Who is a Global Administrator in Microsoft 365?

A Global Administrator (sometimes called Global Admin) is a user with highest level of administrative privilege within a Microsoft 365 tenant. This role grants full access to all management features and services in the tenant, making it the most powerful and critical role in the organization.

Key Responsibilities of a Global Administrator

1. Tenant-Wide Access: :
   A Global Admin can manage all aspects of the tenant, including users, groups, licenses, billing, and security settings.
2. Role Management:
   
   • Assign and remove admin roles for other users.
   • Delegate limited roles like Exchange Administrator or Teams Administrator.
3. Service Configuration: :
• Manage Microsoft 365 services such as Teams, SharePoint, and OneDrive.
• Set global policies for compliance, security, and collaboration.
4. Emergency Recovery: :
• Reset passwords for other administrators.
• Restore deleted users or resources.

Who Should Be a Global Administrator?

Because of its extensive permissions, this role should only be assigned to:

• Trusted individuals, such as IT administrators or executives.
• A limited number of users to minimize security risks.

Best Practices for Global Admins

• Use Multi-Factor Authentication (MFA): Secure accounts to protect against unauthorized access.
• Role-Based Access Control (RBAC): Assign other admin roles (e.g., Billing Administrator) for specific tasks instead of giving Global Admin access.
• Emergency Access Accounts: Create at least one backup Global Admin account for emergencies.

The Global Administrator role is the cornerstone of tenant management, combining power with responsibility. Handle with care!

How to Assign Global Administrator Role?

Using Microsoft 365 Admin Center

• Select Users > Active users > Select User >> Go to Manage Roles (under Roles section) >> select Admin center access >> check Global Administrator and save changes.

Using Graph PowerShell

$DirObject = @{
    "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/a9b3f67a-de74-42f3-8ae1-9a43ab10817b"
}
New-MgDirectoryRoleMemberByRef -DirectoryRoleId '232142d7-3931-4598-b199-75199c53beb7' -BodyParameter $DirObject

Note: You can get the role id using the following command:

get-mgdirectoryrole | select id, displayname