Manage SharePoint Embedded container membership with PowerShell

Microsoft has added new PowerShell capabilities that allow SharePoint Embedded Administrators to manage container memberships with PowerShell commands.
The following SharePoint Embedded container applications are available:

This update enhances administrative flexibility by enabling user role management through PowerShell, eliminating the need for dependency on the SharePoint Admin Center.

Timeline

The rollout should be completed in October 2025.

Impact for SharePoint Embedded Administrators

Since December 2024, administrators have been able to manage members of SharePoint Embedded containers through the SharePoint Admin Center.

Microsoft now extends this functionality to PowerShell with the following commands:

• Add-SPOContainerUser
• Set-SPOContainerUser
• Remove-SPOContainerUser

These commands support membership management in all container types, including user-owned containers.

The commands are included in the latest Microsoft.Online.SharePoint.PowerShell module update.
Each SharePoint Embedded container includes four roles: Owner, Manager, Writer, and Reader. Newly added members are assigned the Manager role by default.

Managers can add, update, and delete content within a container, and also manage permissions for that container. However, they cannot delete the container itself.

A SharePoint Embedded Administrator can now update the role of an existing member with PowerShell.
Important: The SharePoint Administrator role does not grant permissions to manage SharePoint Embedded containers.

$SPEContainer = Get-SPOContainer -Identity "<ContainerID>"
Set-SPOContainerUser -ContainerId $SPEContainer.ContainerId -LoginName "pattif@demo1.tam365.com" -Role Reader

$SPEContainer = Get-SPOContainer -Identity "<ContainerID>"
Set-SPOContainerUser -ContainerId $SPEContainer.ContainerId -LoginName "[email protected]" -Role Reader

Adding a new member to the container. You cannot add more than one member at the same time.

Add-SPOContainerUser -ContainerId $SPEContainer.ContainerId -LoginName "chrisg@demo1.tam365.com" -Role Writer

Add-SPOContainerUser -ContainerId $SPEContainer.ContainerId -LoginName "[email protected]" -Role Writer

Removing a member from the container:

Remove-SPOContainerUser -ContainerId $SPEContainer.ContainerId -LoginName "chrisg@demo1.tam365.com"

Remove-SPOContainerUser -ContainerId $SPEContainer.ContainerId -LoginName "[email protected]"

Removing the last owner from the container. Also possible > congratulations, you now have an ownerless container.

Note:
Equivalent PnP PowerShell commands are not yet available. Until then, automation for membership management is not possible through Microsoft.Online.SharePoint.PowerShell module.