Export (0) Print
Expand All

Assigning administrator roles

Published: April 16, 2012

Updated: February 27, 2014

noteNote
This topic provides online help content for cloud services, such as Windows Intune and Office 365, which rely on Windows Azure Active Directory for identity and directory services.

Depending on the size of your organization, you may want to designate several administrators who serve different functions to performing various tenant-related administrator tasks such as creating and editing users, managing billing operations, and resetting passwords. For more information about other tenant administrator tasks, see What are tenant administrator responsibilities?.

CautionCaution
When you assign an admin role using any of the portals (or cmdlets), it is important you understand that this change will be tenant-wide, so assigning an admin role in one portal will grant the user the same permissions across all of the services that your organization has subscribed to. For more information about how your tenant works, see Administering your Windows Azure AD tenant.

The following admin roles can be assigned:

  • Billing administrator: Makes purchases, manages subscriptions, manages support tickets, and monitors service health.

    noteNote
    If you did not purchase a Microsoft cloud service, you will not be able to make billing changes and therefore will not have the billing administrator role available to you. For billing issues, contact the administrator at the organization where you purchased your subscription.

  • Global administrator: Has access to all administrative features. By default, the person who signs up to purchase a Microsoft cloud service on behalf of your organization automatically becomes the first global administrator in your tenant. Only global administrators can assign other administrator roles. There can be more than one global administrator at your organization.

    TipTip
    Using Windows Intune? Once this group is synchronized into Windows Intune it will appear as a Security Group criteria for Groups, however it will be called Company Administrators and not "Global Administrators".

  • Password administrator: Resets passwords, manages service requests, and monitors service health. Password administrators can reset passwords only for users and other password administrators.

  • Service administrator: Manages service requests and monitors service health.

    noteNote
    To assign the service administrator role to a user, the global administrator must first assign administrative permissions to the user in the service, such as Windows Intune, and then assign the service administrator role to that user.

  • User management administrator: Resets passwords, monitors service health, and manages user accounts, user groups, and service requests. Some limitations apply to the permissions of a user management administrator. For example, he or she cannot delete a global administrator or create other administrators. Also, he or she cannot reset passwords for billing, global, and service administrators.

The following table shows the administrator roles and their associated permissions.

 

Permission Billing administrator Global administrator Password administrator Service administrator User management administrator

View organization and user information

Yes

Yes

Yes

Yes

Yes

Manage support tickets

Yes

Yes

Yes

Yes

Yes

Reset user passwords

No

Yes

Yes

No

Yes; with limitations. He or she cannot reset passwords for billing, global, and service administrators.

Perform billing and purchasing operations

Yes

Yes

No

No

No

Create and manage user views

No

Yes

No

No

Yes

Create, edit, and delete users and groups, and manage user licenses

No

Yes

No

No

Yes; with limitations. He or she cannot delete a global administrator or create other administrators.

Manage domains

No

Yes

No

No

No

Manage organization information

No

Yes

No

No

No

Delegate administrative roles to others

No

Yes

No

No

No

Use directory synchronization

No

Yes

No

No

No

TipTip
Using Office 365? For information about administrator roles and permissions specific to Microsoft Office 365, see the wiki article Permissions in Office 365 FAQ or Understanding Role Based Access Control.

Use the following steps to assign or remove administrator permissions for an existing user.

noteNote
Administrators who forget their passwords can use the password self-reset process to regain access to their accounts. To use this feature, both a mobile phone number that can receive a text message and an alternate email address that is not tied to the cloud service subscription must be included with an administrator’s information.

  1. In the Management Portal, click Active Directory, and then click on the name of your organization’s directory.

  2. On the Users page, click the display name of the user you want to edit.

  3. Select the Organizational Role drop-down menu, and then select User to remove an existing admin role or Global Administrator to assign an admin role. If you select Global Administrator, provide additional information as explained in the next two steps.

    noteNote
    For the Spring 2013 release of Windows Azure, you can only select the Global Administrator admin role. This will be updated to support additional admin roles in the future.

  4. In the Alternate email address box, type an email address. This email address is used for important notifications, including password self-reset, so the user must be able to access the email account whether or not the user can access the cloud service.

  5. When you have finished, click Save.

More information The following steps can be completed using either the Office 365 account portal, the Windows Intune account portal or the Windows Azure AD portal, depending on which services your organization has subscribed to. In this way, portals act as front-end interfaces that pull in directory data associated with your organizations Windows Azure AD tenant. For more information about using portals to manage your tenant, see Administering your Windows Azure AD tenant.

  1. Depending on which portal you are using, in the left pane, click either Users or Users and Groups.

  2. Depending on which portal you are using, select the check box next to the name of the user whose administrator role you want to change, and then click either Edit or the Edit icon.

  3. Click Settings, under Assign role, select No to remove administrator permissions or Yes to grant administrator permissions. If you select Yes, select the appropriate role from the list, and then provide additional information on the Settings tab and on the Details tab as explained in the next two steps.

  4. In the Alternate email address box, type an email address that is not connected to the cloud service. This email address is used for important notifications, including password self-reset, so the user must be able to access the email account whether or not the user can access the cloud service.

  5. Click the Details tab. Click the arrow next to Additional details, and in the Mobile phone box, type the number of a mobile phone—including the country code—that can receive a text (SMS) message, if the user has one. This phone number is also used in the password self-reset process.

  6. When you have finished, click Save.

noteNote
For partner companies that are certified to provide delegated administration, additional features are available. In addition to setting administrative access for your own organization, you can also set administrative access for companies you support. There are two types of administrative access that can be assigned to your support agents:

  • Full administration: this role has privileges equivalent to those for the global administrator role.

  • Limited administration: this role has privileges equivalent to those for the password administrator role.

This additional capability is available when you add or edit users, as well as when you bulk edit groups of users.

Use the following steps to assign or remove permissions for multiple existing users.

noteNote
You cannot assign administrator permissions during the process of adding multiple users using bulk import.

  1. Depending on which portal you are using, in the left pane, click either Users or Users and Groups.

  2. Depending on which portal you are using, select the check box next to the names of the users that you want to assign administrator permissions to or remove administrator permissions from, and then click either Edit or the Edit icon.

  3. On the Details page, click Next.

  4. On the Settings page, under Assign role, select No to remove permissions or Yes to grant permissions. If you select Yes, select the appropriate role from the list. When you have finished, click Next.

  5. On the Assign licenses page, click Submit.

  6. On the Results page, review your results. When you have completed your review, click Finish.

Community Additions

Show:
© 2014 Microsoft