Exchange, SharePoint, Teams: who really holds admin rights in your tenant?
When teams list the administrators of a tenant, they often stop at Entra ID directory roles. Yet each workload has its own permission model. An account with no directory role at all can still hold broad rights over mail or over SharePoint sites.
Two layers of delegation
Microsoft 365 stacks two layers. The first is Entra ID directory roles: Global Administrator, Exchange Administrator, SharePoint Administrator, Teams Administrator and so on. The second is specific to each service: Exchange Online role groups, SharePoint site collection administrators, Purview compliance roles. Entra ID roles flow down into the services automatically, but not the other way round: a member of an Exchange role group does not show up in the Entra ID portal.
Exchange Online: a rich and often overlooked RBAC
Exchange Online uses an RBAC model made of management roles (sets of cmdlets), role assignments and scopes. Roles are usually bundled into role groups:
- Organization Management: near-total control of the Exchange organisation;
- Recipient Management: creating and changing mailboxes, including permissions;
- Discovery Management and Compliance Management: search and compliance, hence potential access to content;
- Help Desk, View-Only Organization Management and custom role groups.
Roles can also be assigned directly to a user, without any group, which makes them even harder to spot.
Get-RoleGroup | ForEach-Object {
$g = $_.Name
Get-RoleGroupMember -Identity $g | Select-Object @{n='RoleGroup';e={$g}}, Name, RecipientType
}
Get-ManagementRoleAssignment -GetEffectiveUsers | Where-Object { $_.RoleAssigneeType -eq 'User' }
Applications have Exchange roles too
RBAC for Applications lets you grant a service principal Exchange permissions limited to a management scope, such as a specific set of mailboxes. It is the recommended alternative to tenant-wide Graph application permissions like Mail.Read, which open every mailbox in the tenant. Those assignments still need to be inventoried: Get-ServicePrincipal and Get-ManagementRoleAssignment list them on the Exchange side.
SharePoint and Teams
In SharePoint, the SharePoint Administrator role covers the whole service, but every site also has its own site collection administrators with full control over content. These assignments pile up over projects and are rarely reviewed. For Teams, several specialised Entra ID roles exist (Teams Administrator, Teams Communications Administrator, Teams Devices Administrator and others), and team owners hold significant rights over the team and its connected site.
The classic trap. A former contractor removed from every Entra ID role but still a member of Organization Management can still grant themselves access to any mailbox.
What an audit checks
- members of every Exchange role group, including custom ones;
- direct management role assignments to users or applications;
- service principals holding tenant-wide Graph permissions on mail;
- consistency between Entra ID roles and service-level delegations.