How to Transfer Microsoft 365 Administrator Ownership and MFA Access
Question details
The user needs to securely transfer administrative responsibilities, including Multi-Factor Authentication (MFA) access, to a new Microsoft 365 administrator.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- An organization is handing over administrative duties to a new officer and needs to manage login credentials, MFA details, and association records.
- Observed behavior
- The user wants to establish a secure handover process without improperly sharing a single login or its associated MFA device/phone number among successive administrators.
Ensure you are currently signed in with an account that has Global Administrator privileges in Microsoft 365 before attempting to assign roles or modify administrative access.
Assign the Global Administrator Role to a New Individual Account
The most secure and recommended method for transferring ownership is to create a distinct user account for the incoming administrator and grant them Global Administrator rights.
Microsoft highly advises against sharing a single administrator account or its Multi-Factor Authentication (MFA) methods between multiple users. Shared accounts complicate security audits and increase the risk of unauthorized access.
Instead, each administrator should have their own dedicated account with their own personalized MFA setup (such as a unique phone number or their own Microsoft Authenticator app).
Go to the Microsoft 365 admin center and log in with your current Global Administrator credentials.
In the left-hand navigation menu, select 'Users' and then click on 'Active users'.
If the new administrator already has an account, click on their name. If not, click 'Add a user' to create a new individual Microsoft 365 account for them.
In the user's settings pane, navigate to the 'Roles' tab, select 'Manage roles', choose 'Global Administrator', and save the changes.
Instruct the new administrator to log into their account. They will be prompted to set up their own authentication methods using the Microsoft Authenticator app or their personal phone number.
Store Official Records in a Centralized SharePoint Site
To ensure organizational documents remain accessible after an administrator leaves, store them in a shared location rather than an individual's OneDrive.
Manage Your Office Documents Seamlessly with WPS Office
While you manage complex administrative roles and security settings in Microsoft 365, consider WPS Office as a lightweight, free alternative for your organization's daily document processing. WPS Office provides an intuitive, familiar interface without the heavy administrative overhead.
- 1. Download and Install: Visit the official WPS website to download the free WPS Office installer for your operating system.
- 2. Open Existing Documents: Launch WPS Office and directly open your existing Word, Excel, and PowerPoint files without any formatting loss.
- 3. Collaborate and Save: Edit your documents locally or save them in standard Office formats to share with your team seamlessly.
Frequently Asked Questions
Can I retain the same Microsoft 365 administrator login but just change the registered MFA phone number?
While it is technically possible to update the MFA methods on an existing account, Microsoft strongly recommends against sharing or reusing a single generic administrator login among successive officers. The best practice is to assign the Global Administrator role to the incoming user's individual account.
How does a new administrator set up their Microsoft Authenticator?
Once the Global Administrator role is assigned to the new user's individual account, they will be prompted to configure their own MFA during their first login. They can download the Microsoft Authenticator app on their mobile device and scan the provided QR code to link it to their own account securely.
What happens to the organization's documents when the old administrator's account is deleted?
If documents were saved in the old administrator's personal OneDrive, they may be lost when the account is deleted. To prevent this, always store official association records and handover documents in a centralized SharePoint site and document library with permissions granted to the new administrator.
