Microsoft 365 Admin Roles and Least Privilege

Microsoft 365 admin roles are predefined sets of permissions that control administrative access to Microsoft 365 services. They are part of Azure Active Directory (Azure AD) role-based access control (RBAC). When you assign a role to a user, that user gains the permissions associated with the role across the Microsoft 365 tenant. Roles are granular: there are over 60 built-in roles, each designed for specific administrative tasks. The principle of least privilege dictates that users should be granted only the permissions necessary to perform their job functions — no more.

Before granular roles, the only way to delegate administration was to assign the Global Administrator role, which grants unrestricted access to all settings and data. This violates least privilege and increases the blast radius of a compromised account. Microsoft 365 roles allow organizations to delegate tasks (e.g., resetting passwords, managing groups, configuring Exchange) without giving full control. The exam expects you to know the most common roles and their scopes.

Azure AD stores role definitions as collections of permissions. When a user attempts an operation (e.g., via the Microsoft 365 admin center, PowerShell, or Graph API), Azure AD evaluates the user's role memberships. If any role grants the required permission, access is allowed. This is similar to how Windows RBAC works but at the cloud directory level.

Each role has a set of "allowedActions" and "notActions" (though notActions are rarely used). For example, the User Administrator role includes the permission to create users but not to delete them? Actually, User Administrator can delete users but not delete all users? Wait, let's be precise: User Administrator can create, manage, and delete users, but cannot manage roles or subscriptions. The exam tests these boundaries.

Roles do not inherit from each other. For example, being a User Administrator does not automatically grant any Exchange Administrator permissions. However, some roles overlap in permissions. The exam may ask which role can perform a specific task — you must know the exact boundaries.

Roles are assigned to users (or groups — see below) via the Azure AD portal, Microsoft 365 admin center, PowerShell (AzureAD module or Microsoft Graph PowerShell SDK), or Microsoft Graph API. To assign a role:

Using PowerShell:

# Connect to Azure AD
Connect-AzureAD

# Assign User Administrator role to user@contoso.com
Add-AzureADDirectoryRoleMember -ObjectId <RoleObjectId> -RefObjectId <UserObjectId>

To find the role ObjectId:

Get-AzureADDirectoryRole | Where-Object {$_.DisplayName -eq "User Administrator"}

Using Microsoft Graph PowerShell (recommended for newer tenants):

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"
New-MgRoleManagementDirectoryRoleAssignment -PrincipalId <UserId> -RoleDefinitionId <RoleId> -DirectoryScopeId "/"

Azure AD allows assigning roles to cloud groups (security groups or Microsoft 365 groups) instead of individual users. This simplifies management: add users to the group, and they inherit the role. The group must be assigned the "role-assignable" attribute (isAssignableToRole: true). Only Global Administrators and Privileged Role Administrators can create such groups. This is a key exam point: role-assignable groups cannot be dynamic groups; they must be assigned membership.

Every tenant has default role assignments: the person who signed up for the subscription becomes a Global Administrator. Additionally, Azure AD creates a few roles automatically: Global Administrator (the default), Billing Administrator (if a billing admin was added), etc. The exam may ask about the initial setup.

Least privilege means giving users the minimum permissions needed to perform their tasks. In Microsoft 365, this translates to:

Custom roles allow you to define a set of permissions from a list of over 1,000 actions. However, custom roles cannot include all permissions — some high-impact actions are reserved for built-in roles. The exam tests when to use built-in vs. custom roles.

PIM provides just-in-time (JIT) privileged access, time-bound role activation, and approval workflows. It is a key tool for enforcing least privilege. With PIM:

PIM is available with Azure AD Premium P2. The exam expects you to know PIM capabilities and how they support least privilege.

Most roles have a tenant-wide scope — they apply to all resources. However, some roles can be scoped to an administrative unit (AU). AUs allow you to delegate administration over specific subsets of users, groups, and devices. For example, you can create an AU for the "Sales" department and assign a Helpdesk Administrator role scoped to that AU. The admin can then only reset passwords for users in Sales. This is critical for large organizations.

If a user has multiple roles, they get the union of all permissions. For example, a user who is both User Administrator and Exchange Administrator can manage both users and mailboxes. There is no negative permission unless explicitly denied via custom roles (using notActions).

When a user performs an action, Azure AD logs it in the Audit logs. You can review who did what, when, and from where. This is essential for compliance and troubleshooting. The exam may ask about audit log retention: 30 days for Azure AD Free, 30 days for Premium P1, and 365 days for Premium P2.

Admin roles integrate with: - Microsoft 365 Defender: Security roles control access to security alerts and incidents. - Microsoft Purview compliance portal: Compliance roles manage DLP, eDiscovery, and retention. - Azure AD Identity Protection: Security Administrator can manage risk policies. - Exchange Online: Exchange Admin role manages mailboxes, transport rules, etc. - SharePoint Online: SharePoint Admin role manages site collections and sharing. - Teams: Teams Admin role manages teams settings and policies.

Note: Custom roles cannot include permissions for high-privilege actions like managing role assignments or subscriptions. Those require built-in roles.

