Office 365 Limited Administration Roles

In the past when managing Office 365 permissions, we had several options for granting ‘super user’ rights to users however these stopped somewhat short of allowing us to be selective over what parts of our Office 365 deployment an administration could have control. You could either make somebody a Global Admin which essentially gave them the keys to the kingdom or you could assign them one of the reduced adminsitration roles such as Password Admin or User Management Admin.

Fortunately, Microsoft listened to the vast feedback they must have recieved about this and in Office 365 we now have three new limited administration roles for Exchange Online Admin, SharePoint Online Admin and Skype for Business Admin as well as the existing roles including Global Admin. These new roles allow us to assign users permissions more appropriately scoped to their role in the organisation. If an admin is only responsible for SharePoint then no longer do we need to him them unnecessary rights to amnage Exchange so that they can perform Site Collection administration in SharePoint for example.

To take advantage of these new roles, you need to ensure that you are using the Office 365 Admin site to manage the permissions and not the Azure Active Directory settings in the Azure Management Portal (you knew that you could manage users there too right).

Azure Active Directory Organisational Roles

The image above shows the roles that are available if you are managing a user through the Azure Management Portal and as you can see, the same old options limiting you to using a Global Admin role are present. If you use the Office 365 Admin site however as shown below, you can see the new roles.

Office 365 User Roles

When changing permissions of your users, be careful that you don’t take away permissions from users that they actually need. As always, an element of caution should be applied.

If you want to see what permissions map to each role and how they differ, you can view the full table at https://support.office.com/en-us/article/Assigning-admin-roles-d58b8089-cbfd-41ec-b64c-9cfcbef495ac#__choose_an_admin

 

 

richardjgreen

Richard works as a Cloud Consultant for Fordway Solution where his primary focus is to help customers understand, adopt and develop with Microsoft Azure, Office 365 and System Center. Richard Green is an IT Pro with over 15 years' of experience in all things Microsoft including System Center and Office 365. He has previously worked as a System Center consultant and as an internal solutions architect across many verticals. Outside of work, he loves motorbikes and is part of the orange army, marshaling for NGRRC, British Superbikes and MotoGP. He is also an Assistant Cub Scout Leader.