One front door and seven specialist workspaces
Microsoft describes the Microsoft 365 admin center as the common entry point for all teams and roles managing Microsoft 365, and says that specialist workspaces, including SharePoint, Teams, Exchange, Security, Compliance and Microsoft Entra ID, allow deep, granular control and are reached from its navigation pane (Microsoft Learn, Overview of the Microsoft 365 admin center, accessed 2026-10-20). The practical rule EPC Group teaches client admin teams is short: tenant-wide identity and licensing start in the Microsoft 365 admin center or Microsoft Entra, a workload setting lives in that workload's admin center, compliance lives in Microsoft Purview, security operations live in Microsoft Defender, and devices live in Intune. The second half of the answer is who gets into each one, which is a role design question rather than a navigation question. EPC Group's Microsoft 365 consulting practice delivers both together, because a clear map with standing Global Administrator for everyone is still an exposed tenant.
What each admin center is for
The Microsoft 365 admin center, at admin.microsoft.com, holds the tenant's day-to-day controls. Microsoft lists Settings for global app settings, password policy, domains, organization profile and release preferences; Setup for domains, multifactor authentication, admin access and mailbox migration; Reports for usage; Health for service health and Message center; and an Admin centers group that opens the separate Exchange, Teams, SharePoint, Viva Engage and Microsoft Entra admin centers, each with all available settings for its service. Microsoft notes that the admin centers available depend on plan and region (Microsoft Learn, Overview of the Microsoft 365 admin center, accessed 2026-10-20).
The Exchange admin center manages mailboxes, Microsoft 365 Groups, distribution groups, mail-enabled security groups and dynamic distribution groups, mail flow and migrations, including cross-tenant moves, and role-based access control decides which of its features each admin sees (Microsoft Learn, Exchange admin center in Exchange Online, accessed 2026-10-20). In the SharePoint admin center, administrators create and manage site collections, site settings and OneDrive; in the Teams admin center they manage messaging, meetings and presence (Microsoft Learn, Overview of the Microsoft 365 admin center, accessed 2026-10-20). The Microsoft Entra admin center at entra.microsoft.com holds users, groups, Conditional Access, role assignments and Privileged Identity Management.
Three portals sit outside the admin-center list but carry as much weight. Microsoft lists the Microsoft Purview portal at purview.microsoft.com for eDiscovery, audit, DLP, retention and encryption, the Microsoft Defender portal at security.microsoft.com for security operations, and the Microsoft Intune admin center at intune.microsoft.com for devices and apps (Microsoft Learn, Microsoft Cloud Portals: Self-Help When a Support Request Cannot Be Opened, accessed 2026-10-20). Intune notes that its Intune Administrator role is privileged, and that Microsoft recommends granting less privileged Intune RBAC roles for daily administration (Microsoft Learn, Sign up or sign in to Microsoft Intune, accessed 2026-10-20).
Which built-in roles to assign
Microsoft's guidance on roles is consistent: use roles with the fewest permissions and limit the number of users with administrative permissions. Its security guidelines say to have as few Global Administrators as possible, to assign the least permissive role (for example Password Administrator or Helpdesk Administrator rather than Global Administrator to reset passwords), and to require multifactor authentication for every administrator. It also advises keeping at least one Privileged Authentication Administrator so that a locked-out Global Administrator can be reset (Microsoft Learn, About administrator roles in the Microsoft 365 admin center, accessed 2026-10-20).
The commonly used roles map onto the admin centers above. Exchange Administrator, SharePoint Administrator and Teams Administrator manage their workloads; User Administrator creates and manages accounts; Groups Administrator manages group creation, expiration and naming policies; License Administrator assigns licenses and reprocesses group-based licensing; Helpdesk Administrator resets passwords for non-administrators; Service Support Administrator opens service requests and reads Message center; Security Administrator and Security Reader cover the security portals; and Global Reader can view everything a Global Administrator can view but edit nothing (same source). Microsoft recommends fewer than five Global Administrators, all protected with multifactor authentication, cloud-native rather than synchronized accounts for role holders, and PIM for Groups when one person needs several roles at once (Microsoft Learn, Best practices for Microsoft Entra roles, accessed 2026-10-20). EPC Group adds custom role groups in Exchange and Purview where a built-in role is still broader than the job.
