Skip to content
← Back to the guide

Microsoft 365 administrator roles

4slides. Screenshot a slide, download it as a PNG, or use your browser's Print → Save as PDF for a LinkedIn-ready multi-page carousel — each slide becomes one page.

M
solvingmicrosoft365.com
1 / 4

Microsoft 365 administrator roles

The Entra ID admin roles that gate Microsoft 365 administration — and how to assign them with least privilege.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-365-administrator-roles

Slide 1Download PNG
M
solvingmicrosoft365.com
2 / 4
01

How many Global Administrators should a tenant have?

Between two and five, including break-glass accounts — Microsoft's own recommendation and the threshold PIM alerts on. Everyone else gets a scoped role: Exchange, SharePoint, Teams, Intune, Security, Compliance, User, o…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-365-administrator-roles

Slide 2Download PNG
M
solvingmicrosoft365.com
3 / 4
02

What is the difference between Global Administrator and Global Reader?

Global Reader sees everything a Global Administrator sees, in every admin center, but cannot change anything. It is the right role for auditors, security reviewers, and managers who need visibility without the ability t…

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-365-administrator-roles

Slide 3Download PNG
M
solvingmicrosoft365.com
4 / 4
03

Which role can reset MFA for users?

Authentication Administrator for non-admin users; Privileged Authentication Administrator for anyone with an admin role. Helpdesk and User Administrators cannot manage authentication methods.

Solving Microsoft 365 · www.solvingmicrosoft365.com/guides/microsoft-365-administrator-roles

Slide 4Download PNG

Auto-generated from Microsoft 365 administrator roles. This page is not indexed and isn't part of the guide itself.