📚 M365 Admin Center Course · Module 5 of 9
Admin Roles & Permissions
MS-102 Exam Alignment
MS-102
Objective 1.4 — Plan and implement admin roles: assign and manage built-in Microsoft Entra ID admin roles, apply least-privilege principles, understand the responsibilities of each key role, and audit role assignments via PowerShell.
- Know Microsoft's recommendation of 2–4 Global Administrators per tenant
- Understand the least-privilege principle — assign the lowest role that covers the job
- Distinguish between Global Administrator, User Administrator, Helpdesk Administrator, and Global Reader
- Know that Helpdesk Admins cannot reset passwords for other admins — only standard users
- Use Get-MgRoleManagementDirectoryRoleAssignment to audit role assignments via PowerShell
Exam Tip: Role scope boundaries are heavily tested. Know exactly what each role can and cannot do, especially the difference between Helpdesk Administrator (password resets for non-admins only) and User Administrator (full user lifecycle management).
Not everyone who needs admin access should have all admin access. Microsoft 365 uses Role-Based Access Control (RBAC) to grant administrators precisely the permissions they need — and nothing more. This module covers the built-in admin role catalogue, the critical rules around the Global Administrator role, how to assign roles through the portal and PowerShell, and how to audit who has admin access in your tenant.
🔐 What Is Role-Based Access Control (RBAC)?
💡 The Least-Privilege Principle
RBAC is a security model where permissions are granted based on job role rather than individual. In M365, built-in admin roles define exactly which sections of the admin center and which operations a user can perform. The principle of least privilege means assigning the lowest-permission role that still lets the person do their job — a helpdesk agent does not need Global Administrator to reset a password.
Admin roles are assigned to user accounts in Entra ID and are enforced across all Microsoft 365 portals and services. A user can hold multiple roles simultaneously. Roles are additive — each role you assign adds more permissions; there is no way to deny a specific permission within an assigned role.
⚠️ The Global Administrator — Handle With Care
🚨 Global Administrator Rules — Know These for Interviews
- Global Administrators have unrestricted access to every setting, every service, every user, and every piece of data in your M365 tenant
- Microsoft recommends keeping the number of Global Admins between 2 and 4 — enough for redundancy, not so many that the blast radius of a compromise is catastrophic
- All Global Admin accounts should be cloud-only accounts (not synced from on-premises AD) to avoid a single point of compromise
- Every Global Admin account must have MFA enforced — preferably via Conditional Access policy
- For day-to-day admin work, Global Admins should use a separate standard user account and only elevate to their GA account when needed
🗂️ Roles → Role Assignments Portal
M365 Admin Center › Roles › Role assignments
🏠 Home
Users
Active users
Billing
Licenses
Roles
Role assignments
Health
Service health
Role assignments
Showing Microsoft Entra ID roles — All
① Global Administrator — 3 users. This is within the recommended 2–4 range. If you see this number climbing toward 10 or more in a real tenant, it is a significant security risk. Click the role name to see which accounts are assigned and verify each has MFA enforced.
② Exchange Administrator — 2 users. A scoped role — these users can fully manage Exchange Online but cannot access user account settings, Intune, or SharePoint. This is correct use of least-privilege.
📋 Built-In Admin Roles — Key Reference
| Role | What They Can Do | What They Cannot Do |
|---|---|---|
| Global Administrator | Everything — full unrestricted access to all M365 services, settings, and data | N/A — no restrictions |
| Exchange Administrator | Mailboxes, mail flow, connectors, shared mailboxes, Exchange policies | User management, licensing, Teams, SharePoint, Intune |
| Teams Administrator | Teams policies, meeting settings, voice, calling plans, Teams devices | Mailbox management, SharePoint sites, user lifecycle |
| SharePoint Administrator | Site collections, sharing settings, storage quotas, hub sites, term store | Email, Teams policies, device management |
| User Administrator | Create/delete users, reset passwords, manage licenses, manage groups | Modify other admins, change tenant settings |
| Helpdesk Administrator | Reset passwords for non-admin users, manage service requests, view health | Create or delete users, assign licenses, manage admin accounts |
| Security Administrator | Manage security policies, alerts, Defender settings, Secure Score | User lifecycle, licensing, Exchange mail flow configuration |
| Reports Reader | View all usage reports and activity dashboards in the admin center | Cannot change any settings or manage any objects |
| Global Reader | Read-only view of all admin center settings and configurations | Cannot make any changes — read-only across everything |
| License Administrator | Assign and remove product licenses for users and groups | Cannot create users, modify user properties, or change other settings |
➕ Assigning a Role — Two Methods
Method 1 — Via the Role assignments page
- 1 Go to Roles → Role assignments. Browse or search for the role you want to assign.
- 2 Click the role name to open its details. Go to the Assigned tab.
- 3 Click Add and search for the user by name or email. Select them and click Save.
