Too often people get Global Administrator because they need to do one task in Microsoft 365. That's a big risk. Microsoft 365 has dozens of admin roles, so you can give someone exactly the rights they need. You manage the roles in the Microsoft 365 admin center or the Microsoft Entra admin center (Azure AD is now Microsoft Entra ID). This article shows the most important roles and how to assign them.
The most important roles
| Role | What can this role do? |
|---|---|
| Global Administrator | Almost everything, in all admin centers. Give this role to as few people as possible: Microsoft recommends fewer than five, with at least two emergency access accounts. |
| Global Reader | View everything a Global Administrator sees, without changing anything. Ideal for a supplier or auditor. |
| Exchange Administrator | Manage mailboxes, Microsoft 365 groups and Exchange Online settings. |
| SharePoint Administrator | Create and delete sites, and manage SharePoint and OneDrive settings. |
| Teams Administrator | The Teams admin center: meetings, policies, telephony and organization-wide settings. |
| User Administrator | Create users and groups, manage properties and reset passwords for non-admins. |
| Helpdesk Administrator | Reset passwords for non-admins, sign users out and view service health. |
| License Administrator | Assign and remove licenses. |
| Groups Administrator | Manage all groups and group settings. |
| Security Administrator | Manage security settings and policies in Microsoft Defender and Entra ID. |
| Office Apps Administrator | Manage cloud policies for the Microsoft 365 apps. |
| Service Support Administrator | Open service requests with Microsoft and read the message center. |
| Privileged Role Administrator | Assign other admin roles. A very sensitive role. |
You find the full list and the exact permissions per role in the Microsoft Entra ID documentation.
Assign a role
- Open the Microsoft 365 admin center (admin.microsoft.com).
- Go to Roles > Role assignments.
- Choose the role and select Assign users or Add.
- Find the user and confirm.
You can also assign roles in the Microsoft Entra admin center under Roles and administrators. More details in role assignments in Microsoft 365.
Tips for secure role management
- Least privilege: always choose the smallest role that does the job.
- Separate admin accounts: use a separate account for administration, without a mailbox and not for daily use.
- MFA for all admins, preferably phishing-resistant such as passkeys or FIDO2 keys.
- Privileged Identity Management (PIM): admins only activate their role when they need it, for a limited time. This requires Microsoft Entra ID P2.
- Review regularly who has which role and remove roles that are no longer needed.
Also see a Global Reader account for your IT supplier and a tour of the Microsoft 365 admin center.
Read also
Assign admin roles in Microsoft 365
Assign the Global Reader role in Microsoft 365
A quick guide to the Microsoft 365 admin center for admins
Nederlandstalige versie: De belangrijkste beheerdersrollen in Microsoft 365