Microsoft Office 365 Administrators are often easily confused when they do an administrative task is PowerShell that involves retrieving, or changing the RBAC administrative roles for users in the tenant. The Administrative Role names used in the Office 365 Portal do not always match the equivalent role used in PowerShell. The reason for this is that PowerShell uses the underlying Azure AD RBAC Administrative Role name, whereas the Office 365 Admin Portal has it’s own Administrative Role display name. Most of the time they are the same, but a few role names are different.
This post shows the Administrator Roles used in both the Office 365 Admin Portal, and Azure AD, and the equivalent roles where the names differ.
The Office 365 Admin Portal
There are 11 default Administrator Roles in an E3 / E5 Office 365 Portal – one Global Administrator and 10 Customized Administrator Roles as shown here:
Note: you can assign multiple Administrator Roles to a user.
Azure AD PowerShell
In the Azure AD V1 PowerShell module (MSOnline), Azure AD has 38 Administrator Roles available as shown here:
Equivalent Azure AD Administrator Roles for Office 365 Portal Administrator Roles
You can see that some of the Office 365 Administrator Role names differ. The equivalent Azure AD Administrator Role names are listed below with any differences highlighted in red.
|
Office 365 Admin Role |
Equivalent Azure AD Admin Role |
|
Global administrator |
Company Administrator |
|
Billing administrator |
Billing Administrator |
|
Dynamics 365 service administrator |
CRM Service Administrator |
|
Exchange administrator |
Exchange Service Administrator |
|
Password administrator |
Helpdesk Administrator |
|
Skype for Business administrator |
Lync Service Administrator |
|
PowerBI service administrator |
Power BI Service Administrator |
|
Reports reader |
Reports Reader |
|
Service administrator |
Service Support Administrator |
|
SharePoint administrator |
SharePoint Service Administrator |
|
User management administrator |
User Account Administrator |
Hi, thank you for posting this. I am trying to discover the exact permissions granted by these roles. Would you please post or reply with the PowerShell command to display all the built-in roles, and if you know how to display the permissions granted, that would be extremely helpful. Will link to your post in what I am writing. Thanks again.