Microsoft 365 ships with a long list of admin roles, and the temptation is to hand out Global Administrator to anyone who needs to “do admin stuff.” That’s how tenants end up with eight Global Admins, half of whom only ever reset passwords. Each one of those accounts is a master key, and every extra key is extra risk.
This guide explains what the main roles actually grant, where the lines are between Global, Exchange, and Teams admin, and how to assign the least privilege that still gets the job done. The roles live in Microsoft Entra ID (formerly Azure AD), and the most-used ones also surface in the Microsoft 365 admin center. The goal is simple: give people exactly the access their job needs and nothing more.
Global Administrator: the master key
Global Administrator can read and change almost everything across the tenant — users, licenses, security settings, every workload, and the ability to grant roles to others, including more Global Admins. It’s the most powerful role, and it’s the one attackers most want to compromise.
Because of that, keep the count small. Microsoft’s guidance is generally two to four Global Admins: enough that you’re never locked out if one person is unavailable, few enough that the master key isn’t spread around. Everyone else should have a scoped role.
The scoped admin roles you’ll use most
Most day-to-day administration fits a scoped role that’s limited to one workload or task. These cover the bulk of real assignments.
Common Microsoft 365 admin roles
| Global Administrator | Full control of the tenant. Keep to 2–4 people. |
|---|---|
| Global Reader | Read-only view of everything. For auditors and reviewers. |
| User Administrator | Create/manage users and groups, reset passwords, manage licenses. |
| Exchange Administrator | Mailboxes, mail flow rules, distribution groups, Exchange settings. |
| Teams Administrator | Teams service settings, policies, devices, calling. |
| SharePoint Administrator | SharePoint and OneDrive admin settings. |
| Helpdesk Administrator | Reset passwords and handle service requests for non-admins. |
| Billing Administrator | Purchases, subscriptions, invoices — no service config. |
A pattern worth noticing: most roles are read-and-write within a boundary. Global Reader is the exception that’s read-only across everything, which makes it the safest role to hand to anyone who just needs to look.
Where Exchange, Teams, and the others draw the line
The scoped roles don’t bleed into each other. An Exchange Administrator manages mailboxes, mail flow rules, and distribution groups, but can’t touch Teams policies or SharePoint settings. A Teams Administrator manages Teams policies, devices, and calling, but can’t manage Exchange mailboxes or create mail flow rules.
That separation is the point. If your messaging admin only works in Exchange, the Exchange Administrator role is the correct grant — not Global Admin “to be safe.” The same logic applies to whoever runs your Teams calling setup: Teams Administrator covers assigning phone numbers to Teams users and policy work without exposing the rest of the tenant.
Least privilege in practice
“Least privilege” sounds like a slogan until you apply it to a real org chart. The method is straightforward: match the person to the smallest role that covers their actual tasks.
Match the role to the job
| First-line help desk (password resets) | Helpdesk Administrator |
|---|---|
| Onboards/offboards staff, assigns licenses | User Administrator |
| Runs email and mail flow | Exchange Administrator |
| Runs Teams calling and policies | Teams Administrator |
| Security/audit review, no changes | Global Reader |
| Handles invoices and subscriptions | Billing Administrator |
| Tenant owner / break-glass | Global Administrator (2–4 only) |
When someone’s role grows, add another scoped role rather than upgrading them to Global Admin. It keeps the blast radius small if their account is ever compromised.
Assign roles the right way
You can assign the common roles in the Microsoft 365 admin center and the full set in Entra ID.
Microsoft 365 admin center: go to Roles → Role assignments, pick a role, and add the user. This covers the everyday roles like User, Helpdesk, Exchange, and Teams admin.
Microsoft Entra ID: go to Roles and administrators for every built-in role and the option to assign a role as eligible (activated on demand) rather than active (always on) where Privileged Identity Management is available.
With PowerShell (Microsoft Graph), you can audit and assign programmatically:
Connect-MgGraph -Scopes "RoleManagement.Read.Directory","Directory.Read.All"
# List who holds which directory role
Get-MgDirectoryRole | ForEach-Object {
$role = $_
Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id |
Select-Object @{n='Role';e={$role.DisplayName}}, Id
}Tie it back to security
Admin roles and account security go together. A scoped role limits what an account can do; MFA and Conditional Access limit who can use it. Make sure every admin — especially Global Admins — is covered by MFA for Microsoft 365 users, and consider a Conditional Access policy that requires compliant devices or extra verification for privileged roles.
Admin role hygiene
- Only 2–4 Global Administrators
- Everyone else on the smallest scoped role that fits their job
- Separate admin accounts from everyday user accounts
- MFA enforced on all admin accounts, no exceptions
- One or two protected break-glass accounts
- Periodic review to remove stale role assignments
Bottom line
Global Administrator is the master key — keep it to a handful of people and protect it hard. For everyone else, use the scoped roles: Exchange admin for mail, Teams admin for Teams, User admin for onboarding, Helpdesk admin for password resets, and Global Reader for anyone who only needs to look. Assign the smallest role that does the job, keep admin accounts separate from daily-use accounts, and review the assignments on a schedule so access doesn’t quietly pile up.
