Forum Discussion
Best Practices O365 Admin Roles
Hi,
very intersting topic and replies.
WE are a tenant of 100 users and we have 3 global admins, with separate admin accounts.
Things work pretty much fine (including MFA), we have an issue though with 2 things:
1) Granularity of admin roles managed in Office 365 vs managed in Azure AD, there seem to be some little tiny differences that can prevent admin to their job.
2) Licenses: in principle an Admin needs no license, but ther are some actions that you can't perform with an adequate license (in Exchange Online or Intune).
We can sort point 1, but I am quite upset with point 2.
I recently attended an Ask The Expert session, during which the the MSFT guru suggested the elevation of "normal users" to "admin role" based on specifc time frame or on demand, but i could not find any hint in this sense.
If you have any, and want to share, feel free!
Nicola
Guarino Nicola wrote:
I recently attended an Ask The Expert session, during which the the MSFT guru suggested the elevation of "normal users" to "admin role" based on specifc time frame or on demand, but i could not find any hint in this sense.
Sounds like they were referring to the feature called Privileged Identity Management, which can temporarily elevant permissions based on specific conditions and approvals.
Is this what you are referring to?
https://docs.microsoft.com/en-us/azure/active-directory/active-directory-privileged-identity-management-configure
That's the one, and is even better now compared to 3 months ago :)