Privileged Identity Management for every admin role
Privileged Identity Management turns standing access into just-in-time access. Microsoft lists its features as just-in-time privileged access, time-bound assignments with start and end dates, approval to activate, MFA on activation, justification, notifications, access reviews, downloadable audit history and protection against removing the last active Global Administrator (Microsoft Learn, What is Microsoft Entra Privileged Identity Management?, accessed 2026-10-20). It requires Microsoft Entra ID P2 or Microsoft Entra ID Governance licenses for users with eligible or time-bound assignments, for approvers and for access reviewers; P2 is included with Microsoft 365 E5 (Microsoft Learn, Microsoft Entra ID Governance licensing fundamentals, accessed 2026-10-20).
Configuration happens per role. A Privileged Role Administrator opens ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles, selects the role and edits its role settings: activation duration, MFA or a Conditional Access authentication context on activation, justification, ticket information, approval with named approvers, and whether eligible or active assignments may be permanent. Microsoft warns that a tenant locks itself out if every Global Administrator and Privileged Role Administrator is eligible, approval is required and no approver is configured (Microsoft Learn, Configure Microsoft Entra role settings in Privileged Identity Management, accessed 2026-10-20). Its deployment plan says to keep zero permanently active assignments for roles other than the emergency access accounts (Microsoft Learn, Plan a Privileged Identity Management deployment, accessed 2026-10-20). EPC Group's Microsoft Entra ID practice uses a short activation window and approval for Global Administrator, Privileged Role Administrator and Security Administrator, and justification-only activation for workload roles.
Break-glass accounts and auditing admin activity
Emergency access accounts exist for the day PIM, federation or MFA is unavailable. Microsoft's checklist is specific: at least two cloud-only accounts on the .onmicrosoft.com domain, phishing-resistant authentication different from normal admin accounts, credentials that do not expire, Global Administrator assigned as permanent active in PIM, use from a designated secure workstation, credentials in separate secure locations, exclusion from Conditional Access policies that block sign-in, alerts on all sign-in and audit activity, and validation at least every 90 days (Microsoft Learn, Manage emergency access accounts in Microsoft Entra ID, accessed 2026-10-20). Separately, Microsoft recommends phishing-resistant MFA for administrators of the Microsoft admin portals, starting with Global Administrator, Exchange Administrator, SharePoint Administrator, Security Administrator and the other high-impact roles (Microsoft Learn, Require multifactor authentication for admins accessing Microsoft admin portals, accessed 2026-10-20). Every admin change then has two records: the unified audit log for the workload change, and PIM audit history for the activation that made it possible.
Documented work
ANON-CASES: EPC Group engagement data for Microsoft 365 administration covers mid-size and large organizations in healthcare, financial services and the public sector moving from shared standing Global Administrator accounts to workload roles, PIM activation and documented emergency access, delivered by the firm's Microsoft 365 consulting and managed Microsoft services practices. Client names are not published here. Engagements are described by industry and organization size only, and no outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.
Primary sources
- Overview of the Microsoft 365 admin center — Microsoft Learn, accessed 2026-10-20
- About administrator roles in the Microsoft 365 admin center — Microsoft Learn, accessed 2026-10-20
- Exchange admin center in Exchange Online — Microsoft Learn, accessed 2026-10-20
- Microsoft Cloud Portals: Self-Help When a Support Request Cannot Be Opened — Microsoft Learn, accessed 2026-10-20
- Sign up or sign in to Microsoft Intune — Microsoft Learn, accessed 2026-10-20
- Best practices for Microsoft Entra roles — Microsoft Learn, accessed 2026-10-20
- What is Microsoft Entra Privileged Identity Management? — Microsoft Learn, accessed 2026-10-20
- Microsoft Entra ID Governance licensing fundamentals — Microsoft Learn, accessed 2026-10-20
- Configure Microsoft Entra role settings in Privileged Identity Management — Microsoft Learn, accessed 2026-10-20
- Plan a Privileged Identity Management deployment — Microsoft Learn, accessed 2026-10-20
- Manage emergency access accounts in Microsoft Entra ID — Microsoft Learn, accessed 2026-10-20
- Require multifactor authentication for admins accessing Microsoft admin portals — Microsoft Learn, accessed 2026-10-20
- Search the audit log — Microsoft Learn, accessed 2026-10-20
Frequently Asked Questions
What does each admin center cover (Microsoft 365, Exchange, SharePoint, Teams, Entra, Purview, Defender, Intune)?
