How to Manage Microsoft 365 Administrator Approval and Root Access
Question details
The user is looking for a way to configure a root access setting to require one administrator to approve another administrator's changes to accounts or mailboxes.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- Configuring security policies to enforce dual authorization or approval workflows for high-level administrative tasks.
- Observed behavior
- The Microsoft 365 admin center does not offer a specific 'root access' setting to mandate approval for administrative account or mailbox changes.
Ensure you have Global Administrator privileges in your Microsoft 365 tenant to view and modify role assignments and access the Microsoft Purview compliance portal.
Implement Least-Privilege Administrator Roles
Instead of relying on a root access approval system, use Role-Based Access Control (RBAC) to separate responsibilities and limit what each administrator can change.
Because Microsoft 365 does not support a native cross-admin approval workflow for standard settings, the best security practice is applying the principle of least privilege. By granting admins only the exact permissions they need (e.g., Exchange Administrator for mailboxes, User Administrator for accounts), you prevent broad, unchecked changes across the entire tenant.
Sign in to the Microsoft 365 admin center using your Global Administrator credentials.
In the left-hand navigation pane, click on 'Roles' and then select 'Role assignments'.
Review the list of available roles. Instead of assigning 'Global Administrator', select specific roles like 'Exchange Administrator' or 'User Administrator'.
Click on the chosen role, select 'Assigned admins', and add the specific users who need these limited administrative capabilities.
Monitor Actions via Microsoft Purview Audit Log
Use the unified audit log to track and review all administrative changes made to user accounts and mailboxes.
Looking for a Lightweight, Secure Office Alternative?
While Microsoft 365 handles complex enterprise security policies, everyday document management shouldn't be complicated. WPS Office provides a free, lightweight, and highly compatible suite for your daily document, spreadsheet, and presentation needs.
- 1. Download the Installer: Visit the official WPS Office website and click the free download button for your operating system.
- 2. Install the Application: Run the downloaded installer and follow the simple on-screen instructions to complete the setup.
- 3. Open and Edit Documents: Launch WPS Office to instantly open, edit, and save your existing Microsoft Office documents without any formatting loss.
Frequently Asked Questions
Can I require dual authorization for administrative tasks in Microsoft 365?
There is no native 'root access' dual-approval for basic admin changes. However, if you have Microsoft Entra ID P2 licenses, you can use Privileged Identity Management (PIM) to require a second admin's approval before a user can activate an elevated administrative role.
What is the Microsoft Purview audit log?
The Microsoft Purview audit log is a comprehensive compliance tool that records administrative and user actions across your Microsoft 365 tenant, allowing you to monitor exactly who made changes to accounts, mailboxes, and security settings.
Does Microsoft 365 have a root account similar to Linux?
No, Microsoft 365 operates on Role-Based Access Control (RBAC) rather than a single root account system. The Global Administrator role holds the highest privileges, but best practices dictate minimizing the number of Global Admins and using specialized roles instead.
