manage roles in Microsoft 365 admin center

Managing roles within Microsoft 365 Admin Center is a crucial aspect of handling a company’s cloud-based solutions. This article discusses how to manage these roles and how it applies to the MS-100 Microsoft 365 Identity and Services Exam.

I. Understanding Microsoft 365 Roles

In the Microsoft 365 admin center, roles are authorization levels assigned to users to grant the necessary permissions to perform specific tasks. Each role has a unique set of capabilities designed to allow users to perform specific tasks within the admin center. Some of the primary roles, including Global Administrator, Billing Administrator, Exchange Administrator, Password Administrator, and Service Administrator.

II. Managing Roles in Microsoft 365 Admin Center

Managing roles involves assigning, changing, or removing roles from users. Here’s how:

1. Assigning Roles

To assign a role to a user, navigate to Users > Active users in the admin center. From the list, choose a user, and then in the pane on the right, choose Roles. Pick the role/s that you want to assign and then click Save changes.

2. Changing Roles

To change a role, follow the steps as if you are assigning a role, but choose a different role for the user. Save the changes.

3. Removing Roles

To remove a role from a user, in Roles panel, clear the check box for the role, and then click Save changes.

III. Role Assignment Examples

It’s important to assign roles relevant to an employee’s task. For instance, if an employee is tasked with accounts management, you might want to assign them the ‘Billing Administrator’ role. This role allows them to make purchases, manage subscriptions, manage service requests, and monitor overall service health.

IV. Custom Roles in Azure AD

In addition to the predefined roles, Azure Active Directory (Azure AD) allows you to create custom roles for more flexible access management. You can create a unique combination of privileges that are not available in any existing roles.

For example, you can create a custom administrator role with the ability to read all directory information but only write certain user information.

V. Role Management and MS-100 Exam

In the MS-100 Microsoft 365 Identity and Services Exam, understanding how to manage roles in Microsoft 365 Admin Center is relevant. Microsoft’s exam focuses on the design and implementation of Microsoft 365 services, including user identity and roles.

VI. Conclusion

Proper management of roles in Microsoft 365 is essential to tailor the access controls to your organization’s needs. Custom roles can add more granularity to these access levels and ensure the right level of authorization for relevant tasks. Future administrators should master this concept for managing Microsoft 365 services and succeeding in the MS-100 Exam.

Practice Test

In Microsoft 365 Admin center, you can assign Administrator role to any user.

• a) True
• b) False

Answer: a) True

Explanation: In Microsoft 365 Admin center, you can assign the Administrator role to any user. The individual will have access to the admin center and can make changes based on the permissions of their role.

You can add roles to a user in Microsoft 365 admin center without having administrator permissions.

• a) True
• b) False

Answer: b) False

Explanation: You need to have administrator permissions to add roles to a user in Microsoft 365 admin center.

Microsoft 365 admin center allows managing roles for individual users and groups.

• a) True
• b) False

Answer: a) True

Explanation: Microsoft 365 admin center provides the functionality to manage roles not only for individual users but also for groups.

Microsoft 365 admin center supports role-based access control (RBAC).

• a) True
• b) False

Answer: a) True

Explanation: Microsoft 365 admin center supports role-based access control (RBAC), which helps to limit access to certain resources in Microsoft 365 based on the role of the user.

With the Microsoft 365 admin center, you cannot assign custom roles to a user.

• a) True
• b) False

Answer: b) False

Explanation: With the Microsoft 365 Admin center, you can create and assign custom roles to users based on their responsibilities and tasks.

The ‘Global Admin’ is the highest-level administrator role in Microsoft 365 admin center and has access to all administrative features.

• a) True
• b) False

Answer: a) True

Explanation: The ‘Global Admin’ is indeed the highest-level administrator role in the Microsoft 365 admin center, providing access to all aspects of the admin center.

You can assign a role to a user at the time of their account creation in Microsoft 365 admin center.

• a) True
• b) False

Answer: a) True

Explanation: While creating an account for a user, you have an option to assign a role to that user.

Multiple roles can be assigned to a user in Microsoft 365 admin center.

• a) True
• b) False

Answer: a) True

Explanation: Users can have more than one role in the Microsoft 365 admin center. They can perform tasks based on the permissions of their assigned roles.

It is not possible to remove the administrator role from a user in Microsoft 365 Admin center.

• a) True
• b) False

Answer: b) False

Explanation: It is possible to remove the administrator role from a user. You need to go to the active user’s section, select the user, and then remove the admin role from the user’s account.

