Manage Admins without Microsoft Global Admin Credentials
This article explains how to configure a Microsoft Teams user in your Microsoft 365 organization to manage day-to-day tasks in the Microsoft Teams Phone Connector Enterprise Portal, without requiring the Global Admin role.
This approach is ideal when you want non-admin staff, such as IT personnel or operations teams, to handle routine user management without needing elevated access.
Introduction
Enterprises strongly prefer to reserve their Microsoft Global Admin role for use only when necessary. Some certifications (e.g., SOC 2) require very strict control over who has access at the highest level in IT Systems.
Microsoft Global Admin role is REQUIRED to complete the Enterprise Registration and Direct Routing setup, as well as the optional Teams Application setup.
All day-to-day tasks - adding, configuring and deleting End Users - can be performed with delegated Microsoft credentials.
The Microsoft User with this delegated authority must have Teams Administrator role.
In some Microsoft Enterprises, delegation is a conditional setting that must be configured in Azure Active Directory, with the Global Admin granting conditional consent to a delegated admin for a specific task. While time-consuming and inconvenient, this is undoubtedly an effective security measure.
Here is a table of the capabilities of each level of Microsoft roles:
Portal Tasks |
Global Administrator |
Teams Administrator |
|---|---|---|
Initial Registration |
YES |
NO |
Set up Direct Routing |
YES |
NO |
Set up/Manage PBX |
YES |
YES |
Set up / Manage PBX End User Portal |
YES |
YES |
Set up / Manage PBX Feature Codes |
YES |
YES |
Set up / Manage Users |
YES |
YES |
Add / Delete Teams Applications |
YES |
NO |
Steps to Provide Delegated Authority
Follow these steps to assign the Teams Administrator role to a user in your Microsoft 365 organization.
1. Go to the Microsoft Teams Admin Center and navigate to Active Users.
2. Select the user you want to delegate authority to (this should not be the Global Admin account), then click Manage Roles.
3. Select Admin center access.
4. Choose Teams Administrator from the list of available roles, then click Save changes.
Once saved, the user's profile will show Teams Administrator under their assigned Role.
That user can now log in to the Microsoft Teams Phone Connector Enterprise Portal and manage end users, as well as perform all the tasks listed in the table above.
When changes are saved, the Microsoft User with these credentials will be able to access the ConnecttoTeams Enterprise Portal and manage end users and the tasks listed in the table above.