Read time: 8 minutes
Organizations prefer to create multiple admin accounts in Microsoft 365 to delegate roles and improve the workflow. Having multiple accounts also helps during account lockout, providing an easy way for account recovery. Assigning the correct admin role to the correct user helps secure the tenant and prevent unauthorized access.
Global Admins can assign admin roles to any user in Office 365. The easiest way to create an admin account is by using the Microsoft 365 Admin Center or by the Microsoft Entra Admin Center using global credentials. Now, let’s understand the different types of admin roles available in Microsoft.
What are the Different Admin Roles in Office 365?
Apart from the Global Admin role, there are a lot of different admin roles in Microsoft 365 for specific tasks. Knowing about the different kinds of roles will help you understand which role should be assigned to which user.
| Administrator roles | Who should be assigned this role? |
|---|---|
| Global Administrator |
This is the most privileged role in Microsoft 365. Global admins have full access to all the Microsoft Entra ID services. Some key functions are:
This role is automatically assigned to the account that purchases the Microsoft 365 subscription. There can be more than one Global Admins. |
| Billing Administrator |
Manages the subscriptions, purchases, and service requests. Billing admins have the following core functions:
|
| Exchange Administrator |
Manages and secures user mailboxes, Microsoft 365 groups, and Exchange Online services. Some aspects managed by an Exchange Administrator are:
|
| SharePoint Administrator |
Manages the operations and upkeep of a company’s SharePoint environment. Main functions of a SharePoint admin are:
|
| Teams Administrator |
Manages the overall functions of a Microsoft Teams tenant of an organization. Core functions of these admins include:
|
| User Administrator |
Manages everything related to access controls and provisioning/deprovisioning of user accounts. Functions of user administrator are:
|
Why do Organizations Create Multiple Admin Accounts?
Microsoft recommends creating multiple admin accounts for different tasks for improved workflow and security. Here’s why each organization should consider creating different admin accounts:
- Avoid lockout: Every organization must have at least two Global Admin accounts. When one Global Admin account becomes unavailable or disabled, the second Global Admin account is able to unlock the account easily.
- Prevent unauthorized access: Having a separate admin account for sensitive tasks helps to prevent unauthorized access and data breaches. This also helps to minimize the risk of data breach in case of a ransomware or phishing attack.
- Implementing principle of least privilege: Not every user in an organization should have access to the admin privileges. Also, not every admin should have the same access as privileged admins for management tasks.
- “Break glass” admin accounts: Every organization must have a “break glass” account for emergencies when they can’t access their data. These admin accounts are highly privileged that bypass all the security and controls like MFA in critical situations like system outages, Admin lockouts, cyberattacks, etc.
Pre-Requisites for Creating an Admin Account in Office 365
Admins must prepare beforehand to make sure they don’t encounter any difficulties while creating Microsoft admin accounts. Some pre-requisites include:
- Have the credentials of an active Global Admin account to create and assign roles to the new admin account.
- Have an active Microsoft 365 License (Business standard/premium or Enterprise).
- Enable MFA for added protection to prevent any unauthorized access.
How to Create Office 365 Admin Account?
There are a few methods available to create a new admin account in Office 365. All of these methods involve creating methods with the help of a Global Admin account, so make sure you have one.
1. Create Microsoft Admin Account using Admin Center
The easiest way to create admin account in Office 365 is via the Microsoft 365 Admin Center. Follow the steps below to create a new admin account using the Global Admin credentials:
- Visit https://login.microsoftonline.com/ and sign in with your existing Global admin account.
Note: This global admin account can also be used for all activities in Office 365, but we recommend you create a new admin account. - Now, go to the Admin center, and in the Office 365 menu, click Users > Active Users.
- In the Active Users Dashboard, click the “+” icon to create a new user.
- The Create new user account wizard will appear on the screen. Provide the user details in the given field and click Create.
- Once the new user account is created, close the dialog box.
- Now, go back to the Active Users section and select the account that you just created.
- The summary of the account will display on the right side, click Edit user roles in that section.
- Here, you will see the roles that can be assigned to the new user, select Global Administrator, and click Save.
Note: In the Alternative email address box, provide an email address that can be used in case of a password loss.
That way, you will be able to create a new admin account in Office 365.
2. Using PowerShell to Create Office 365 Admin Account
A new Microsoft admin account can be created by running some simple commands in PowerShell. Here are the steps for this process:
- Launch PowerShell as an Administrator.
- Connect with Office 365 with the help of Global Admin credentials.
- Run this command in PowerShell to create a new admin account:
New-MsolUser -UserPrincipalName newadmin@yourdomain.com `
-DisplayName “New Admin User” `
-FirstName New `
-LastName Admin `
-UsageLocation US `
-LicenseAssignment yourtenant:ENTERPRISEPACK
- Once the account is created, run the given command to assign the admin role to the newly created user.
- Now, run the command given below to verify that the newly created account has admin privileges.
3. Create Office 365 Admin Account with Microsoft Entra ID
Global Admins can also create Microsoft admin account through Azure AD (Microsoft Entra ID). The steps for this process are given below:
- Sign into Microsoft Entra Admin Center with the Global Admin account.
- Choose Identity from the left pane and then click on Users > All users.
- Click on the New users > Create users option and enter the required details.
- In the Assignment tab, assign Admin role to the user by clicking on +Add role option.
- Review all the details and then click on Create.
How to Add an Outside Person as Office 365 Admin?
If you want to add someone as an admin who does not belong to your organization, then you need to follow the below steps:
- Go to Office 365 admin center, Select User in the menu tab, and then click Add a User.
- Enter the details for the new user and your company’s domain name.
Note: The user name and domain name together make up the email address and sign-in address for the user. - Now, provide the contact information of the user.
- Click Auto-generate password for automatically creating a password by Office 365, and then check the checkbox Make this user change their password when they first sign in.
- Select Global Administrator under Roles.
- In the Alternative email address field, provide a different email address that can be used in case of password loss.
- Under the Product licenses, select Create user without product license, and then click Add.
- Make sure Send password in email is selected and add your email address and the new user’s email address, and then click Send email and close.
That way, you can assign the admin role to an outside user. However, it is not recommended to assign the admin role to someone outside your organization.
Conclusion
Creating an admin is not that much complicated if you have the Global administrator account, the account that you used to purchase the Office 365 subscription. We’ve given three approaches by which you can create an admin account. Apart from that, we’ve also talked about the process of assigning the Office 365 account admin role to an outside user using Office 365 Admin Center. Now that you’ve created a new admin account, how to migrate your existing data and permissions in the said account? Experts suggest using a dedicated Office 365 migration software to safely migrate all your data to the new admin account.
Frequently Asked Questions
A. You can create admin account in Office 365 via the Microsoft Entra admin center if you can’t access the Microsoft 365 Admin Center.
A. You need to have a Global Admin account to create admin account in Office 365. Depending upon roles and permissions of your organization, users may also have the permission to create admin accounts.
A. Global Admins can create Microsoft 365 Admin accounts by Microsoft 365 Admin Center, Microsoft Entra Admin Center, or by using PowerShell.
A. Yes you can. Admins can easily manage access, identity, governance policies, and security-based risks directly through Microsoft Entra Admin center.
