedded applications registered in the tenant.
View details for a specific SharePoint Embedded application.
Review owning and guest application permissions.
Install or register a SharePoint Embedded app in a consuming tenant.
Configure application-level external sharing settings when supported.
Create apps from the SharePoint admin center when the tenant owns the app.

Start with Create apps in SharePoint admin center for owned apps.

Use Install a SharePoint Embedded app for consuming tenant installation.

Admin consent installs the application service principal in the consuming tenant and grants the requested permissions.

For container type registration, the owning application must have admin consent and the required SharePoint application permission before it can register permissions in the consuming tenant.

Review consent guidance in Grant admin consent and permissions.

Billing administration

SharePoint Embedded uses pay-as-you-go billing through Azure.

Cost is driven by storage, API transactions, and egress.

Developer tenants configure billing for standard billing container types.

Consuming tenants configure billing for pass-through apps before users can access those apps.

Only a Global Administrator can set up billing in the Microsoft 365 admin center. The SharePoint Embedded Administrator role can't configure billing.

Set up pass-through billing with Set up billing in Microsoft 365 admin center.

Monitor usage with Monitor usage, billing, and cost.

Container administration

Containers hold the content used by SharePoint Embedded apps.

Admins can view active containers, archive containers, reactivate archived containers, inspect metadata, set sensitivity labels, manage membership in the admin center, delete containers, restore deleted containers, and permanently delete deleted containers.

Use the graphical experience in Manage containers in SharePoint admin center.

Use cmdlets and scripting in Manage containers with PowerShell.

Compliance administration

SharePoint Embedded content participates in Microsoft Purview capabilities.

Compliance admins can use audit, retention, DLP, eDiscovery, and sensitivity labels in ways that are similar to SharePoint.

Some scenarios that need end-user interaction depend on the owning app to provide the user experience.

Review Review audit events and Apply security and compliance controls.

SharePoint admin center versus PowerShell

Use both management surfaces.

They're complementary.

Surface	Best for
SharePoint admin center	Interactive app inventory, container views, container details, deleted container operations, sensitivity labels, and membership management.
SharePoint Online Management Shell	Repeatable administration, inventory exports, sorting containers by storage, application permission review, and lifecycle scripts.

The SharePoint admin center exposes SharePoint Embedded-specific pages such as Apps, Active containers, and Deleted containers.

A SharePoint Embedded Administrator sees the SharePoint Embedded administration pages but not general SharePoint site management pages.

SharePoint Online Management Shell provides SharePoint Embedded cmdlets for application and container administration.

Use the latest version before running container administration cmdlets.

For command details, see Manage containers with PowerShell and the linked cmdlet reference.

Tip

Use the admin center for one-time review and confirmation. Use PowerShell when you need repeatable inventory, reporting, or bulk operations.

Common administration paths

Use this path when you own a SharePoint Embedded app:

Confirm the admin role. See Assign the SharePoint Embedded Administrator role.
Create the app in Create apps in SharePoint admin center.
Choose and configure billing.
Install the app if it must be available in a consuming tenant.
Grant admin consent and register required permissions.
Monitor usage and cost.

Use this path when your tenant consumes a SharePoint Embedded app:

Assign or confirm the SharePoint Embedded Administrator role.
Install or approve the app in Install a SharePoint Embedded app.
Grant admin consent when required.
Set up pass-through billing in Set up billing in Microsoft 365 admin center.
Manage containers in the SharePoint admin center or with PowerShell.
Apply compliance controls in Microsoft Purview.

Operational guardrails

Before making changes, identify the owning application and affected containers.

Container deletion can break links, remove content, and interrupt the app that depends on the container.

Deleted containers can be restored from the deleted container collection within the supported retention period unless they're permanently deleted or retention policies change the behavior.

Warning

Permanently deleting a container removes it from the deleted container collection and it can't be restored. Notify app owners before deleting containers.

Next steps

Create an owned app in Create apps in SharePoint admin center.

Last updated on 2026-07-15