Who should be an admin in our Microsoft 365 account?
Keep the Global Administrator role to two trusted people, ideally the owner and one backup, both with two-step sign-in. Give everyone else the smallest role that does their job, such as Billing, User or Helpdesk Administrator. Outside helpers should have their own accounts or a partner relationship, never the owner's login.
The short version
- Two Global Administrators: the owner and one trusted backup. Not more than you need.
- Everyone else gets a smaller role, or none at all.
- Every admin uses two-step sign-in. Microsoft now requires it for the admin center.
- Outside helpers get their own account or a partner relationship.
- Check the list of admins at least once a year and whenever someone leaves.
What can a Global Administrator do?
Almost anything. Microsoft’s admin roles page says Global Administrators have “almost unlimited access” to settings and most data. They can reset anyone’s password, buy and cancel subscriptions, add domains, and unblock other admins. The person who signed up for the subscription becomes one automatically.
Microsoft’s advice is to have as few Global Administrators as possible, and to give people the “least permissive” role that gets their job done.
Which smaller roles fit a small business?
| Person | Role | What it lets them do |
|---|---|---|
| Bookkeeper or office manager who pays the bills | Billing Administrator | Buy, manage subscriptions, see invoices |
| Office manager who adds and removes staff | User Administrator | Create and disable users, assign licenses, reset most passwords |
| Someone who helps colleagues get back in | Helpdesk Administrator or Password Administrator | Reset passwords and sign people out, for non-admin users |
| Whoever looks after mailboxes | Exchange Administrator | Manage mailboxes, groups, Send As permissions |
| Whoever looks after Teams settings | Teams Administrator | Manage meetings and Teams settings |
How do I give someone a role?
- In the Microsoft 365 admin center, go to Users, then Active users.
- Select the person.
- Under roles, choose Manage roles, pick the role, and save.
To see who holds each role, go to Role assignments in the admin center, select a role, and open its Assigned tab. Microsoft also lets you read each role’s Permissions tab before you assign it.
Why two Global Administrators, not one?
Microsoft points out that a Global Administrator can lock themselves out and need a reset. Only another Global Administrator or a Privileged Authentication Administrator can reset them. With one admin, a lost phone or a forgotten password can leave the whole business waiting on Microsoft support. With two, the backup fixes it in minutes.
Microsoft’s security defaults page goes further for larger setups. It recommends two cloud-only emergency (“break glass”) accounts, not tied to any one person. For a small office, a second named Global Administrator is usually the practical version of that idea.
How should outside helpers get access?
- Their own account in your organization with the smallest role they need. You can remove it in one step.
- A partner relationship. Microsoft says authorized partners can be added as delegated administrators. The partner sends you an invitation by email, and you accept it in the admin center.
- Never the owner’s login. A shared login can’t have its own two-step sign-in, and you can’t tell who did what.
Why does it matter?
An admin account is the master key to your email, files and billing. If an attacker gets one, they can read everything and lock you out. If the only admin leaves on bad terms, you may not be able to add staff, reset passwords or pay the bill. Both are avoidable with two named admins.
What are the common mistakes?
- Everyone is a Global Administrator because it was easier at setup.
- The only Global Administrator is a former employee or an IT company you no longer use.
- Admins doing daily email on their admin account. Microsoft suggests separate accounts for admin work and everyday work, so admins see fewer prompts and attackers have fewer chances.
- No two-step sign-in on admin accounts. Microsoft has required it for admin center sign-in since 2025. See security defaults and two-step sign-in.
- Forgetting to remove roles from leavers. See offboarding an employee.
What if nobody can get in as an admin?
- If any Global Administrator or Privileged Authentication Administrator can still sign in, they can reset the others.
- If none can, contact Microsoft support. You’ll be asked to prove you control the business and its domain, which is much easier if the domain is registered in the business’s name.
- Don’t create a new Microsoft 365 account to get around it. It splits your email and files across two accounts and makes the domain harder to move.
How much does it cost, and how long does it take?
Admin roles are free. Reviewing who has which role takes about ten minutes.
How does E-3 handle this?
Accounts E-3 sets up are created in the client’s name, with E-3 added as a user. The business keeps the top-level access, and our access can be removed whenever you choose. Domains we manage are registered to the client too.
Related questions
Next step
- Microsoft 365 for small business: the complete guideEvery guide in this topic, in order.
- Free website checkPublic checks on your own site, then an action plan of what to fix first.
Still stuck? Ask E-3 for an answer from our help guides.
Rather we handled microsoft 365 for small business for you?
It’s part of what we do every week for small businesses, as part of managed wordpress hosting. Start with a free check of your site and profile, or call and ask.