Microsoft 365 admin roles and least privilege explained

Admin roles decide who can change a Microsoft 365 tenant: who can create users, reset passwords, change email settings or turn security features on and off. Because an admin account can change so much, Microsoft’s documentation treats these accounts as a priority to protect. This page explains how Microsoft describes built-in roles, least privilege, emergency access accounts and Privileged Identity Management (PIM).

What admin roles are

Microsoft’s Microsoft 365 admin documentation explains that tasks like “adding users, assigning licenses, or configuring services” need an administrator role, and that each role “corresponds to common business functions.” Microsoft Entra ID, the identity service behind Microsoft 365, has many built-in roles. Microsoft’s Entra best practices page says Entra role-based access control “supports over 65 built-in roles.” The Entra ID basics guide explains where roles sit alongside users and groups.

Some of the common roles Microsoft describes:

Microsoft notes that the person who bought the subscription becomes a Global Administrator automatically, and that there can be more than one.

How to see and change who has admin roles

Based on Microsoft’s instructions (checked October 2026). Menus can change; Microsoft’s guide to assigning admin roles has the latest steps.

1. Sign in to the Microsoft 365 admin center and go to Roles > Role assignments.
2. Select a role, such as Global Administrator, and open the Assigned tab to see who holds it. Export admin list downloads every admin in the organisation as a .csv file.
3. To give someone a role, select Add users or Add groups on the same tab. Or go to Users > Active users, select the person and choose Manage roles.

The Microsoft Entra admin center shows the same assignments under Entra ID > Roles & admins: select a role name, then Assignments. Microsoft’s page on listing Entra role assignments also describes Download assignments for a full export.

Least privilege, as Microsoft describes it

Microsoft’s admin roles page states: “Microsoft recommends that you use roles with the fewest permissions, and that you limit the number of users who have administrative permissions.” It gives an example: someone who only needs to reset passwords can be given Password Administrator or Helpdesk Administrator rather than “the unlimited global administrator role.”

Microsoft’s Entra role best practices add more detail:

• Avoid broad roles at broad scopes. Microsoft says to avoid “assigning broader roles at broader scopes even if it initially seems more convenient to do so.”
• Fewer than five Global Administrators. Microsoft recommends assigning the Global Administrator role “to fewer than five people in your organization.”
• Fewer than 10 privileged role assignments. Microsoft says the use of roles labelled PRIVILEGED should be limited to fewer than 10 assignments, and that the admin center shows a warning above that.
• MFA for every admin account. Microsoft lists turning on MFA for all administrator accounts as a best practice. Its admin roles page explains that with MFA, a stolen password alone “isn’t sufficient to sign in.”
• Cloud-native accounts for roles. Microsoft advises against assigning Entra roles to accounts synced from on-premises Active Directory, because a compromised on-premises account “can compromise your Microsoft Entra resources as well.”
• Regular access reviews to find and remove role assignments that are no longer needed.

Microsoft’s guide to responding to a compromised Microsoft 365 account also includes reviewing and removing admin roles the user shouldn’t have.

Microsoft’s admin roles page also describes keeping “at least a Privileged Authentication administrator in case a Global Administrator is locked out of their account.”

Separate admin accounts

Microsoft’s current guidance does describe separate accounts for admin work. Its Microsoft 365 Business Premium guidance states that admins “should use non-admin accounts as primary accounts to sign in to their computers and do regular tasks like checking email and using Microsoft 365 Apps,” and use their admin account “only as needed.” The same page describes a naming convention that “doesn’t advertise the fact that an account has admin privileges”, for example a regular account mia.ng@yourbusiness.example and an admin account mian@yourbusiness.example.

Microsoft’s enterprise guidance on protecting privileged accounts says the same thing differently: instead of giving everyday accounts admin roles, it describes creating “dedicated user accounts that have the admin roles in Microsoft Entra ID.”

Emergency access (break-glass) accounts

An emergency access account is a spare admin account kept for the moment when normal admins can’t sign in, such as when a sign-in policy is set up wrongly. Microsoft’s emergency access documentation describes:

• two or more emergency access accounts, for redundancy
• cloud-only accounts on the .onmicrosoft.com domain, not federated or synced from on-premises
• the Global Administrator role assigned to them
• protection with a passkey (FIDO2), which Microsoft marks as recommended, or certificate-based authentication, which Microsoft says satisfies its mandatory MFA requirements
• excluding them from any Conditional Access policy that blocks or restricts sign-in (see moving from security defaults to Conditional Access)
• not tying them to any individual person, with credentials stored somewhere available to several admins
• alerts for every use, and testing at least every 90 days.

Microsoft’s pages differ here. The Business Premium page “Protect your administrator accounts” (last updated January 2026) says emergency access accounts “need to be excluded from MFA requirements” and should have long, complex passwords of 16 or more characters. The more detailed Entra emergency access page (last updated June 2026) describes a passkey (FIDO2) or certificate-based authentication, which it says satisfy Microsoft’s mandatory MFA requirements. Microsoft’s mandatory MFA page (last updated April 2026) also states that emergency access accounts “are also required to sign in with MFA once enforcement begins.” This page follows the Entra pages for that reason; Microsoft’s own pages are the authority for any particular tenant.

