Week 1, Day 4 — Admin Roles & Admin Centre Tour

Day 3 review — from users to access control

• Ask: "Yesterday you created six security groups and added all ten Lakeview Logistics users to the right groups. If you wanted to give every Finance user access to a SharePoint site, how many steps does that take now versus how many it would have taken before you created LL-Finance?" — one step (add the group) vs ten steps (add each user individually). Groups are the access control multiplier.
• Ask: "Dev Sharma is the IT Support Specialist. Sarah Chen is the IT Manager. They both work in IT. Should they have identical access to the M365 admin centre?" — no. Dev needs to reset passwords and handle service requests. He should not be able to add licences, change billing, or modify security settings. This is the principle of least privilege — give only the access the role requires.
• Frame the day: so far every admin action has been performed using the Global Administrator account. Today covers how to scope admin access appropriately — assigning the right role to each IT person — and takes a structured tour of every major admin centre students will use over the next seven weeks.

Admin roles — Global vs scoped, least privilege, and the M365 admin centre landscape

• Global Administrator — the nuclear option — Global Admin has unrestricted access to every M365 service, every Entra ID setting, every piece of data. It can: delete tenants, remove all CA policies, read any user's email, assign any role to anyone. This is why Global Admin should be used only when absolutely necessary, there should be as few Global Admins as possible (Microsoft recommends 2–4 max), and every action taken as Global Admin is audited. The course uses Sarah Chen's account as Global Admin because it is a lab environment — in production, even Sarah would use a scoped role for day-to-day work.
• Entra ID built-in roles — Microsoft provides over 60 built-in roles in Entra ID, each granting specific permissions to specific services. The most important for an M365 admin: Global Administrator, Global Reader (read everything, change nothing), User Administrator (manage users and groups — not admins), Helpdesk Administrator (reset passwords for non-admins), Exchange Administrator, SharePoint Administrator, Teams Administrator, Compliance Administrator, Security Administrator. Each role is cumulative — a user can hold multiple roles simultaneously.
• The least privilege principle — every admin should have only the permissions their job requires. A helpdesk technician who can reset passwords does not need to modify CA policies. A SharePoint admin who manages sites does not need to read HR emails. Assigning scoped roles reduces: blast radius if an account is compromised, accidental misconfiguration risk, and audit noise (the audit log is easier to investigate when each admin has a clear, bounded scope of action).
• Role boundaries — what Helpdesk Admin cannot do — the Helpdesk Administrator role can: reset passwords for non-administrator users, manage service requests, monitor service health. It cannot: reset passwords for other admins, modify user licences, add or remove group members (unless they are also User Administrator), create or delete users, change any security or compliance settings. Understanding the boundary is as important as understanding what a role can do.
• The M365 admin centre landscape — each M365 service has its own admin centre. Students will use all of them over the next seven weeks. Today's lab visits each one and records its URL, purpose, and what settings it contains. Knowing where to go before you need to go there eliminates confusion during time-pressured labs.

Lab 1-D: Role assignment, boundary testing, and admin centre mapping

Students assign the Helpdesk Administrator role to Dev Sharma and the SharePoint Administrator role to Sarah Chen, test the role boundaries empirically using Dev's account, tour all eight admin centres, and document the Lakeview Logistics admin structure.

• Step 1 — Assign Helpdesk Administrator to Dev Sharma (10 min)
  Navigate to entra.microsoft.com → Roles & admins → Roles. Search for Helpdesk Administrator.
  Click the role → + Add assignments → Select members → Dev Sharma → Add.
  Confirm the assignment appears in the role's Assignments tab.
  Then navigate to Users → Dev Sharma → Assigned roles. Confirm Helpdesk Administrator appears.
  Record in your lab journal: what permissions does this role grant? What does it explicitly deny?
• Step 2 — Assign SharePoint Administrator to Sarah Chen (5 min)
  In Roles & admins → Roles, search for SharePoint Administrator.
  Add Sarah Chen's admin account. Confirm assignment.
  Navigate to Users → Sarah Chen → Assigned roles. Sarah should now show two roles: Global Administrator and SharePoint Administrator.
  Record: why assign SharePoint Admin to someone who is already a Global Admin? — to demonstrate role stacking and because in production, some organisations use scoped roles even for primary admins.
• Step 3 — Test Dev Sharma's role boundaries (20 min)
  Open a private/incognito browser window. Sign in as Dev Sharma (d.sharma@[yoursubdomain]).
  Navigate to admin.microsoft.com. Record what Dev can see in the left navigation — it is significantly reduced compared to the Global Admin view.
  Attempt each of the following and record whether Dev can or cannot perform the action:
  · Reset Priya Nair's password — should succeed (Helpdesk Admin can reset non-admin passwords)
  · Try to reset Sarah Chen's password — should fail (cannot reset admin passwords)
  · Try to add a licence to Tom Bellamy — should fail (Helpdesk Admin cannot manage licences)
  · Try to view service health — should succeed
  · Try to create a new user — should fail (Helpdesk Admin cannot create users)
  · Try to navigate to the Security admin centre — access denied for most settings
  Record the exact error messages shown for each failed attempt. These messages tell you what the role boundary is.
• Step 4 — Admin centre tour (25 min)
  Switch back to Sarah Chen's Global Admin session. Visit each admin centre in the table below. For each one: navigate to the URL, identify the three most prominent menu sections in the left navigation, note one setting or feature that will be used in a later lab week. Record your findings in the Admin Centre Map table in your lab journal.
  Admin centres to visit: admin.microsoft.com, entra.microsoft.com, admin.exchange.microsoft.com, admin.microsoft.com/sharepoint, admin.teams.microsoft.com, intune.microsoft.com, security.microsoft.com, purview.microsoft.com
• Step 5 — Document the Lakeview Logistics admin structure (5 min)
  In your lab journal, draw or describe the admin structure for Lakeview Logistics:
  · Who holds Global Administrator — and why only one person?
  · Who holds Helpdesk Administrator — and what can they do?
  · What additional role does Sarah have — and when will it be needed?
  · What is missing that you would add if this were a real production environment? (Hint: Week 2 covers this — break-glass account.)

⭐ Bonus: Global Reader role and PowerShell role management

Reflection & preview

• Ask: "Dev Sharma couldn't reset Sarah Chen's password. Why is that the right design — why shouldn't a Helpdesk Admin be able to reset an admin's password?" — because resetting an admin password is equivalent to taking over that admin's account. A compromised helpdesk account should not be able to escalate to Global Admin access by simply resetting the Global Admin's password. This is one of the most important security properties of role-based access.
• Ask: "You visited eight admin centres today. Which one felt most unfamiliar, and which setting there do you most want to understand better by the end of the course?" — open discussion, helps gauge student confidence and curiosity ahead of Week 2.
• Preview Day 5: tomorrow is the Week 1 assessment — a new-hire scenario where students create a user, assign the right licence, add them to the right groups, assign an appropriate admin role if needed, and document their reasoning. Everything from Days 1–4 is tested. Review your lab journal tonight — specifically: UPN format, group names and their members, which role does what.