How to Manage Microsoft Teams Users without Microsoft Global Admin Credentials
Table of Contents
How to Manage Microsoft Teams Users without Microsoft Global Admin Credentials InstructionsHow to Manage Microsoft Teams Users without Microsoft Global Admin Credentials
Enterprises strongly prefer reserving their Microsoft Global Admin credentials only when necessary. Some certifications (i.e. SOC2) require a very strict control on who has access at the highest level in IT Systems.
Microsoft Global Admin credentials are required to complete the Enterprise Registration and Direct Routing setup and the optional Teams Application setup. However, delegated Microsoft credentials can be used for all day-to-day tasks, such as adding, managing, and deleting Users.
The Microsoft User with this delegated authority must have Teams Service Admin and Skype Admin rights.
In some Microsoft Enterprises, delegation is a conditional setting that needs to be configured in Azure Active Directory. The Global Admin grants conditional consent to a delegated admin to perform a certain task. Yes, it is time-consuming and a pain, but it is also a good security measure.
Here is a table of the capabilities of each level of Microsoft credential:
| Microsoft Global Admin | Microsoft Teams Service Admin & Skype Admin (both) | |
| Initial Enterprise Reg. | YES | NO |
| Setup Direct Routing | YES | NO |
| Setup/Manage PBX | YES | YES |
| Setup/Manage TM Users | YES | YES |
| Add/Delete Teams App | YES | NO |
| Setup/Manage End User Portal | YES | YES |
| Setup/Manage Feature Codes | YES | YES |
Instructions
- Navigate to Microsoft Admin Center >>Active Users
- Select a User (not the Global Admin) and then select Manage Roles
- Select Admin center access as seen in the picture below
- Select Teams Service admin
- Select Skype for Business admin (you must select Show all by category dropdown to see this option), then select Save changes.
Once changes are saved, the Microsoft User with these credentials can add and Manage Users. The Microsoft User will look like this in the Roles assignment:
