Why roles come before everything else
In Level 1 you saw what users see in Teams and what runs behind it. Before you touch any of it, you need to know which key opens which door. In Microsoft 365, admin roles are those keys, and support work runs on a simple rule: use the smallest key that opens the door the ticket needs. Microsoft's own guidance says the same thing. Use the roles with the fewest permissions, and keep Global Administrator for emergencies only.
Why does this matter on a help desk? Every extra permission you hold is something you can break by accident and something an attacker can use if your account is phished. It also makes an auditor ask why you had it. A first-line analyst with Teams Administrator can change the org-wide external access settings while trying to fix one guest's sign-in. A Support Specialist can't, because that button never appears for them.
Checked against Microsoft Learn in November 2026. Role names and what they can do change, so check them again before you rely on them.
The six keys on your ring
Admin roles are assigned in Microsoft Entra ID. The team owner is different: it's a role inside one team, not a tenant role.
Role (Entra name) What it's for What it can't reach
---------------------------------------- ------------------------------------ ------------------------------------
Teams Communications Support Specialist Basic call troubleshooting for the The rest of the Teams admin centre;
user you search for other participants' names; device/IP detail
Teams Communications Support Engineer Advanced call troubleshooting: The rest of the Teams admin centre;
full call detail, all names it can't change policies
Teams Devices Administrator Teams-certified devices: config, Call quality data and Call Analytics
updates, health, RESTART
Teams Communications Administrator Meetings + calling: policies, Messaging policies, org-wide settings,
conference bridges, phone numbers team management
Teams Administrator The whole Teams service and (Almost nothing in Teams; that's the
Microsoft 365 Groups point: it's a big key)
Team owner (per team, not Entra) Members, owners, channels and Anything outside that one team
settings of their own team
Two neighbours are worth knowing because they come up in requests. Teams Telephony Administrator covers voice only: calling policies, phone numbers, voice apps and PSTN usage reports. For a purely calling job it's narrower than Communications Administrator. Teams Reader can see the admin centre read-only but cannot open a user's Meetings & Calls details, so it's no good for call tickets.
Gotcha: The Teams documentation calls it "Teams Device Administrator". In Entra the role is listed as Teams Devices Administrator, with an s. Search for both when you request it.
Worked example 1: "My calls keep dropping", so read the call history
The smallest role for this is Teams Communications Support Specialist. It opens a user's profile and their calls and meetings without exposing the rest of the admin centre.
Teams admin centre (admin.teams.microsoft.com)
-> Users -> Manage users # only the users you're allowed to see appear
-> select the user # e.g. priya.shah@contoso.com
-> Meetings & calls tab # In-progress and Completed meetings lists
-> open a call # read-only; nothing here changes the user
The Support Specialist and the Support Engineer see that call differently. Microsoft's Call Analytics documentation (updated July 2026) sets it out:
Same call, two views
Support SPECIALIST (Tier 1) Support ENGINEER (Tier 2)
Caller name Only the user you searched for User name
Other participants "Internal User" / "External All names shown
User"
Phone numbers Last 4 digits masked Last 4 digits masked (same for all roles)
Advanced detail Not shown Device names, IP address, subnet mapping
(devices, IP, Wi-Fi) DNS suffix, SSID
So the Specialist can confirm that Priya's calls failed and when. The Engineer can see why, for example that she was on hotel Wi-Fi behind a particular subnet. Microsoft describes the Specialist as collecting the facts and escalating to the Engineer.
Unconfirmed: Microsoft has replaced the older Call Analytics view with a newer meeting troubleshooting experience that has Meeting and Participant views and no Advanced/Debug tabs. The newer page doesn't give a specialist-versus-engineer table. Test what each role sees in your own tenant before you promise it to anyone.
Worked example 2: "The Teams Room in Board Room 2 is frozen"
The smallest role here is Teams Devices Administrator. It can review device health, see the status of connected peripherals, apply configuration profiles and restart devices. What it can't do is open Call Analytics or call quality data. If the room also has bad audio on calls, that part of the ticket goes to someone holding a communications support role.
Worked example 3: "Change Tom's calling policy so he can forward to mobiles"
This is a change, not a read, so neither support role can do it. Teams Communications Administrator manages calling and meeting policies. Teams Telephony Administrator is narrower if your firm uses it for voice-only staff. You don't need Teams Administrator. How policies are assigned and which one wins comes in Level 5. For now, just note who holds the key.
Worked example 4: "Add the new starter to the Finance team"
Usually the smallest "role" is no admin role at all. The team's owner adds members, promotes owners and manages channels from the team's Manage team screen. Send the request to the owner. Use an admin role only when the team has no owner or the owner is unavailable. Teams Administrator can then manage membership under Teams -> Manage teams in the admin centre.
Checking who holds what (read-only)
Before you ask for a role, check whether you or a colleague already has it:
# Read-only: sign in with a scope that can only read role data
Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
# Find the role definition by its Entra display name
$role = Get-MgRoleManagementDirectoryRoleDefinition -Filter "displayName eq 'Teams Communications Support Specialist'"
# List who is assigned it (PrincipalId = the user or group object ID)
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '$($role.Id)'" |
Select-Object PrincipalId, DirectoryScopeId # "/" means tenant-wide scope
Spotting over-asks, and writing the reply
Tickets and colleagues will often ask for more access than the job needs. Here's a typical request and a short refusal you can reuse:
REQUEST: "Please give me Teams Administrator so I can check why Priya's calls drop."
REPLY: Declined as asked. Reading one user's call history needs
Teams Communications Support Specialist, which shows her calls but
can't change any settings. If we need IP/device detail, Support
Engineer covers that. Teams Administrator would also allow
org-wide changes this ticket doesn't need.
A good justification says three things: the task, the smallest role that does it, and why the bigger role is unnecessary.
Key takeaways
- Pick the smallest key for the job. Microsoft recommends least privilege and keeping Global Administrator for emergencies.
- Reading a user's calls: Support Specialist. Full call detail (all names, device, IP): Support Engineer. Neither can reach the rest of the admin centre.
- Restarting a room device: Teams Devices Administrator. It has no access to call quality data.
- Changing a calling or meeting policy: Teams Communications Administrator (or Telephony Administrator for voice only).
- Team membership: the team owner first. An admin role is the fallback.
- Teams Reader can't open Meetings & Calls details. Check what each role shows in your own tenant, because the screens change.