How do I change the root user to another user in Azure, including all permissions, email triggers, and settings? I also need to remove the existing root user.

Question

How do I change the root user to another user in Azure, including all permissions, email triggers, and settings? I also need to remove the existing root user. please give me proper steps with examples.

Answer 1

Hi @Dinesh S

I understand that you want to transfer the root user's role and all associated permissions, email triggers, and settings to another user in Azure, and then remove the existing root user.

In Azure a root user also known as a global administrator is a user account with the highest level of privileges and access to all resources and settings within a Microsoft entra id.

Please follow the below steps

1.Identify the roles, permissions, email triggers, licenses and settings for that root user.

To list Azure role assignments (subscriptions) using the Azure portal: https://learn.microsoft.com/en-us/azure/role-based-access-control/role-assignments-list-portal

You can list azure roles via PowerShell: powershell

To list Microsoft Entra roles, groups assigned to root user, application permissions

Sign in to the Microsoft Entra admin center->Browse to Identity > Users > All users->Select root user.

All the information you need can be found here.

2.Create a new user in Microsoft Entra admin center.

Sign in to the Microsoft Entra admin center as at least a User Administrator -> Browse to Identity > Users > All users Select New user > Create new user > Complete the remaining tabs in the new user page > select the Review + create button to create the new user.

For your reference: create-a-new-user

3.Assign the same roles (root user have) to another users.

You can assign Microsoft entra roles via Azure portal or PowerShell: manage-roles-portal

4.Before deleting the root user, try logging into the Azure portal with a new user to check if they have all the necessary permissions.

You can delete an existing user using the Microsoft Entra admin center: Delete-a-user

Note: After deleting user no longer appears on the All-users page. The user can be seen on the Deleted users page for the next 30 days and can be restored during that time.

I would like to understand the types of email triggers that the root user has configured in your tenant. The global administrator has received email triggers related to Entra.

To configure email notifications for issues in Microsoft Entra Domain Services.

If roles are configured through PIM and the root user is added to the approver list, they will receive email notifications.

Hope this helps. Do let us know if you any further queries.

Thanks,

Navya

If this answers your query, do click Accept Answer and Yes for was this answer helpful. And, if you have any further query do let us know.

Answer 2

Thanks for your useful response, Navya.

Now I need to enable MFA for multiple users in Microsoft Entra, but I can only select or tick one user at a time in Microsoft Entra. Please provide a proper solution for this.