That person can assign admin permissions to other people to help them manage Microsoft 365 for their organization. Often they give admin permissions to their IT consultant who does all the computer maintenance work for their business.īy default, the person who signs up for and buys a Microsoft 365 for business subscription gets admin permissions. Small businesses: Contact the business owner / co-owner. Large businesses: Contact your internal help desk / technical support. Try asking your teacher or school administrators for where you should go to get technical help. At universities or colleges, usually you can find a link on your university site.Īt other schools, there may be just a couple technical people who have admin permissions. Universities and schools: Contact your technical support team. Looking to do some more reading on Office 365?Ĭatch up on my past articles here: Joe Palarchio.When looking for your Microsoft 365 admin to contact an agent on your behalf, reset your password, delete an account, or do other tasks, here's who you should contact: Leave a comment below or follow me on Twitter ( for additional posts and information on Office 365. Azure AD has such functionality available in preview, check out “ Azure AD Privileged Identity Management” for more information. Hopefully this will change in the future, in the meantime, protect it as much as possible with a secure password.Īs my colleague Allan Bourne pointed out, “Just In Time Access” is quite possibly the future replacement for maintaining a secondary admin account. Unfortunately, Remote PowerShell doesn’t currently work with MFA and if you’re using your admin account, you’re probably using PowerShell at least half the time. Since you’re likely logging into the Office 365 portal daily with your “user” account (to access email, OneDrive for Business, SharePoint Online), it can be beneficial to be able to see the service health or other important alerts such as an expiring AD FS certificate (like below) as part of your daily activity.Īdding your “day-to-day” user account to the “Service Administrators” role provides the benefit of increased awareness with minimal additional elevated privileges to be concerned about.Īs for your “Global Administrator” account, I would love to say that we should enable multi-factor authentication (MFA) for this account. Additionally, I have seen Microsoft send notifications to the “Service Administrator” role such as the notification discussed in this post: “ Microsoft’s Proactive Notification of User Issues“. What you do get with the “Service Administrator” role is the ability to view the current health of your tenant via the dashboard. It can basically view user information and open support tickets. When you look at the permissions the “Service Administrator” has, it’s not much. By definition, this role can “manage service requests and monitor service health”. One role that I rarely see used is the “Service Administrator” role. A “Global Admin” account, if compromised, could certainly do some dastardly things. In the Office 365 realm, this role has more privileges than a “Domain Admin” would typically have in the on-premises environment. Despite this, I still see many administrators with their “user” account assigned the “Global Administrator” role. One that is difficult to argue against is that administrators should maintain an account with elevated access that is separate from their day-to-day user account (see note at the bottom for a possible argument against this “difficult to argue” point).įor Office 365, there are a number of roles available with varied level of elevated access. When it comes to security “best practices” there are some that are debatable and others that are fairly well accepted.
#MICROSOFT 365 ADMIN HOW TO#
Discover how to empower innovation from non-traditional developers with the Microsoft Power Platform. Unleash the Potential of Power Platform With a Center of Excellenceīusiness innovation often comes from within.
0 kommentar(er)
