Assign Admin Roles to users in Microsoft 365

Assigning admin roles in Microsoft 365 lets you control what users can see and manage without giving them full access to everything. In this article, you will learn how to assign admin roles to users in the Microsoft 365 Admin Center and using Powershell.

Important (Before you Begin)

1. Avoid assigning Global Administrator unless absolutely necessary.
2. Follow the principle of least privilege. Always assign the most narrow role that allows the user to complete their specific tasks.
3. Role changes propagate quickly but may require the user to sign out/in.
4. For a description of the built in roles refer to Microsoft Entra built-in roles

Assign Role with 365 Admin Center

1. Log into the Microsoft 365 Admin Center

2. Go to Roles > Role assignments

   

3. Choose the administrator role you want to give to the user. In this example im assigning a user to the Billing Administrator role.

   

4. Go to the Assigned tab then select Add users

   

5. Search for the user then select add to assign the role.

   

Assign Role with PowerShell

1. Install graph module if you don’t already have it installed.

      Install-Module -Name Microsoft.Graph -Scope CurrentUser

2. Connect to Microsoft graph

      Connect-MgGraph -Scopes User.ReadWrite.All, Directory.AccessAsUser.All

3. Assign the role. Change Billing Administrator to the role you are wanting to assign. Then replace user@domain.com with the user’s email.

      New-MgDirectoryRoleMemberByRef -DirectoryRoleId (Get-MgDirectoryRole | Where DisplayName -eq "Billing Administrator").Id -BodyParameter @{ "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$((Get-MgUser -UserPrincipalName user@domain.com).Id)" }

   

4. To verify the user was added use this command. Replace user@domain.com with the user’s email. If the role you assigned shows up then they were added.

      Get-MgUserMemberOf -UserId user@domain.com |
      Where-Object { $_.AdditionalProperties['@odata.type'] -eq '#microsoft.graph.directoryRole' } |
      ForEach-Object {
       [PSCustomObject]@{
        DisplayName = $_.AdditionalProperties.displayName
    }
   }