Office Support / Office 365 Admin / Users and passwords

Assigning admin roles in Office 365

Depending on the size of your organization, you may want to designate several admins who serve different functions. The admin has access to all features in the admin center, and can create or edit users, assign admin roles to others, reset user passwords, manage user licenses, and manage domains, among other things. Choose an admin role for an existing user, and then use this procedure to assign or remove the role.

Note   If you're using Office 365 Small Business, there is only one type of Office 365 admin. You can assign admin permissions to other users.

Important    Admins who forget their passwords can use the Reset passwords for admins process to reset their own passwords and regain access to their accounts. To use this feature, include both a mobile phone number that can receive a text message and an alternate email address that isn't connected to the Office 365 subscription with the admin’s information.

To assign admin roles to an existing user

  1. Sign in to Office 365 with your work or school account.

  2. Go to the Office 365 admin center.

  3. Go to Users > Active Users.

  4. On the Active users page, select the user whose administrator role you want to change, and then click Edit Edit.

  5. Click Settings. Under Assign role, click Yes or No.

  6. If you chose No, you are done and can click Save. If you chose Yes, choose a role from the list, and then continue with the rest of these steps.

  7. In the Alternate email address box, type an email address that is not connected to Office 365. This email address is used for important notifications, including resetting your admin password, so the user must be able to access the email account whether the user can access Office 365 or not.

    Note    If you don’t want to receive product-related communications at your alternate email address, change your contact preferences on the About me page. For more information, see Change your contact preferences.

  8. Click Details. Click the arrow next to Additional details, and in the Mobile phone box, type the number of a mobile phone—including the country code if the user has one—that can receive a text (SMS) message. This phone number is also used in the resetting your admin password process.

    Notes    You need a mobile phone that’s capable of receiving text messages for password reset only if one or both of the following applies to you:

    • Your organization has a custom domain that you’ve set up to use with Office 365.

    • Your Office 365 subscription is synchronized through directory synchronization.

  9. When you have finished, click Save.

    Notes   If you are a certified partner, you can set admin roles for your customers and the people in your organization that act as support agents or admins for your customers. These choices show up when you add or edit users, or when you add multiple users with bulk import. Admin roles a partner can set:

    • Full administration: This role has privileges equivalent to those for the global admin role.

    • Limited administration: This role has privileges equivalent to those for the password admin role.

What do you want to do?

Assign or remove admin roles for multiple users

Choose an admin role

Which services do my Office 365 permissions extend to?

View admin permissions by role

Assign or remove admin roles for multiple users

Use this procedure to assign or remove admin permissions for multiple existing users.

Note    You cannot assign admin permissions when you add multiple users using bulk import.

  1. Sign in to Office 365 with your work or school account.

  2. Go to the Office 365 admin center.

  3. Go to Users > Active Users.

  4. On the Active users page, check the box next to the names of the users whose admin roles you want to change, and then click Edit Edit.

  5. On the Details page, click Next.

  6. On the Settings page, under Assign role, click Yes or No.

  7. If you click Yes, choose a role from the list. When you have finished, click Next.

  8. On the Assign licenses page, click Submit.

  9. On the Results page, review your results, and then click Finish.

Top of Page

Choose which Office 365 admin role to delegate

Depending on the size of your organization, you may want to designate several admins who serve different functions. The following admin roles are available:

  • Global admin: Has access to all administrative features. Global admins are the only admins who can assign other admin roles. You can have more than one global admin in your organization. The person who signs up to purchase Office 365 becomes a global admin.

  • Billing administrator: Makes purchases, manages subscriptions, manages support tickets, and monitors service health.

    Note   If you didn’t purchase Office 365 from Microsoft, you can’t make billing changes and therefore can’t be assigned the billing admin role. For billing issues, contact the admin at the organization where you purchased your subscription.

  • Password administrator: Resets passwords, manages service requests, and monitors service health. Password admins are limited to resetting passwords for users and other password admins.

  • Service administrator: Manages service requests and monitors service health.

    Note   Before global admins can assign the service admin role to a user, they first assign the user administrative permissions to a service, such as Exchange Online, and then assign the service admin role to the user in Office 365.

  • User management administrator: Resets passwords, monitors service health, and manages user accounts, user groups, and service requests. The user management admin can’t delete a global admin, create other admin roles, or reset passwords for billing, global, and service admins.

  • Exchange administrator: Has administrative access to Exchange Online through the Exchange admin center (EAC), and can perform almost any task in Exchange Online.

  • SharePoint administrator: Has administrative access to SharePoint Online through the SharePoint Online admin center, and can perform almost any task in SharePoint Online.

  • Skype for Business administrator: Has administrative access to Skype for Business through the Skype for Business admin center, and can perform almost any task in Lync Online.

Which services do my Office 365 permissions extend to?

Certain admin roles Office 365 have a corresponding role in Exchange Online, SharePoint Online, and Lync Online. See the table below to learn how these Office 365 admin roles translate into roles in the different Office 365 services.

Office 365 admin role

Role in Exchange Online

Role in SharePoint Online

Role in Skype for Business

global admin

  • Exchange Online admin

  • Company admin

SharePoint Online admin

Skype for Business admin

billing administrator

N/A

N/A

N/A

password administrator

Help Desk admin

N/A

Skype for Business Online admin

service administrator

N/A

N/A

N/A

user management administrator

N/A

N/A

Skype for Business Online admin

Exchange administrator

Exchange Online admin

N/A

N/A

SharePoint administrator

N/A

SharePoint Online admin

N/A

Skype for Business administrator

N/A

N/A

Skype for Business Online admin

For more information about roles and permissions for Office 365 and Office 365 services, see the Permissions in Office 365.

Top of Page

View Office 365 admin permissions by role

This table shows the Office 365 admin roles and their associated permissions.

Permission

Billing admin

Global admin

Password admin

Service admin

User management admin

Exchange administrator

SharePoint administrator

Skype for Business administrator

View organization and user information

Yes

Yes

Yes

Yes

Yes

Yes

Yes (but can't edit)

Yes (but can't edit)

Manage support tickets

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Yes

Reset user passwords

No

Yes

Yes; with limitations. This admin can only reset passwords for non-admins.

No

Yes; with limitations. This admin can’t reset passwords for billing, global, and service admins.

No

No

No

Perform billing and purchasing operations

Yes

Yes

No

No

No

No

No

No

View users and roles

No

Yes

No

No

Yes

Yes

Yes

Yes

Create, edit, and delete users and groups

No

Yes

No

No

Yes; with limitations. This admin can’t delete a global admin or create other admins.

No

No

No

Manage user licenses

No

Yes

No

No

Yes; with limitations. This admin can’t delete a global admin or create other admins.

No

No

No

View user licenses

No

Yes

No

No

Yes; with limitations. This admin can’t delete a global admin or create other admins.

Yes

Yes

Yes

Manage domains

No

Yes

No

No

No

No

No

No

Manage organization information

No

Yes

No

No

No

No

No

No

View service health and message center posts

No

Yes

No

No

No

Yes

Yes

Yes

Delegate administrative roles to others

No

Yes

No

No

No

No

No

No

Use directory synchronization

No

Yes

No

No

No

No

No

No

Manage reporting

No

Yes

No

No

No

Yes

Yes

Yes

Manage mobile devices

No

Yes

No

No

No

No

No

No

Top of Page

Applies To: Office 365 End User, Office 365 Admin



Was this information helpful?

Yes No

How can we improve it?

255 characters remaining

To protect your privacy, please do not include contact information in your feedback. Review our privacy policy.

Thank you for your feedback!

Support resources

Change language