Method 2 — Via the User's Profile
- 1 Go to Users → Active users and click the user's name.
- 2 In the panel, select the Account tab and scroll to Roles.
- 3 Click Manage roles. Choose Admin center access, select the role, and click Save changes.
✅ How to Remove a Role
Removing an admin role is done via the same Role assignments page — click the role, go to the Assigned tab, select the user, and click Remove. The role is revoked immediately; the user's next session will reflect the reduced permissions. Removing a role does not affect the user's license or account status.
⚡ PowerShell: Admin Role Management
PowerShell — Audit All Role Assignments
Connect-MgGraph -Scopes "RoleManagement.Read.Directory","User.Read.All" # Get all current role assignments with user and role names Get-MgRoleManagementDirectoryRoleAssignment -All | ForEach-Object { $roleDef = Get-MgRoleManagementDirectoryRoleDefinition -UnifiedRoleDefinitionId $_.RoleDefinitionId $principal = Get-MgUser -UserId $_.PrincipalId -ErrorAction SilentlyContinue [PSCustomObject]@{ User = $principal.UserPrincipalName Role = $roleDef.DisplayName } } | Sort-Object Role # Audit: list all Global Administrators in the tenant $gaRoleId = (Get-MgRoleManagementDirectoryRoleDefinition | Where-Object { $_.DisplayName -eq "Global Administrator" }).Id Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$gaRoleId'" | ForEach-Object { (Get-MgUser -UserId $_.PrincipalId).UserPrincipalName }
🎓 Interview Q&A
Q: A junior IT technician needs to be able to reset user passwords but should have no other admin permissions. Which role should you assign?
Assign the Helpdesk Administrator role. This role allows password resets for non-admin users, managing service requests, and viewing service health — without the ability to create or delete accounts, modify licenses, manage groups, or access any other admin center settings. Note: Helpdesk Administrators cannot reset passwords for users who hold any admin role.
Q: What are Microsoft's recommendations around the Global Administrator role?
Microsoft recommends keeping Global Admin accounts between 2 and 4 — enough redundancy if one is unavailable, not so many that the attack surface grows unnecessarily. All Global Admin accounts should be cloud-only (not synced from on-premises AD), should have MFA enforced (preferably via Conditional Access), and should be used only when Global Admin privileges are actually needed.
Q: What is the difference between the Global Administrator and the Global Reader role?
The Global Administrator has full read and write access to every M365 service, setting, and piece of data — they can change anything in the tenant. The Global Reader has read-only access across every admin center and service — they can view all settings, configurations, and reports, but cannot make any changes. Global Reader is ideal for auditors, compliance reviewers, or senior stakeholders who need visibility without the risk of accidental changes.
🎯 MS-102 Mock Test
Module 5 — Admin Roles & Permissions
Question 1 of 5
A security audit of your Microsoft 365 tenant reveals that 12 users have the Global Administrator role assigned. According to Microsoft best practices, what is the recommended maximum number of Global Administrators?
✅ Correct answer: B. Microsoft recommends between 2 and 4 Global Administrators. Having 12 GAs is excessive and each should be reviewed to determine whether they genuinely need that level of access, or can be moved to a scoped role.
Question 2 of 5
A helpdesk team member needs to reset passwords for standard (non-admin) users. They should not be able to create accounts, delete users, or change any other settings. Which role provides exactly these permissions?
✅ Correct answer: C. Helpdesk Administrator can reset passwords for non-admin users, manage their own service requests, and view service health. They cannot create or delete accounts, assign licences, manage groups, or modify admin accounts.
Question 3 of 5
An administrator uses their Global Administrator account to read emails, create documents, and attend Teams meetings daily, in addition to admin tasks. Which security principle are they violating?
✅ Correct answer: B. The principle of least privilege dictates that a user should have only the minimum permissions needed for the current task. Using a Global Administrator account for everyday activities means the GA's powerful credentials are exposed to phishing and session hijacking during routine operations.
Question 4 of 5
A partner auditor needs to review all Microsoft 365 admin center configurations and settings, but must not be able to make any changes. Which role is most appropriate?
✅ Correct answer: D. Global Reader provides read-only access across all Microsoft 365 admin centers — the auditor can see all settings, configurations, user lists, and reports without the ability to make any changes. Reports Reader is limited to usage reports only. Security Reader is scoped to security-related settings.
Question 5 of 5
You need to produce a report of all current admin role assignments in your Microsoft 365 tenant using PowerShell. Which cmdlet retrieves all Entra ID role assignments?
✅ Correct answer: B. Get-MgRoleManagementDirectoryRoleAssignment -All retrieves all active role assignments in Microsoft Entra ID, returning the PrincipalId (who has the role) and RoleDefinitionId (which role). You can then resolve these IDs to user names and role names using Get-MgUser and Get-MgRoleManagementDirectoryRoleDefinition.
🔒
This module is lockedComplete Module 4 and pass its mock test to unlock this module.