Connect-SPOService: Current Site Is Not a Tenant Administration Site (Fix)

You open the SharePoint Online Management Shell, paste the URL of the site you want to manage, and Connect-SPOService stops with a red error before you’ve run a single command. Your account is an admin, so the message feels wrong.

It isn’t about your permissions, though. Connect-SPOService only talks to one place in your tenant, and a normal site URL isn’t it.

In this tutorial, we’ll fix connect-sposervice current site is not a tenant administration site step by step: what the error means, how to find your real admin center URL, and the less obvious causes (custom domains, GCC High, multi-geo, roles and old modules).

Quick answer: Point -Url at the SharePoint admin center, not a site: Connect-SPOService -Url https://<tenant>-admin.sharepoint.com. The tenant name is the part before .sharepoint.com in any site URL, with -admin added.

What does “Current site is not a tenant administration site” mean?

This is the full error record you get in Windows PowerShell when the -Url points at a team site, a communication site or the root site:

Connect-SPOService : Current site is not a tenant administration site.
At line:1 char:1
+ Connect-SPOService -Url https://spguides.sharepoint.com/sites/SPGuides
+ ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
    + CategoryInfo          : NotSpecified: (:) [Connect-SPOService], ServerException
    + FullyQualifiedErrorId : Microsoft.SharePoint.Client.ServerException,Microsoft.Online.SharePoint.PowerShell.ConnectSPOService

Connect-SPOService connects you to the SharePoint admin center, and its -Url parameter expects that admin center’s address. Every other SPO cmdlet, including Get-SPOSite and Set-SPOSite, then runs through that one connection. If you’re new to the module, my guide on the SharePoint Online Management Shell covers installing and opening it.

Fix 1: Connect to the -admin URL, not the site URL

Nearly every time I see this error, the script uses a site URL. Swap it for the admin center URL and keep the site URLs for the cmdlets that come after:

# Wrong: a site URL (or the root site https://spguides.sharepoint.com)
Connect-SPOService -Url https://spguides.sharepoint.com/sites/SPGuides

# Right: the SharePoint admin center URL
Connect-SPOService -Url https://spguides-admin.sharepoint.com

# Check the connection
Get-SPOSite -Limit 5

You can see the same rule with PnP PowerShell, which I can script end to end. I connected to /sites/SPGuides and asked for all site collections. PnP refused and told me which admin URL to use instead:

Then I connected the same account to the -admin URL. Get-PnPTenantSite returned all 165 site collections in the tenant. That’s the same split Connect-SPOService enforces; for more on that listing, see getting all SharePoint Online sites with PnP PowerShell.

How to find your SharePoint admin center URL

The quickest way is the browser: in the Microsoft 365 admin center, expand Admin centers and select SharePoint. The address bar now shows your admin URL, such as https://spguides-admin.sharepoint.com.

From PowerShell, Get-PnPTenantInstance returns the admin URL once you’re connected as an admin. Without an admin connection, a one-line regex builds it from any site URL. Both gave me the same answer (PnP needs its own app registration; see installing PnP PowerShell for SharePoint Online):

$siteUrl  = "https://spguides.sharepoint.com/sites/SPGuides"
$adminUrl = $siteUrl -replace '^https://([^.]+)\.sharepoint\.com.*', 'https://$1-admin.sharepoint.com'
Connect-SPOService -Url $adminUrl

Wrong tenant name, GCC High and multi-geo admin URLs

• Custom domain instead of the tenant name: your email may end in spguides.com, but SharePoint URLs use the tenant name from the original onmicrosoft.com domain. Copy the name from a real site URL rather than typing your email domain.
• GCC High and DoD: the admin URL ends in sharepoint.us, and you add -Region ITAR. Tenants operated by 21Vianet use -Region China.
• Multi-geo tenants: each geo location has its own admin center, and one session holds one geo connection. Connect to the satellite’s admin URL to manage its sites.

# GCC High or DoD
Connect-SPOService -Url https://spguides-admin.sharepoint.us -Region ITAR

# Multi-geo: each geo has its own admin center (EUR satellite shown)
Connect-SPOService -Url https://spguidesEUR-admin.sharepoint.com

For every other way to sign in, including MFA, certificates and PnP, see connecting to SharePoint Online using PowerShell.

Still failing? Check your role and module version

Microsoft documents Connect-SPOService for SharePoint Administrators and SharePoint Embedded Administrators. A Global Administrator has those rights too, but a site collection admin doesn’t, even on the right URL. Without the role, you’ll typically hit Connect-SPOService (403) Forbidden instead.

Old module builds cause their own sign-in failures, so I update before I troubleshoot anything else. On this machine I had 16.0.27424 installed while the PowerShell Gallery already offered 16.0.27709:

Get-Module -Name Microsoft.Online.SharePoint.PowerShell -ListAvailable | Select-Object Name, Version
Update-Module -Name Microsoft.Online.SharePoint.PowerShell

# In PowerShell 7, load it through Windows PowerShell compatibility
Import-Module Microsoft.Online.SharePoint.PowerShell -UseWindowsPowerShell

Once you’re connected to the admin center, these guides are good next steps:

• How to Create a Site in SharePoint Online Using PnP PowerShell
• PnP PowerShell Scripts for SharePoint Developers
• Enable Sensitivity Labels For Microsoft 365 Groups & SharePoint Sites Using PowerShell
• How to Upload Files to a SharePoint Document Library Using PnP PowerShell

Frequently Asked Questions