There are 5 main variations of administrators, which are all given different permissions based on the tasks they are responsible for. These permissions allow the different administrators to effectively complete their tasks without having unnecessary access to sensitive information.
The global admin can also set up other admins with permissions different from these 5 admins.
Office 365 Administration Center
The Office 365 admin center is essentially home base for an Office 365 subscriber. This is where cloud services can be set up, users and groups can be added and created, subscriptions and payment methods can be managed, and many other actions can be performed. The Global Admin has access to all of these features and can assign other users admin roles so that they can also have control over some of these features. However, it is important for a Global admin to know what permissions they are granting each admin. Each admin is given specific permissions, so they can effectively manage their responsibilities without having control over unnecessary features.
Different Admins for Office 365
· Service Admin – Can view organization and user information and manage support tickets.
· Billing Admin – Can do everything service admin can do and perform billing and purchasing operations.
· Password Admin – Can do everything the Billing admin can do, with the exception of performing billing and purchasing operations. Can also reset user passwords for anyone who is not an admin.
· User Management Admin – Can do everything the Password admin can do, but can also reset the password for the password admin. They can also create, edit, and delete users and groups, and manage user licenses, but cannot delete a global admin or create other admin
· Global Admin – This is the person who actually purchases the Office 365 subscription. They have permissions to everything and are the only admin who can manage domains and organization information, delegate admin roles to others, and use directory synchronization. The global admin can also set up other admins with permissions different from these 5 admins.
Permission |
Service Admin |
Billing Admin |
Password Admin |
User Management Admin |
Global Admin |
View organization and user information |
ü |
ü |
ü |
ü |
ü |
Manage support tickets |
ü |
ü |
ü |
ü |
ü |
Reset user passwords |
ü* |
ü* |
ü |
||
Perform billing and purchasing operations |
ü |
ü |
|||
Create and manage user views |
ü |
ü |
|||
Create, edit, and delete users and groups, and manage user licenses |
ü* |
ü |
|||
Manage domains |
ü |
||||
Manage organization information |
ü |
||||
Delegate admin roles to others |
ü |
||||
Use directory synchronization |
ü |
*With certain limitations, as to not overpower the Global Admin.
Assigning Admin Roles
1. Sign into Office 365 and go to the Admin Center.
2. Select the user you want to make an admin from the Active Users page and click Edit.
3. Click on Settings and then under Assign role, click Yes.
4. Enter an email address not connected to Office 365 in the Alternate email address box.
5. Select Details, go into Additional details, and enter the user’s mobile phone number in the Mobile phone box
6. Click Save
Administrator Security
Administrators are given a great deal of control over an Office 365 account. So, in order to keep your account safe and secure, there are some guidelines all Office 365 administrators should follow. These security measures include:
· Use Long Complex Passwords
· Use a Separate Administrator Account
· Enable Multi-Factor Authentication
· Use a Separate Administrator Account for PowerShell Access
These security measures are explained in more in this Cogmotive Article.