Every Microsoft 365 tenant has administrator accounts. Some manage Exchange Online, others look after Teams or SharePoint, while a few have full Global Administrator access. As organisations grow, these administrative roles often get assigned to more people than originally intended. Over time, it becomes surprisingly difficult to answer a simple question: Who has administrative access in our Microsoft 365 tenant?
That’s why reviewing administrator roles should be a regular part of tenant maintenance. Knowing exactly who has elevated permissions helps reduce security risks, prepares you for compliance audits, and ensures users only have the level of access they actually need. Let’s learn how to identify users with administrator roles in Microsoft 365.
Why It’s Important to Review Administrator Roles
Administrative roles are some of the most powerful permissions available in Microsoft 365. Depending on the assigned role, a user could reset passwords, manage mailboxes, change security settings, assign licences, or even make tenant-wide configuration changes.
Because these permissions are so powerful, administrator accounts are also among the first targets attackers look for. If a privileged account is compromised, the impact can be far greater than that of a standard user account. Here’s the three most efficient methods to find users with admin roles in Microsoft 365.
Method 1: Export Users with Admin Roles Using Microsoft 365 Admin Center
The Microsoft 365 admin center provides a simple way to view and export users with administrative roles. Follow the below steps:
- Sign in to the Microsoft 365 admin center.
- In the left navigation pane, go to Roles > Role assignments and select the Microsoft Entra ID tab.
- Click Export admin list.
The exported CSV makes it easier to review privileged users, share the report with auditors, and identify role assignments that may no longer be required. The report typically includes details such as the administrator’s display name, email address, and assigned administrative role.
Method 2: Find All Users with Admin Roles Using Microsoft Entra Admin Center
If you manage identities through the Microsoft Entra admin center, you can also export a complete list of administrator role assignments. This method is particularly useful for reviewing privileged access or preparing reports for security and compliance audits.
- Sign in to the Microsoft Entra admin center.
- In the left navigation pane, select Roles & admins.
- Click Download assignments from the command bar.
- Enter a name for the export file if required.
- Click Start bulk operation to generate the report.
- Once the export request has been submitted, click Click here to view the status of each operation.
- On the Bulk Operations page, wait until the export status changes to Succeeded.
- Click the generated CSV file name to download the administrator role assignment report.
- Open the downloaded CSV file to review users and their assigned Microsoft Entra administrator roles.
This approach provides a consolidated report of administrator role assignments instead of requiring you to check each role individually.
Method 3: Get Users with Admin Roles Report Using Microsoft Graph PowerShell
For administrators who need a complete report or want to automate recurring audits, Microsoft Graph PowerShell offers a flexible way to retrieve all Microsoft Entra administrator role assignments. Unlike the graphical interfaces, PowerShell can generate a consolidated report that can easily be filtered, exported, or incorporated into scheduled audit scripts.
Firstly, connect to Microsoft Graph with the required permissions.
Connect-MgGraph -Scopes RoleManagement.Read.Directory,Directory.Read.All Then, run the following script to list every administrator role together with the users assigned to it.
$roles = Get-MgDirectoryRole
$results = foreach ($role in $roles) {
$members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id
foreach ($member in $members) {
# Only grab actual users (ignoring groups/service principals)
if ($member.AdditionalProperties['@odata.type'] -eq '#microsoft.graph.user') {
[PSCustomObject]@{
Role = $role.DisplayName
DisplayName = $member.AdditionalProperties['displayName']
UserPrincipalName = $member.AdditionalProperties['userPrincipalName']
}
}
}
}
# Ensure folder exists and export
if (!(Test-Path "C:\Reports")) { New-Item -ItemType Directory -Path "C:\Reports" -Force }
$results | Export-Csv "C:\Reports\AdminRoleAssignments.csv" -NoTypeInformation
While Microsoft Graph PowerShell provides a powerful way to retrieve administrator role assignments, it does require familiarity with PowerShell and the Microsoft Graph SDK. You’ll also need the appropriate permissions to query directory roles. For one-time checks, the Microsoft 365 or Microsoft Entra admin centers may be sufficient. However, if you regularly audit privileged access or want to automate reporting, PowerShell is the more scalable option.
