About Office 365 admin roles

Office 365 comes with a set of administrator roles that you can assign to users in your organization. Each admin role maps to common business functions, and gives those people permissions to do specific tasks the Office 365 admin center.

Here are the available roles and what people assigned to them can do:

Role

What they do in Office 365

Global admin

Global administrator

Accesses all administrative features in the Office 365 suite of services in your plan, including Skype for Business. By default the person who signs up to buy Office 365 becomes a global admin.

Global admins are the only admins who can assign other admin roles. You can have more than one global admin in your organization. As a best practice we recommend that only a few people in your company have this role. It reduces the risk to your business.

Tip: Make sure everyone who is a global admin in your organization has a mobile phone number and alternate email address in their contact info. Check out Change your organization's address, technical contact email, and other information for more details.

Credit card

Billing administrator

Makes purchases, manages subscriptions, manages support tickets, and monitors service health.

Exchange Online

Exchange administrator

Manages mailboxes and anti-spam policies for your business, using the Exchange admin center. To learn more, see About the Exchange Online admin role.

SharePoint admin

SharePoint administrator

Manages the document storage for your business on SharePoint Online. They do this in the SharePoint admin center. They can also assign other people to be Site Collection administrators and Term Store administrators.

Permissions assigned to SharePoint sites are completely separate from the Office 365 global admin role. You can be a global admin without access to a SharePoint site if you weren't added to it or didn't create the site.

To learn more, see About the SharePoint Online admin role.

Key, permissions

Password administrator

Resets passwords, manages service requests, and monitors service health. Password admins are limited to resetting passwords for users.

Skype for Business Online

Skype for Business administrator

Configures Skype for Business for your organization and reviews usage reports. To learn more, see About the Skype for Business admin role.

Headset

Service administrator

Opens support requests with Microsoft, and views the service dashboard and message center. They have “view only” permissions except for opening support tickets and reading them.

Tip: People who are assigned to the Exchange Online, SharePoint Online, and Skype for Business admin roles should also be assigned to the Service admin role. This way they can see important information in the Office 365 admin center, such as the health of the service, and change and release notifications.

User

User management administrator

Resets passwords, monitors service health, adds and deletes user accounts, and manages service requests. The user management admin can’t delete a global admin, create other admin roles, or reset passwords for billing, global, and service admins.

Microsoft Dynamics CRM Online

Microsoft Dynamics CRM Online

There is no Office 365 admin role specifically for Microsoft Dynamics CRM Online. Rather, when a person is assigned to the Office 365 global administrator role, they are automatically assigned to the System Administrator security role in CRM Online.

A person assigned to the System Administrator security role in CRM can assign other people to CRM security roles. With the System Administrator security role, you can manage all aspects of CRM. For more information about CRM Online security roles, see this CRM article on Microsoft TechNet: Manage subscriptions, licenses, and user accounts.

What can the Office 365 admin roles do in Exchange Online, SharePoint Online, and Skype for Business Online?

Certain admin roles in Office 365 have a corresponding role in Exchange Online, SharePoint Online, and Skype for Business Online. The table below describes how these Office 365 admin roles translate into roles in the different Office 365 services.

Office 365 admin role

Translates to this in Exchange Online …

Translates to this in SharePoint Online …

Translates to this in Skype for Business Online.....

Translates to this in the Security & Compliance Center...

global admin

Exchange Online admin

Company admin

SharePoint Online admin

Skype for Business admin

Security & Compliance Center admin (member of OrganizationManagement role group)

billing admin

N/A

N/A

N/A

N/A

password admin

Help Desk admin

N/A

Skype for Business Online admin

N/A

service admin

N/A

N/A

N/A

N/A

user management admin

N/A

N/A

Skype for Business admin

N/A

Exchange administrator

Exchange Online admin

N/A

N/A

N/A

SharePoint administrator

N/A

SharePoint Online admin

N/A

N/A

Skype for Business administrator

N/A

N/A

Skype for Business admin

N/A

Delegated administration

If you're working with a Microsoft partner, you can assign them admin roles. They in turn can assign users in your company - or their company - admin roles. You might want them to do this, for example, if they are setting up and managing Office 365 for you.

A partner can assign these roles:

  • Full administration, which has privileges equivalent to a global admin.

  • Limited administration, which has privileges equivalent to a password admin.

Before the partner can assign these roles to users, you must add the partner as a delegated admin to your Office 365 account. This process is initiated by an authorized partner. The partner sends you an email to ask you if you want to give them permission to act as a delegated admin. For instructions, see Authorize or remove partner relationships.

See Also

Assign admin roles in Office 365

Share Facebook Facebook Twitter Twitter Email Email

Was this information helpful?

Great! Any other feedback?

How can we improve it?

Thank you for your feedback!

×