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"

# Get role definition ID
$role = Get-MgRoleManagementDirectoryRoleDefinition -Filter "DisplayName eq 'User Administrator'"

# Get user ID
$user = Get-MgUser -Filter "UserPrincipalName eq 'user@contoso.com'"

# Create role assignment
New-MgRoleManagementDirectoryRoleAssignment -PrincipalId $user.Id -RoleDefinitionId $role.Id -DirectoryScopeId "/"

Note: Once created, the group cannot be converted to a dynamic group. Also, the group's membership must be assigned, not dynamic.

This enforces least privilege by ensuring only necessary users retain role assignments.

Azure AD provides a report that lists each role and its permissions. To access:

GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments
Authorization: Bearer {token}

This returns all role assignments. You can filter by principalId or roleDefinitionId.

Note: Custom roles are available only with Azure AD Premium P1 or P2. The exact permission names are important for the exam.

You can create a Conditional Access policy that targets admin roles (e.g., require MFA for all Global Administrators). This is a common exam scenario.

Connect-AzureAD
$roles = Get-AzureADDirectoryRole
$report = @()
foreach ($role in $roles) {
    $members = Get-AzureADDirectoryRoleMember -ObjectId $role.ObjectId
    foreach ($member in $members) {
        $report += [PSCustomObject]@{
            RoleName = $role.DisplayName
            UserName = $member.UserPrincipalName
        }
    }
}
$report | Export-Csv -Path "RoleAssignments.csv" -NoTypeInformation

This is useful for auditing and ensuring least privilege.

Each role has a fixed GUID. For example:

The exam does not require memorizing GUIDs, but you should know how to find them.

Get-MgRoleManagementDirectoryRoleDefinition | Select-Object DisplayName, Id

This lists all roles with their IDs.

GET https://graph.microsoft.com/v1.0/roleManagement/directory/roleDefinitions/{role-id}
Authorization: Bearer {token}

Returns the role definition including allowedActions.

POST https://graph.microsoft.com/v1.0/roleManagement/directory/roleAssignments
Content-Type: application/json
Authorization: Bearer {token}

{
  "principalId": "group-id",
  "roleDefinitionId": "role-definition-id",
  "directoryScopeId": "/"
}

This is the essence of least privilege: temporary elevation.

Suppose you need a role that can only manage user photos. There's no built-in role for that, so create a custom role with the permission "microsoft.directory/users/photo/update." Assign it to the HR team.

Always read the description of a role before assigning. The description tells you exactly what the role can do. For example, "Helpdesk Administrator: Can reset passwords for non-administrators and helpdesk users."

Security roles (e.g., Security Administrator) can also be managed from security.microsoft.com > Permissions. This is a common exam scenario: where to assign which role.

Azure AD roles control access to Azure AD resources (users, groups, roles). Azure RBAC roles control access to Azure resources (VMs, storage, etc.). They are separate. The exam may ask which role is needed for a task: Azure AD roles for directory tasks, Azure RBAC for Azure resources.

Only Global Administrators and Privileged Role Administrators can assign roles. So if you want to delegate role management to a security team, assign them the Privileged Role Administrator role. They can then assign other roles (including Global Admin to themselves, which is why this role is highly privileged).

Set up recurring access reviews for sensitive roles. For example, quarterly review of Global Administrator assignments. If a user no longer needs the role, revoke it.

Use Azure AD sign-in logs and audit logs to see when admins are using their roles. If a role is never used, consider removing it.

Service accounts (used by applications) should also follow least privilege. Assign the minimum roles needed, and avoid using Global Admin for service accounts. Use application permissions instead.

In the admin center, go to Roles > Role descriptions. This provides a user-friendly list of roles and their capabilities.

There is no hard limit on the number of role assignments, but best practice is to keep them minimal. Azure AD Premium P2 is recommended for large organizations.

This comprehensive coverage ensures you understand both the theory and practical application of Microsoft 365 admin roles and least privilege.

A multinational corporation with 50,000 employees has separate IT teams for helpdesk, security, compliance, and infrastructure. The helpdesk team needs to reset passwords for end users but not for executives or other admins. The security team needs to manage Microsoft 365 Defender and Conditional Access policies. The compliance team needs to manage eDiscovery and retention policies.

To enforce least privilege, the organization assigns:

They create role-assignable groups for each team to simplify membership management. For example, the "Security Admins" group is assigned the Security Administrator role. When a new security analyst joins, they are added to the group and immediately inherit the role.

The organization also uses PIM access reviews quarterly to ensure no one retains unnecessary roles. This setup reduces the blast radius: if a helpdesk account is compromised, the attacker can only reset passwords for a subset of users, not access security settings.

A small business with 200 employees has one IT generalist who handles everything. The principle of least privilege still applies: the IT staff should not have Global Admin permanently. Instead, they use PIM to make themselves eligible for Global Admin. They also assign themselves the User Administrator role permanently for daily tasks like creating users and resetting passwords.

They create a custom role for a part-time contractor who only needs to manage SharePoint Online permissions. The custom role includes only SharePoint-related permissions. This avoids giving the contractor broader access.

The business also uses Azure AD audit logs to monitor all admin actions. Since they have Azure AD Premium P2, they retain logs for 365 days for compliance.

In production, always start with the most restrictive role, use PIM for elevation, and regularly audit assignments. This approach minimizes security incidents and satisfies compliance requirements.