The Microsoft 365 admin center is the common entry point for users, licenses, billing, settings, reports and service health, and it links to specialist workspaces (Microsoft Learn, Overview of the Microsoft 365 admin center, accessed 2026-10-20). Exchange manages mailboxes, groups and mail flow; SharePoint manages sites, sharing and OneDrive; Teams manages meetings and org-wide Teams settings. Microsoft Entra manages identities, Conditional Access and roles. Microsoft Purview at purview.microsoft.com covers audit, eDiscovery, DLP and retention, the Defender portal at security.microsoft.com covers security operations, and Intune at intune.microsoft.com covers devices and apps (Microsoft Learn, Microsoft Cloud Portals: Self-Help When a Support Request Cannot Be Opened, accessed 2026-10-20).
Which built-in roles should be used, and which avoided, such as Global Administrator?
Microsoft advises assigning the least permissive role: Password Administrator or Helpdesk Administrator to reset passwords, User Administrator to create accounts, License Administrator for licensing, and the Exchange, SharePoint and Teams Administrator roles for their workloads, with Global Reader for read-only oversight (Microsoft Learn, About administrator roles in the Microsoft 365 admin center, accessed 2026-10-20). Global Administrator should go to fewer than five people, all protected with multifactor authentication (Microsoft Learn, Best practices for Microsoft Entra roles, accessed 2026-10-20). EPC Group keeps Global Administrator for the two emergency accounts and a small PIM-eligible group.
What is Privileged Identity Management and how is it configured for admins?
Privileged Identity Management gives just-in-time, time-bound and approval-based role activation, with MFA, justification, notifications, access reviews and downloadable audit history (Microsoft Learn, What is Microsoft Entra Privileged Identity Management?, accessed 2026-10-20). It requires Microsoft Entra ID P2 or Microsoft Entra ID Governance licenses for eligible users and approvers (Microsoft Learn, Microsoft Entra ID Governance licensing fundamentals, accessed 2026-10-20). Role settings are found under ID Governance > Privileged Identity Management > Microsoft Entra roles > Roles, and can require justification, ticket information and approval; Microsoft recommends at least two approvers (Microsoft Learn, Configure Microsoft Entra role settings in Privileged Identity Management, accessed 2026-10-20).
How are break-glass accounts set up?
Microsoft recommends at least two cloud-only emergency access accounts on the .onmicrosoft.com domain, not federated or synchronized, permanently assigned Global Administrator as active rather than eligible in PIM. They use phishing-resistant authentication such as a FIDO2 passkey or certificate-based authentication, are excluded from Conditional Access policies that block sign-in, have credentials stored in separate secure locations, are monitored with alerts on every sign-in, and are validated at least every 90 days (Microsoft Learn, Manage emergency access accounts in Microsoft Entra ID, accessed 2026-10-20). EPC Group documents the retrieval procedure and the post-use review in the client runbook.
How is admin activity audited?
Admin actions across Exchange, SharePoint, Entra and other services land in the unified audit log, which records user, group, application, domain and directory activities performed in the Microsoft 365 admin center or the Azure portal (Microsoft Learn, Search the audit log, accessed 2026-10-20). PIM adds its own audit history of activations and assignments that can be downloaded for internal or external audit (Microsoft Learn, What is Microsoft Entra Privileged Identity Management?, accessed 2026-10-20). For emergency accounts, Microsoft describes sending Entra sign-in logs to Azure Monitor and alerting on their object IDs (Microsoft Learn, Manage emergency access accounts in Microsoft Entra ID, accessed 2026-10-20).
Talk to a senior architect
If your tenant still has more Global Administrators than it needs, or no tested emergency access accounts, a 30-minute discovery call with a senior EPC Group architect will map each admin to a workload role and set out the PIM settings to apply. See the Microsoft 365 consulting service hub for engagement structures.
Email contact@epcgroup.net or call 888-381-9725.
a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.