Assign admin roles in the Microsoft 365 admin center

A Microsoft 365 subscription comes with a set of admin roles that you can assign to users in your organization using the Microsoft 365 admin center. Each admin role maps to common business functions and gives people in your organization permissions to do specific tasks in the admin centers. For more information, see About admin roles.

Important

If you're the person who purchased your Microsoft business subscription, you are the global admin. This means you have unlimited control over the products in your subscriptions and you can access most data.

When you add new users, if you don't assign them an admin role then they are in the user role and don't have admin privileges to any of the Microsoft admin centers. But if you need help getting things done, you can assign an admin role to a user. For example, if you need someone to help reset passwords, you shouldn't assign them the global admin role, you should assign them the password admin role. Having too many global admins, with unlimited access to your data and online business, is a security risk.

To help keep your organization secure, Microsoft recommends that you use roles with the minimum level of permissions needed to perform a job. Global administrator is a highly privileged role that should be limited to scenarios where you can't use a less-privileged role.

You can assign users to a role in two different ways:

• You can go to the user's details and Manage roles to assign a role to the user.
• Or you can go to Roles and select the role, and then add multiple users to it.

Watch: Add an admin

Check out this video and others on our YouTube channel.

If you found this video helpful, check out the complete training series for small businesses and those new to Microsoft 365 on YouTube.

Steps: Add an admin

1. When you sign up for Microsoft 365 Business, you automatically become a global admin. To help manage the business, you can make other people admins as well.
2. In the Microsoft 365 admin center, select Users > Active users.
3. Choose the user you want to make an admin, and then select Manage roles.
4. Select the admin access you want the user to have and select Save changes.

Assign admin roles to users using Roles

1. In the admin center, go to Roles -> Role assignments. Choose the Microsoft Entra ID, Exchange, Intune or Billing tab to view the admin roles available for your organization.

   Note

   You might not see all the tabs depending on your Microsoft 365 subscription.

2. Select the admin role that you want to assign the user to.

3. On the Assigned tab, select Add users or Add groups.

4. Type the user's display name or username, and then select the user from the list of suggestions.

5. Add multiple users until you're done.

6. Select Add, and the user or users will be added to the list of assigned admins.

Assign a user to an admin role from Active users

1. In the admin center, go to Users > Active users page.

2. On the Active users page, select the user whose admin role you want to change. In the flyout pane, under Roles, select Manage roles.

3. Select the admin role that you want to assign to the user. If you don't see the role you're looking for, select Show all at the bottom of the list.

Assign admin roles to multiple users

If you know PowerShell, see Assign roles to user accounts with PowerShell. It's ideal for assigning roles to hundreds of users.

Use the following instructions to assign roles to tens of users.

Export, search and filter

You can export the admin list as well as search and filter by role.

• Use Export admin list to get a full list of all the admin users in your organization. The list is stored in an Excel .csv file.

• Use Search to search for an admin role and see your users who are assigned to that role.

• Use Filter to change your view of displayed admin roles.

Check admin roles in your organization

You might not have the correct permissions to assign admin roles to other users. Check to make sure you have the correct permissions or ask another admin to assign roles for you.

You can check admin role permissions in 2 different ways:

• You can go to the user's details and look under Roles on the Account page.
• Or you can go to Roles and select the admin role, and select assigned admins to see which users are assigned.

Compare roles

You can now compare permissions for up to 3 roles at a time so you can find the least permissive role to assign.

In the admin center:

• Select up to 3 roles and choose Compare roles to see the permissions each role has.

Related content

About Microsoft 365 admin roles (article)
Microsoft Entra built-in roles (article)
Assign roles to user accounts with PowerShell (article)
Add, change, or remove partner relationships (article)