Track Users with Admin Roles in Your Microsoft 365 Tenant

In every Microsoft 365 environment, certain users are assigned administrator roles to perform high-privilege tasks such as managing users, resetting passwords, assigning licenses, and securing the organization. These users might hold roles like Global Administrator, Exchange Administrator, or SharePoint Administrator, among others.

Given the power and access these accounts hold, tracking who your administrators are—and monitoring their licensing and account status—is absolutely critical for security, compliance, and operational clarity.

Why Track Users with Microsoft 365 Administrator Roles?

Here’s why tracking admin role holders should be part of your regular Microsoft 365 health checks:

• 🔐 Security: Admin accounts are frequent targets for phishing and brute-force attacks.
• 🎯 Least Privilege Principle: Ensures users don’t retain roles they no longer need.
• 📉 Cost Management: Unlicensed or disabled admins can bloat your environment and increase overhead.
• 🛡️ Compliance: Knowing who has access to what helps meet regulatory standards.

To help with this, we’ve put together four simple yet powerful PowerShell-based reports. Each one uses Microsoft Graph to provide clear visibility into different aspects of admin role usage.

• How to List All Microsoft 365 Administrators?

This report shows all users assigned to any Microsoft 365 admin role—not just Global Admins. It queries role definitions and maps them to user assignments, providing a complete view of delegated privileges in your tenant.

👉 View script to list all Microsoft 365 administrators

• How to List All Microsoft 365 Global Administrators?

Global Admins have unrestricted access across your tenant. This report pinpoints all users with the Global Administrator role and also provides their license status—helping ensure these critical accounts are properly managed and secured.

👉 View script to list Global Admins with license status

• How to List All Unlicensed Microsoft 365 Administrators (if any)?

An admin user without a valid license might indicate a misconfiguration or potential oversight. This script finds all Microsoft 365 administrators who do not currently hold any licenses, enabling timely correction.

👉 View script to find unlicensed Microsoft 365 admins

• How to List All Disabled Microsoft 365 Administrators (if any)?

This report helps uncover any disabled accounts that still retain administrative roles. Such accounts are a hidden risk if they aren’t properly offboarded or removed from role assignments.

👉 View script to find disabled admin users in Microsoft 365

Final Thoughts

By regularly reviewing who has administrative privileges—and whether those accounts are active, licensed, or even necessary—you can dramatically reduce security risks in your Microsoft 365 tenant.

These ready-to-use PowerShell scripts from M365Corner make it easy to track, audit, and manage your admin users with confidence.

Use these reports as part of your monthly admin review or automation cycle to keep your tenant clean, secure, and well-governed.