Microsoft 365 admin roles are Entra ID directory roles. They decide who may create users, read billing, change mail flow, or administer SharePoint. A licensed staff member can use Outlook and Teams with no admin role at all. That is the default you want.
This is not a list of every role Microsoft publishes. It is the set Malaysian SMEs actually assign, and how they go wrong.
Roles you will meet
- Global Administrator: every setting in the tenant. Needed for a few emergency and tenant-wide tasks. Dangerous as a daily login.
- User Administrator (Identity): create and disable users, reset passwords (with limits on other admins). Enough for most joiners and leavers.
- Exchange Administrator: mailboxes, shared mailboxes, transport rules. Not required to use email.
- SharePoint Administrator: site collections and tenant sharing defaults. Distinct from being an owner of one site, which is a SharePoint permission.
- Teams Administrator: Teams policies and org-wide settings. Team owners can still run their own Team without this role.
- Intune / Endpoint Administrator: device policies. See Intune.
- Billing Administrator: invoices, payment methods, and some licence assignment. Does not need Global Admin.
- Global Reader: read-only view of the tenant for audit or a second pair of eyes.
Privileged Identity Management (PIM) can make a role eligible instead of permanent, with an approval and a time limit. Smaller tenants that lack PIM should still keep Global Admin on a named emergency account, not on the managing director’s everyday mailbox.
Assigning admin access without giving away the tenant
- List the tasks: joiners, mail, sites, devices, invoices
- Map each task to the narrowest role that can do it
- Give people a separate admin account if they also handle mail all day
- Require MFA and a stricter Conditional Access grant for every admin role
- Review role holders quarterly and remove leavers the same day
Everyday account vs admin account
A person who reads email all day should not click unknown links in the same session that can delete the tenant. Split the identities when the organisation can bear two sign-ins: jane@company.com for work, jane.admin@company.com for roles. Both still sit in Entra ID. Only the admin account holds the role.
Never share the original tenant Global Admin (“the onmicrosoft.com account from day one”) as a group password. That is how former vendors remain in the directory.
Conditional Access should treat admin roles as a condition: MFA every time, preferably from a compliant device, and no legacy protocols.
Site owners are not tenant admins
Owning a SharePoint site or a Team is not an Entra ID role. It is object-level permission. Confusing the two leads to either a Global Admin who is asked to add a file, or a site owner who is handed the tenant because “they look after IT.”
Licence assignment can be delegated to User Admin or Billing Admin. It does not require Exchange Admin.
A practical example
A 40-person firm gives Global Administrator to five managers “so someone is always around.” One of them forwards the password in a chat. The revision leaves two Global Admins (one emergency, one IT lead), User Admin for HR’s joiner tasks, Billing Admin for finance, and SharePoint Admin for the intranet owner. Managers keep site-owner rights on their own Teams.
Key takeaways
- Most staff need zero admin roles.
- Global Admin is an emergency role, not a convenience title.
- Match the task to the narrowest role: users, mail, sites, devices, billing.
- Site owner and Team owner are not tenant roles.
FAQ
How many Global Administrators should we have?
At least two, so a leaver or a lost laptop cannot lock the tenant. More than a handful means the role is being used as a daily tool.
Can a vendor be a Global Admin?
If they must, use a guest or a named account you can disable, with MFA, and a contract end date. Do not share the founder’s password.
Does the Microsoft 365 admin centre show all roles?
It shows the common ones. Some directory roles are visible only in Entra ID. Start from the task, then find the role, not the other way around.