Microsoft 365 Help Assign or remove an admin role
Give an authorised person only the admin access needed for their job.
Before you start
- Approval from the person responsible for company IT access.
- An account allowed to assign roles, normally Privileged Role Administrator or Global Administrator.
- The exact role and person agreed with IT.
Follow these steps
-
Open the correct person
Go to Users → Active users. Search for the full work email address and select the matching user.
-
Check existing roles
In the details pane, open Account if necessary. Find Roles, then select Manage roles. Note the existing roles before changing them. Select Admin center access if the pane asks you to choose the type of access.
-
Select the agreed role
Select only the role the person needs. For example, User Administrator handles routine user work; Groups Administrator handles supported group administration. If the agreed role is hidden, select Show all by category or Show all, depending on the layout.
-
Review the scope
Read the role description. Do not choose Global Administrator just to make an error disappear. An administrator role affects Microsoft 365 administration; it is different from access to a shared mailbox or document folder.
-
Save the change
Select Save changes. To remove all admin access from an ordinary staff account, select User (no administrator access) when shown, or clear the direct roles being removed, then save. Do not remove emergency or IT owner access without their direction.
-
Check the result
Reopen the person’s account and confirm the intended roles. Ask them to sign out and sign back in before trying the task. Their account should already have MFA configured.
You have finished when…
- The intended role is shown on the correct user.
- No unrelated admin roles were added or removed.
Helpful tips
- Reception staff usually need ordinary user access unless particular admin duties have been assigned.
- Group-based or eligible roles may need to be managed by IT in Microsoft Entra or Privileged Identity Management.
Something looks different?
Manage roles is unavailable
Your account does not have permission to assign roles. Ask the authorised role administrator.
Removing a direct role did not remove access
The person may receive the role through a group or another assignment. Ask IT to review all role assignments.
Microsoft help & further guidance
Menu names can change as Microsoft updates the apps. These official pages include further instructions.