Privileged Identity Management (PIM)

Microsoft describes PIM as “a service in Microsoft Entra ID that enables you to manage, control, and monitor access to important resources.” Instead of someone holding an admin role all the time, PIM lets them be eligible for it and activate it when they need it. Microsoft says there’s no difference in the access an eligible or permanent assignment gives; the difference is that “some people don’t need that access all the time.”

Features Microsoft lists for PIM include:

• just-in-time and time-bound access with start and end dates
• approval before a role can be activated
• MFA to activate any role
• a justification for each activation
• notifications when privileged roles are activated
• access reviews and downloadable audit history.

Microsoft’s best practices page states: “Microsoft recommends that you use PIM in Microsoft Entra ID.”

Based on Microsoft’s instructions (checked October 2026), roles are made eligible in the Microsoft Entra admin center under ID Governance > Privileged Identity Management > Microsoft Entra roles, by selecting Roles > Add assignments and choosing Eligible as the assignment type. Microsoft’s page says this needs at least the Privileged Role Administrator role; Microsoft’s PIM assignment guide has the full steps.

Licensing. Microsoft’s licensing documentation states: “You need either Microsoft Entra ID Governance licenses or Microsoft Entra ID P2 licenses to use PIM and all of its settings.” Microsoft’s Entra licensing page says Microsoft 365 Business Premium includes Entra ID P1, which isn’t listed as including PIM; the same page lists Entra ID P2 in Microsoft 365 E5 and E7 and in the Microsoft Defender Suite for Microsoft 365 Business Premium. The Microsoft 365 licensing and security features reference sets out which plans include which features.

Things that change

Microsoft’s mandatory MFA page states that MFA is required for accounts that sign in to the Azure portal, the Microsoft Entra admin center and the Microsoft Intune admin center, with enforcement for the Microsoft 365 admin center gradually beginning from February 2025 (phishing-resistant MFA methods in Microsoft 365 compares the options), and its emergency access page states that passkeys and certificate-based authentication satisfy those mandatory MFA requirements. Role names, numbers of built-in roles and licensing tiers change from time to time; this page reflects Microsoft’s documentation as checked on 21 October 2026.

Common questions

What does least privilege mean for Microsoft 365 admin roles?

Least privilege means giving each person the role with the fewest permissions that covers their job. Microsoft’s admin roles page says it recommends roles with the fewest permissions and limiting how many users have administrative permissions. Its example is someone who only resets passwords getting Password Administrator or Helpdesk Administrator rather than Global Administrator. Least privilege, as Microsoft describes it covers the rest of Microsoft’s list.

How many Global Administrators does Microsoft recommend?

Microsoft’s Entra role best practices recommend assigning Global Administrator to fewer than five people. The same page says roles labelled PRIVILEGED should be limited to fewer than 10 assignments, and that the admin center shows a warning above that. Microsoft also notes that whoever bought the subscription becomes a Global Administrator automatically. How to see and change who has admin roles shows where to check the current list.

Do I need a separate admin account in Microsoft 365?

Microsoft’s guidance describes using a separate account for admin work. Its Business Premium guidance states that admins “should use non-admin accounts as primary accounts” for everyday tasks like email, and use their admin account “only as needed.” Its enterprise guidance describes dedicated user accounts that hold the admin roles. Separate admin accounts includes Microsoft’s naming example, which doesn’t advertise that an account has admin privileges.

What is a break-glass account in Microsoft 365?

A break-glass, or emergency access, account is a spare admin account kept for when normal admins can’t sign in, such as after a sign-in policy is set up wrongly. Microsoft describes two or more cloud-only accounts on the .onmicrosoft.com domain with Global Administrator, protected with a passkey (FIDO2) or certificate-based authentication, with alerts for every use and testing at least every 90 days. Emergency access (break-glass) accounts notes where Microsoft’s pages differ.

What happens if a Global Administrator gets locked out?

Microsoft’s guidance plans for this with spare admin access. Its admin roles page describes keeping at least a Privileged Authentication administrator in case a Global Administrator is locked out, and its emergency access page describes break-glass accounts that are excluded from Conditional Access policies that block or restrict sign-in. Emergency access (break-glass) accounts sets out what Microsoft describes for those accounts.

Do I need Entra ID P2 for Privileged Identity Management?

Microsoft’s licensing documentation says PIM needs either Microsoft Entra ID P2 or Microsoft Entra ID Governance licences. Microsoft 365 Business Premium includes Entra ID P1, which Microsoft’s licensing pages don’t list as including PIM. Microsoft lists Entra ID P2 in Microsoft 365 E5 and E7 and in the Microsoft Defender Suite for Microsoft 365 Business Premium. Privileged Identity Management (PIM) explains what PIM does.

Related guides

• Security defaults vs Conditional Access covers excluding emergency accounts when sign-in policies change.
• Microsoft 365 MFA methods compared explains which methods Microsoft describes as phishing-resistant.