Access to this page requires authorization. You can try signing in or changing directories . Access to this page requires authorization. You can try changing directories . Check out Microsoft 365 small business help on YouTube. These resources are especially helpful for small business admins who are new to Microsoft 365. To perform tasks like adding users, assigning licenses, or configuring services, you need an administrator role in Microsoft 365 for business. Your Microsoft 365 or Office 365 subscription includes a set of administrator roles that you can assign in the Microsoft 365 admin center . Each administrator role corresponds to common business functions and enables people in your organization to complete specific tasks in the admin centers. This article provides an overview of administrator roles, security guidelines to keep in mind, and links to related content. Watch: What is an admin? Check out this video and others on our YouTube channel . Go to the Microsoft 365 admin center and sign in. If you can access the Microsoft 365 admin center, you're an administrator, and you can proceed to the next step. Go to the Microsoft 365 admin center and sign in. If you can access the Microsoft 365 admin center, you're an administrator, and you can proceed to the next step. In the left navigation pane, select Users > Active users . (Or go directly to the Active users page .) In the left navigation pane, select Users > Active users . (Or go directly to the Active users page .) Select the user account for the person who you want to make an administrator. The user's details appear in the right dialog box. Select the user account for the person who you want to make an administrator. The user's details appear in the right dialog box. Before you begin The Microsoft 365 admin center lets you manage Microsoft Entra roles and Microsoft Intune roles. However, these roles are a subset of the roles available in the Microsoft Entra admin center and the Microsoft Intune admin center. For the full list of detailed Microsoft Entra role descriptions you can manage in the Microsoft 365 admin center, see Administrator role permissions in Microsoft Entra built-in roles . For the full list of detailed Microsoft Intune role descriptions you can manage in the Microsoft 365 admin center, see Role-based access control (RBAC) with Microsoft Intune . For more information on assigning roles in the Microsoft 365 admin center, see Assign admin roles . Microsoft recommends that you use roles with the fewest permissions, and that you limit the number of users who have administrative permissions. See Least privileged roles by task in Microsoft Entra ID . Security guidelines for assigning roles Because administrators have access to sensitive data and files, follow these guidelines to keep your organization's data more secure. If you get a message in the Microsoft 365 admin center that indicates you don't have permission to edit a setting or page, it's because you're assigned to a role that doesn't have that permission. In this case, take one or more of the following actions: Talk to another administrator to assign you the correct role. Learn more about how administrator roles are assigned. See Assign administrator roles . Contact support for Microsoft 365 for business . Commonly used Microsoft 365 admin center roles To view administrator roles, follow these steps: In the Microsoft 365 admin center , go to Role assignments . In the Microsoft 365 admin center , go to Role assignments . Select any role to open its detail pane. Select any role to open its detail pane. Select the Permissions tab to view the detailed list of what administrators assigned that role have permissions to do. Select the Permissions tab to view the detailed list of what administrators assigned that role have permissions to do. Select the Assigned or Assigned admins tab to add users to roles. To view the full list of roles, go to the bottom of the list and select Show all by Category . For detailed information, including the cmdlets associated with a role, see Microsoft Entra built-in roles . Select the Assigned or Assigned admins tab to add users to roles. To view the full list of roles, go to the bottom of the list and select Show all by Category . For detailed information, including the cmdlets associated with a role, see Microsoft Entra built-in roles . Administrator roles and who should be assigned The following table lists administrator roles and information about who should be assigned these roles. To see the full list of roles, visit Microsoft Entra built-in roles . Manage all aspects of Microsoft Copilot Manage AI-related enterprise services, extensibility, and Copilot agents on the Integrated Apps page in the Microsoft 365 admin center Manage agent instances and agent identities using available administrator experiences, such as upload, publish, install, activate, and block or unblock agents where supported Grant tenant-wide consent for apps and agents requesting permissions except Microsoft Graph application permissions. Apps or agents requiring Microsoft Graph application permissions continue to require Global Administrator approval. View usage reports, adoption insights, and organizational insight View basic subscription properties View agents flagged as risky in Identity Protection for agents Allow users to install an app or install an app for users in the organization if the app doesn't require permission Read and configure Microsoft Azure and Microsoft 365 service health dashboards Create and manage support requests in the Microsoft Azure portal and the Microsoft 365 admin center Read all aspects of Microsoft Copilot Read all properties of agent identities, agent identity blueprint principals, and agent identity blueprints Read and configure Microsoft Azure and Microsoft 365 service health dashboards Manage all aspects of billing Create and manage support tickets in the Azure portal Recover deleted items in a user's mailbox Set up "Send As" and "Send on behalf" delegates Manage all admin features for Microsoft Fabric and Power BI Report on usage and performance Review and manage auditing Reset passwords for any user and all other administrators Manage purchasing of your organization's subscriptions and products Reset passwords for all users Add and manage domains Unblock another Global Administrator View agent overview and agents in the registry for their tenant, with details around the metrics with all the richness of agent metadata details View administrator features and settings in admin centers that the Global Administrator can view. Create, edit, delete, and restore Microsoft 365 Groups Create and update group creation, expiration, and naming policies Create, edit, delete, and restore Microsoft Entra security groups Reset passwords Force users to sign out Manage service requests Monitor service health Reprocess license assignments for group-based licensing Assign product licenses to groups for group-based licensing Monitor all notifications in the Message Center, including data privacy messages View groups, domains, and subscriptions Monitor Message Center notifications Get weekly email digests of Message Center posts and updates Share Message Center posts Have read-only access to Microsoft Entra services, such as users and groups Access the full set of administrative capabilities of Microsoft Graph Data Connect Manage Microsoft Graph Data Connect settings in a tenant Enable or disable the Microsoft Graph Data Connect service Configure dataset workload selections in Microsoft Graph Data Connect

