Lesson 2: Who Can Do What: The Smallest Role for Each Job

Why roles come before anything else

Picture a building with a master key, a set of floor keys and a key to each office. The master key opens everything, so you lend it out sparingly. Microsoft 365 is built the same way. Global Administrator is the master key. SharePoint Administrator opens the floors (every site and OneDrive), but only once you let yourself in. Site admins and site owners hold office keys for one site each.

Good support practice is simple to say and easy to forget: use the smallest key that opens the door. Microsoft's own guidance says the same thing: use the role with the fewest permissions and keep Global Administrator for emergencies. In practice there's a second reason too. When something goes wrong, a narrow role keeps the damage small, and so does the audit trail you have to explain.

This course is independent of Microsoft. The role names and pages below were checked against Microsoft's documentation on 3 November 2026. Microsoft renames and splits roles regularly, so treat this table as a snapshot you re-check.

The two layers: tenant roles and site roles

There are two kinds of permission, and mixing them up is the most common mistake here.

• Tenant (directory) roles are assigned in the Microsoft 365 admin centre or Microsoft Entra. Examples: Global Administrator, SharePoint Administrator, Global Reader, User Administrator. They control what you can do in the admin centres.
• Site roles live inside a single site: site admin (formerly "site collection administrator"), site owner, member, visitor. They control what you can do in that site's content.

The point to remember: a SharePoint Administrator does not automatically see every site's files. They can give themselves access to any site or OneDrive, and that leaves a trace. Going the other way, a site admin needs no tenant role and cannot open the SharePoint admin centre at all.

Site owner vs site admin vs SharePoint Administrator

On a site connected to a Microsoft 365 group or team, group owners are automatically site admins. A person added directly to the site's Owners group gets Full Control of the site but not the group or team. Expect tickets like "I'm an owner but I can't see the Teams channel". That's usually the cause.

Matching jobs to the smallest role

Gotcha: the leaver's OneDrive. Microsoft's "give another employee access" article lists User Administrator or Microsoft 365 Backup Administrator for the Users-page route (Users > Active users > user > OneDrive > Create link to files). The step that makes someone else a site admin of the OneDrive is written to be done as a SharePoint admin. If your User Administrator account can't finish the job, that's expected. Escalate. Don't ask for Global Admin.

Gotcha: a bigger SharePoint role. Entra now also has a SharePoint Advanced Management Administrator role. It's a superset of SharePoint Administrator. It's bigger, not smaller, so it's never the least-privileged answer for routine support.

Walkthrough: find out what keys you actually hold

Before you take a ticket, check your own role. The GUI route is Microsoft 365 admin centre > Roles > Role assignments, or Entra admin centre > Roles & admins. The read-only PowerShell route is:

# Read-only: list the directory roles assigned to one account
Connect-MgGraph -Scopes "RoleManagement.Read.Directory","User.Read.All"   # read scopes only
$u = Get-MgUser -UserId "helpdesk1@contoso.com"                           # the account to check
Get-MgRoleManagementDirectoryRoleAssignment -Filter "principalId eq '$($u.Id)'" `
    -ExpandProperty roleDefinition |
  Select-Object @{n='Role';e={$_.RoleDefinition.DisplayName}}, DirectoryScopeId

# Example output
# Role                      DirectoryScopeId
# ----                      ----------------
# SharePoint Administrator  /

If your tenant uses Privileged Identity Management, a role you're only eligible for may not show here until you activate it. Role changes that affect access to the SharePoint admin centre take about an hour to apply, so don't retry for five minutes and then escalate.

Next, check who holds the office keys on a site. This is still read-only and needs the SharePoint Online Management Shell plus the SharePoint Administrator role:

Connect-SPOService -Url https://contoso-admin.sharepoint.com      # admin URL for the tenant
$site = "https://contoso.sharepoint.com/sites/Finance"
Get-SPOSite -Identity $site | Select-Object Url, Owner            # primary admin
Get-SPOUser -Site $site -Limit All |
  Where-Object IsSiteAdmin | Select-Object DisplayName, LoginName # every site admin

Write it down, with a date

Roles drift. Keep a short role register in your team wiki and re-check it every quarter:

ROLE REGISTER - checked 2026-11-03 by J. Patel
Job                         Role used            Source page (learn.microsoft.com)   Re-check by
Leaver OneDrive access      SharePoint Admin     remove-former-employee-step-5        2027-02-03
Restore this library        Site owner           support: Restore a shared library    2027-02-03
Read sharing settings       Global Reader        Entra permissions reference          2027-02-03
Restore deleted OneDrive    SharePoint Admin     restore-deleted-onedrive             2027-02-03

The date and the source URL are the useful part. When a console page moves or a role is split, you know exactly which line to check again.

Key takeaways

• Use the smallest role that does the job, and keep Global Administrator for emergencies.
• Tenant roles control the admin centres. Site roles control one site's content. They're separate.
• SharePoint Administrators can grant themselves access to any site or OneDrive, but don't have it by default.
• Site admins have Full Control plus extras, and see items even where inheritance is broken. Group owners become site admins automatically.
• Site owners can roll back a library. Global Reader can read settings but change nothing.
• Check your own roles first, allow about an hour for changes to apply, and keep a dated role register.