🔐 Recipe · Entra ID & Identity
Assign the Global Administrator Role to a User in Entra ID
Grant tenant-wide admin rights by activating the Global Administrator directory role and adding a member
Complexity
Intermediate
Impact
high-privilege + tenant-wide + security-sensitive + audit-logged
Context
Why This Matters
The Global Administrator role is the highest-privilege role in Microsoft Entra ID. It grants full control over every aspect of Entra ID and any Microsoft 365 service that uses Entra identities — including billing, security, Exchange, SharePoint, Teams, and Intune.
You'll run this recipe when onboarding a new senior IT admin, standing up a break-glass emergency access account, or temporarily elevating a trusted engineer for a tenant-level task. Because the blast radius is enormous, Microsoft recommends keeping the number of permanent Global Admins to fewer than five and using Privileged Identity Management (PIM) for just-in-time elevation wherever possible.
Before assigning, always confirm the user's identity — typos or ambiguous display names can lead to granting tenant-wide control to the wrong account. If a directory search returns no results, verify the exact User Principal Name (UPN) with the requester rather than guessing.
Expected Outcomes
After completing this recipe you will have:
- Verified the target user exists and is the correct identity (by UPN, not just display name).
- Activated the
Global Administratordirectory role in the tenant (if not already active). - Added the user as a member of the Global Administrator role.
- Confirmed the assignment by listing role members or inspecting the user's
memberOfcollection. - An audit trail entry in Entra ID sign-in and audit logs recording who performed the elevation and when.
Risks & Considerations
⚠️ High-risk operation
- Tenant-wide control. A Global Admin can read all data, reset any password, delete any user, and modify tenant configuration. Treat this like handing over the keys to the kingdom.
- Limit count. Microsoft recommends no more than 5 permanent Global Admins. Prefer PIM eligible assignments over permanent active assignments.
- MFA required. Ensure the target account has strong, phishing-resistant MFA (FIDO2 or Windows Hello for Business) registered before elevation.
- Conditional Access. Confirm admin accounts are covered by a Conditional Access policy that enforces MFA and blocks legacy auth.
- Break-glass separation. Do not use day-to-day user accounts for Global Admin. Create a dedicated admin-only UPN (e.g.
admin-firstname@tenant.onmicrosoft.com). - Disambiguate users. If a search returns zero or multiple results, stop and confirm the UPN with the requester. Never assume which account is meant.
- Licensing. Global Admin itself is free, but the account still needs appropriate licenses to use services.
Required Permissions
| Permission | Why It's Needed |
|---|---|
| RoleManagement.ReadWrite.Directory | Required to activate directory roles and add members to them via Microsoft Graph. |
| User.Read.All | Required to look up the target user by display name or UPN before assignment. |
| Directory.Read.All | Required to list active directory roles and confirm the Global Administrator role template. |
| Privileged Role Administrator (or Global Administrator) | The admin running the assignment must hold one of these roles — only these roles can assign Global Administrator. |
The fastest way to get this done: just ask Dex. Copy the prompt below and paste it into your Dex conversation.
For IT Admins
Paste into Dex Pro
Assign Global Administrator via the Entra admin center
- Sign in to the Microsoft Entra admin center with an account that holds Privileged Role Administrator or Global Administrator.
- Navigate to .
- Search for the target user by User Principal Name (email-style login). Do not rely on display name alone — confirm the UPN matches the requester's intent.
- Click the user to open their profile, then select in the left pane.
- Click + Add assignments.
- In the role picker, search for
Global Administratorand select it. - Choose the assignment type:
- Eligible (recommended) — requires activation via PIM each time. Needs Entra ID P2.
- Active — permanent assignment. Use sparingly.
- Set a start/end date if you want time-bound access, then click Assign.
- Verify by returning to and confirming the user appears in the members list.
- Notify the user and ensure they have registered phishing-resistant MFA before their next sign-in.
Assign Global Administrator via Microsoft Graph
The role template ID for Global Administrator is always 62e90394-69f5-4237-9190-012177145e10. The role must be activated (instantiated as a directoryRole) in the tenant before members can be added — if it's already active, the activation call returns an error you can safely ignore.
Step 1 — Locate the user
GET https://graph.microsoft.com/v1.0/users/{userPrincipalName} // Prefer exact UPN lookup over $filter searches — avoids ambiguity.
If you only have a display name, use a precise filter:
GET /v1.0/users?$filter=displayName eq 'Jane Doe'&$select=id,displayName,userPrincipalName
If zero or multiple results are returned, stop and confirm the UPN with the requester rather than guessing.
Step 2 — Activate the Global Administrator role (idempotent)
POST https://graph.microsoft.com/v1.0/directoryRoles Content-Type: application/json { "roleTemplateId": "62e90394-69f5-4237-9190-012177145e10" }
Then fetch the activated role to get its object ID:
GET /v1.0/directoryRoles?$filter=displayName eq 'Global Administrator'
Step 3 — Add the user as a member
POST https://graph.microsoft.com/v1.0/directoryRoles/{roleId}/members/$ref Content-Type: application/json { "@odata.id": "https://graph.microsoft.com/v1.0/directoryObjects/{userId}" }
A 204 No Content response indicates success.
Step 4 — Verify
GET /v1.0/directoryRoles/{roleId}/members?$select=id,displayName,userPrincipalName
Preferred: PIM eligible assignment (Entra ID P2)
POST /v1.0/roleManagement/directory/roleEligibilityScheduleRequests { "action": "adminAssign", "principalId": "{userId}", "roleDefinitionId": "62e90394-69f5-4237-9190-012177145e10", "directoryScopeId": "/", "justification": "Senior IT admin — eligible GA", "scheduleInfo": { "startDateTime": "2025-01-01T00:00:00Z", "expiration": { "type": "noExpiration" } } }
Assign Global Administrator via PowerShell
The Microsoft.Graph PowerShell SDK wraps all the calls above. You'll need the Microsoft.Graph.Identity.DirectoryManagement and Microsoft.Graph.Users modules.
Install & connect
Install-Module Microsoft.Graph -Scope CurrentUser Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory","User.Read.All","Directory.Read.All"
One-shot assignment
# 1. Resolve the user by UPN (exact match, no ambiguity) $user = Get-MgUser -UserId "jane.doe@contoso.com" # 2. Ensure the GA role is activated in the tenant $gaTemplateId = "62e90394-69f5-4237-9190-012177145e10" $role = Get-MgDirectoryRole -Filter "roleTemplateId eq '$gaTemplateId'" -ErrorAction SilentlyContinue if (-not $role) { $role = New-MgDirectoryRole -RoleTemplateId $gaTemplateId } # 3. Add the user as a role member New-MgDirectoryRoleMemberByRef -DirectoryRoleId $role.Id -BodyParameter @{ "@odata.id" = "https://graph.microsoft.com/v1.0/directoryObjects/$($user.Id)" } # 4. Verify Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id | ForEach-Object { Get-MgUser -UserId $_.Id } | Select-Object DisplayName, UserPrincipalName
The downloadable script below wraps this in a reusable function with confirmation prompts, error handling, and a -WhatIf dry-run.
Next steps