Configure cross-tenant data movement settings in Microsoft Graph Data Connect View, approve, or deny application authorization requests for Microsoft Graph Data Connect View, create, update, or delete application registrations for Microsoft Graph Data Connect Use Migration Manager in the Microsoft 365 admin center to manage content migration to Microsoft 365, including Microsoft Teams, OneDrive, and SharePoint sites, from various sources such as Google Drive, Dropbox, Box, and Slack Select migration sources, create migration inventories (such as Google Drive user lists), schedule and execute migrations, and download reports Create new SharePoint sites or Teams teams if the destination sites or teams don't already exist, create SharePoint lists under the SharePoint admin sites, and create and update items in SharePoint lists Manage migration project settings and migration lifecycle for tasks and manage permission mappings from source to destination. Use the Cloud Policy service for Microsoft 365 to create and manage cloud-based policies. Create and manage service requests Manage the What's New content that users see in their apps in Microsoft 365 Monitor service health Manage Office Scripts settings Update profile photos for all users including administrators Update people settings for all users (pronouns, name pronunciation, and profile card settings) Manage all admin features for Power Apps, Power Automate, Power BI, Microsoft Fabric, and Microsoft Purview Data Loss Prevention Create and manage service requests Monitor service health View agent overview and agents in the registry for their tenant, with details around the metrics with all the richness of agent metadata details View usage data and the activity reports in the Microsoft 365 admin center Get access to the Power BI adoption content pack Get access to sign-in reports and activity in Microsoft Entra ID View data returned by Microsoft Graph reporting API Open and manage service requests View and share Message Center posts Monitor service health Create and delete sites Manage site collections and global SharePoint settings Use the SharePoint Admin Agent Manage all aspects of SharePoint Advanced Management View names, paths, and URLs of files, folders, libraries, documents, and lists within SharePoint sites, without accessing file or item content Remove permissions from files, folders, libraries, documents, and lists within SharePoint sites Manage meetings Manage conference bridges Manage all org-wide settings, including federation, teams upgrade, and teams client settings Create, disable, or enable user accounts Add users and groups Assign licenses Manage most users properties Create and manage user views Update password expiration policies Manage service requests Monitor service health Update (FIDO) device keys View a summary of agents across your tenant to gain visibility into overall usage and adoption trends Access Experience Insights, Adoption Score, and the Message Center in the Microsoft 365 admin center. View a summary of agents across your tenant to gain visibility into overall usage and adoption trends This role includes the permissions of the Usage Summary Reports Reader role. Also see Check admin roles in your organization . Permissions based on administrator roles and group type in the Microsoft 365 administrator center Delegated administration for Microsoft Partners If you're working with a Microsoft partner, you can assign them administrator roles. They can assign users in your company, or their company, administrator roles. Assign administrator roles to partners if they're setting up and managing your online organization for you. A partner can assign these roles: Admin Agent Privileges equivalent to a global administrator, except for managing multifactor authentication through the Partner Center. Helpdesk Agent Privileges equivalent to a helpdesk admin. Before the partner can assign these roles to users, you must add the partner as a delegated administrator to your account. The partner has to be an authorized partner. The partner sends you an email to ask if you want to give them permission to act as a delegated admin. For instructions, see Authorize or remove partner relationships . Volume licensing roles Volume licensing (VL) agreement administrators access their volume licenses in the Microsoft 365 admin center . VL Administrators don't have permissions to any other admin center information or functionality outside the VL section. Global administrators don't assign any VL roles and don't need to assign any administrator role to a VL Administrator for them to access the VL agreement. Global administrators don't have access to VL information or functionality in the admin center, unless a VL Administrator assigns them to a VL role. For more information, see Manage volume licensing user roles or contact the Volume Licensing Support team . Related content Get support for Microsoft 365 for business Get support for Microsoft 365 for business Reset passwords in Microsoft 365 for business Reset passwords in Microsoft 365 for business Assign administrator roles Assign administrator roles Check administrator roles in your organization Check administrator roles in your organization Manage user authentication methods for Microsoft Entra multifactor authentication Manage user authentication methods for Microsoft Entra multifactor authentication Microsoft Entra roles in the Microsoft 365 administrator center Microsoft Entra roles in the Microsoft 365 administrator center Activity reports in the Microsoft 365 admin center Activity reports in the Microsoft 365 admin center Exchange Online administrator role Exchange Online administrator role Was this page helpful? Need help with this topic? Want to try using Ask Learn to clarify or guide you through this topic? Additional resources Last updated on 2026-06-18