Secure Score Admin roles

[Dean_Gross]

The FAQ at https://support.office.com/en-us/article/Introducing-the-Office-365-Secure-Score-c9e7160f-2c34-4bd0-... states that "custom admin roles" can access the Secure Score site.  Does anyone know what this means? does it mean "service admins"?

To the best of my knowledge we cannot create custom admin roles. Am I unaware of another new unnannounced feature?

[#2]

I believe Custom Admin Roles in this context is referring to an admin role that is something other than Global Admin (e.g. Exchange Online Admin, SharePoint Online Admin, etc.).

[#3]

In Office 365 are three option. User, Global administrator or Customized administrator, which provides list of different admin roles available to manage services within Office 365. I believe that the reference in the document is to the Customized administrator option in the Office 365 admin center user management. However not all the Customized administrator roles have access to the Secure Score.

[#4]

I read the same article and assumed that Custom Administrator / Reports Reader would give the access.  My user is telling me it's not working.  Is there a definitive list of which Custom Administrators should get access?  Here's the possibilities:

• Billing administrator
• Dynamics 365 service administrator
• Customer Lockbox access approver
• Exchange administrator
• Password administrator
• License administrator
• Skype for Business administrator
• Message Center reader
• Power BI service administrator
• Reports reader
• Service administrator
• SharePoint administrator
• User management administrator

[#5]

Hi Tony,

The user needs to be a workload (Exchange, SharePoint, etc) admin or have a security role.  You might want to grant the user Security Reader rights via Azure AD to see if that meets their needs.

The other option is to leverage the Secure Score API and build out a dashboard in Power BI or another tool to show them just the data they need.  There are some YouTube videos here and here that might help with this.

[#6]

Can you elaborate specifically on which of the above-mentioned are "workload" besides Exchange and SharePoint?

[#7 · Accepted solution]

Hi Tony,

The roles are:

• Exchange Administrator
• Global Administrator
• Security Administrator
• Security Reader
• SharePoint Administrator
• Skype for Business Administrator

We are looking to add the Teams Administrator to the list in the future

[#8]

Perfect.

For the record, the option of "...grant the user Security Reader rights via Azure AD..." also worked.

[#9]

Is everything in the tool available for users with that roles granted?
Or do you need any kind of specific lincense for extra functions?