A role group in Microsoft 365 admin center is a group of privileges.

• a) True
• b) False

Answer: a) True

Explanation: In Microsoft 365 admin center, a role group is indeed a group of privileges. It’s a way of assigning roles to multiple users at once.

Which of these is not a predefined role in Microsoft 365 admin center?

• a) Billing Administrator
• b) Services Administrator
• c) Security Administrator
• d) Content Administrator

Answer: d) Content Administrator

Explanation: Content Administrator is not a predefined role in Microsoft 365 admin center. Predefined roles include Billing, Services, and Security administrators.

Users assigned with Compliance Management role can manage Exchange Online and SharePoint Online compliance features in Microsoft 365 admin center.

• a) True
• b) False

Answer: a) True

Explanation: Users assigned with the Compliance Management role can manage compliance features in Exchange Online and SharePoint Online through Microsoft 365 admin center.

It is possible to restore a deleted role in Microsoft 365 admin center within 30 days of deletion.

• a) True
• b) False

Answer: b) False

Explanation: It is not possible to restore a deleted role. Once a role is deleted, it’s final and cannot be undone.

The ‘Password Administrator’ role in Microsoft 365 admin center can reset passwords, manage service requests, and monitor service health.

• a) True
• b) False

Answer: a) True

Explanation: The ‘Password Administrator’ indeed has the rights to reset passwords, manage service requests, and monitor the health of services.

Microsoft 365 admin center allows temporarily assigning admin roles assigned to a user, where the role automatically gets removed after a specific duration.

• a) True
• b) False

Answer: a) True

Explanation: Microsoft 365 admin center has a feature of ‘Privileged Identity Management’ that allows temporary assignment of admin roles which can be configured to be automatically removed after a specific duration.

Interview Questions

What is Microsoft 365 Conditional Access?

Conditional Access in Microsoft 365 is a feature which allows organizations to enforce policies on devices and apps that connect to their Microsoft 365 applications based on certain conditions.

What are the two components of a Conditional Access policy?

The two components of a Conditional Access policy are: Conditions, which set the scenarios for when the policy should be applied, and Access Controls, which set the actions to be taken if the conditions are met.

Name two examples of conditions that can be applied in Conditional Access policy.

Two examples of conditions are: User or group membership and IP location information.

What are some of the options available for Access Controls in Conditional Access policies?

Some options for Access Controls in Conditional Access policies are: Block access, Grant access, Require device to be marked as compliant, Require password change, and Require Multi-Factor Authentication.

What do Conditional Access policies help protect against?

Conditional Access policies can help protect against potential threats such as unauthorised access to data, data breaches, and attacks on systems.

In Microsoft 365, what is one of the key uses of implementing Conditional Access policies?

One of the key uses of implementing Conditional Access policies in Microsoft 365 is to ensure that only authenticated and authorised users have access to the organization’s resources.

What is the role of the “Sign-in risk” condition in Conditional Access?

The “Sign-in risk” condition in Conditional Access determines the risk level of a sign-in attempt and can trigger different Conditional Access policies based on that determined level of risk.

What are named locations in Microsoft 365 Conditional Access?

Named locations in Microsoft 365 Conditional Access are specific IP address ranges that an organization trusts and has defined.

What is the ‘Report-only mode’ in Microsoft 365 Conditional Access?

The ‘Report-only mode’ allows you to evaluate the impact of your Conditional Access policies before enabling them in your environment. It provides insights on how the policy would have been applied to users over the past seven days.

What does ‘Require MFA for admins’ Conditional Access policy mean?

‘Require MFA for admins’ Conditional Access policy means that any user account with administrative privileges must perform Multi-Factor Authentication before they can access the system.

Can Conditional Access policies be integrated with other services in Microsoft 365?

Yes, Conditional Access policies can be integrated with other services in Microsoft 365 such as Microsoft Cloud App Security, Azure AD Identity Protection, and others.

Is it possible to create multiple Conditional Access policies in Microsoft 365?

Yes, it is possible to create multiple Conditional Access policies and to prioritize them in Microsoft 365 according to their importance.

What does ‘Grant access’ access control do in Microsoft 365 Conditional Access?

The ‘Grant access’ control in Microsoft 365 Conditional Access allows the user access to a resource, given they satisfy some other conditions defined in the policy.

Can Conditional Access policies apply to all users in an organization?

Yes, Conditional Access policies can be applied to all users, specific users, or groups within an organization.

Can you exempt some users or groups from a Conditional Access policy?

Yes, you can exempt certain users or groups from a Conditional Access policy in Microsoft 365.