Give a colleague the admin access they need in Microsoft 365, and no more. For example, let your office manager reset passwords without handing them the keys to everything. This guide explains the common roles and how to assign them.
Before you start
- You need to be a Global Administrator (or Privileged Role Administrator) to assign admin roles.
- The person must already have a user account. See Add a user and assign a licence.
- Every admin must use multi-factor authentication. With security defaults on, they'll be asked for it at every sign-in (see Set up multi-factor authentication).
Which role should I give?
Pick the role with the fewest permissions that still lets the person do the job. If their account is ever compromised, the damage is limited to what that role can do.
| Role | Good for | Can do |
|---|---|---|
| Global Administrator | The business owner and one deputy | Everything, including adding domains, assigning other admins and changing security settings |
| User Administrator | An office manager who handles starters and leavers | Create, edit and delete users, assign licences, reset passwords for non-admins, manage groups |
| Helpdesk Administrator | Someone who looks after day-to-day "I'm locked out" calls | Reset passwords and sign people out (non-admins only), manage support requests |
| Password Administrator | Password resets only | Reset passwords for non-admin users |
| Exchange Administrator | Whoever manages email | Mailboxes, shared mailboxes, distribution lists, mail flow rules, "Send As" permissions |
| Billing Administrator | Your accounts person | View subscriptions and billing, open support requests. Your Microsoft 365 billing itself is handled by Host Dada |
Anyone without a role is an ordinary user and can't open the admin centre.
Step-by-step: give someone an admin role
- Sign in to the admin centre. Go to admin.microsoft.com.
- Open the user. Go to Users → Active users and select the person's name.
- Manage roles. In the panel that opens, under Roles, select Manage roles.
- Pick the role. Choose Admin center access, then tick the role. If it isn't in the short list, select Show all by category.
- Save. Select Save changes. The role applies within a few minutes. Ask the person to sign out and back in.
Add several people to one role
- Go to Roles → Role assignments.
- Select the role, open the Assigned tab and select Add users.
- Type each person's name, pick them from the list and select Add.
On the Role assignments page you can also tick up to three roles and select Compare roles to see exactly what each one allows.
Check who has admin rights
- On Users → Active users, use the filter list and choose a ready-made view such as Global admins or User admins.
- Or open Roles → Role assignments, select a role and look at the Assigned tab. Export admin list downloads everyone with a role as a spreadsheet.
Review this list when someone leaves or changes job, and remove roles they no longer need: open the user, select Manage roles, choose User (no admin center access) and save.
Partner access
Microsoft partners can be given admin access to a customer's tenant. You can see which partners are linked to your organisation, and what access they have, under Settings → Partner relationships. If you have questions about anything listed there, open a ticket.
Troubleshooting
"You don't have permission to access this page"
Your role doesn't cover that area. For example, a Helpdesk Administrator can't open domain settings. Ask a Global Administrator to do the task or give you a more suitable role.
I can't remove my own Global Administrator role
That's deliberate, so a tenant can never be left with no Global Administrator. Another Global Administrator has to remove it for you.
The new admin can't reset another admin's password
Helpdesk, Password and User Administrators can only reset ordinary users and some lower roles. Resetting a Global Administrator's password needs another Global Administrator.
Last reviewed: October 2026
