How to Give HR Microsoft 365 Access Without Compromising Security

The question lands in IT's inbox in some variant of this:

"HR needs to be able to create new hire accounts, reset passwords, and update employee details in M365. What's the right way to give them access without compromising security?"

The wrong answers are easy to spot: give them Global Admin (catastrophic blast radius), grant them User Administrator (still too broad — they can reset other admins' passwords, manage all tenant users, modify any group), or just keep saying "file a ticket" (preserves security, kills HR's velocity and IT's roadmap).

The right answer is a delegation layer that lets HR do exactly what they need — onboard, offboard, reset passwords, manage memberships — through a focused interface, with operations constrained by templates and roles, every action recorded in an immutable audit log. Here's how to build that out without compromising any of the security properties IT cares about.

The four security requirements

Any "give HR access" pattern has to satisfy four properties or it's not security-correct:

1. Scope of action. HR can do specific operations (create user, reset password, assign license from approved set, manage memberships in approved groups). They cannot do anything else. The system enforces this, not policy.

2. Scope of audience. HR works with the users they're responsible for — typically all non-admin users, sometimes scoped to specific departments. They cannot reset other admins' passwords. They cannot modify the IT team's accounts. They cannot escalate themselves to higher access.

3. Audit by default. Every action they take is recorded with actor, target, timestamp, and parameters. The log is immutable — nobody can edit or delete entries, including IT admins. The log is reviewable by non-technical compliance staff.

4. Revocable in one click. When HR turnover happens, the departing employee's access goes away the moment IT updates the portal. No PowerShell cleanup, no Entra ID role hunt, no lingering tokens. The next person stepping into the HR role gets a fresh access grant.

Microsoft's built-in roles satisfy these properties partially but never completely. We covered the gaps in detail in Microsoft 365 Admin Roles Explained and Why the User Administrator Role Is the Wrong Answer for HR Delegation. The short version: the built-in roles assume the role-holder is an IT pro using the admin center. HR is not, and shouldn't be.

The architecture that satisfies all four

A delegation layer that wraps the Microsoft Graph API. Operations the delegate can perform are constrained by their portal role (Admin / Member / Viewer), not by their Entra ID role. The delegate authenticates with their normal Microsoft account; the portal calls Graph on their behalf using their OAuth token.

The flow:

HR signs in with their normal Microsoft account
  → portal grants them "Member" role based on portal-internal assignment
  → portal shows them: user list (their scope only), templates, reset password, manage groups
  → portal hides everything else: billing, security settings, other admins, role management
HR creates a new hire from a Sales template
  → portal calls Graph: POST /users, POST /users/{id}/assignLicense, POST /groups/{id}/members
  → all three calls use HR's token (delegated permissions)
  → all three results recorded in immutable audit log
  → temp password shown once on HR's screen
HR signs out
  → token expires per Microsoft's normal flow (~1 hour)
  → no standing access for the portal or for HR

This satisfies:

• Scope of action: HR can call the operations the portal exposes (create from template, reset password, manage memberships). They cannot call anything else, because the portal doesn't expose anything else. Even if they had higher Entra ID role permissions, the portal interface doesn't surface those operations.

• Scope of audience: configured at the portal-role level. The "Member" role can manage users matching the scope you've set (typically: all non-admin users). Admin-tier users are filtered out of the lists HR sees.

• Audit by default: every Graph call goes through the portal, every call gets logged. The log is structured for human review, not KQL queries. Compliance can scan it without IT's help.

• Revocable in one click: removing the HR coordinator from the portal removes their access. Token expiry handles in-flight sessions; no future tokens issue without the portal grant. There's nothing for IT to remember to clean up elsewhere.

Implementation: the day-one rollout

For an IT team going from "HR files tickets" to "HR self-serves through a delegation portal":

Step 1: Pick the operations to delegate. The minimum useful set is: create user from template, reset password, assign/remove license, add/remove group memberships. Most orgs roll out create + reset + license first, add groups in a second wave.

Step 2: Build templates for the most common roles. New Sales Rep, New Customer Support, New Contractor. Each template locks down department, title, license SKUs, and starting groups. HR can use the templates; they can't bypass them to assign random licenses or add people to sensitive groups.

Step 3: Grant admin consent once. A Global Admin clicks through the consent flow for the delegation portal, granting it the Graph permissions it needs (typically User.ReadWrite.All, Directory.ReadWrite.All, Group.ReadWrite.All, UserAuthenticationMethod.ReadWrite.All). One click. ~60 seconds.

Step 4: Assign HR the Member role in the portal. Through the portal's own role-management screen — not Entra ID. HR signs in for the first time, the portal sees they don't yet have a role, IT (or another portal Admin) approves them.

Step 5: Pilot with one HR coordinator on one team. Sales is a good first pilot because the templates are typically simplest. Run for two weeks. Iterate on the templates based on what doesn't fit cleanly.

Step 6: Expand. Other HR staff, other departments, other operations (group memberships, license adjustments) get added incrementally.

Total elapsed time for the first pilot: typically 2-4 hours of IT work spread over a week. The big time-sink is template design; the technical setup is a few clicks.

What you give up — and what you don't

You give up: the false security of "HR can't do anything because they don't have admin access." That security was always partially fictional anyway, because the people who needed to do M365 work either got admin access through pressure (becoming the over-permissioned Global Admins we warned about) or stayed unable to do their jobs (and you spent the cost on IT-handled tickets we estimated here).

You don't give up:

• Any Entra ID security policy. Conditional access, MFA, sign-in risk policies, all continue to apply to HR's logins exactly as before.
• Any compliance position. The audit log is strictly better than what you had with shared admin accounts or User Administrator grants.
• Any rollback capability. Disable the portal, the operations stop. Revoke admin consent, the portal can't call Graph anymore.
• Control over what HR can do. The portal's role model is more granular than Entra ID's, not less.

The 90-day metric

After 90 days of the rollout, the metrics you should expect (based on what we see in production for orgs in the 50-500 employee range):

• Password reset tickets to IT: down 60-90%
• New-hire onboarding elapsed time: down from 1-3 days to 1-2 minutes
• Global Admin count: down from 4-8 to 2 (the break-glass accounts)
• IT engineer time freed: 1-6 hours per week, redirected to actual roadmap work
• HR satisfaction with IT response: measurably higher, because IT is no longer the bottleneck

These aren't aspirational numbers. They're what the math works out to when you remove the friction layer.

The honest caveat

A delegation portal isn't free. It's $59-99/month for an SMB-sized tenant. For very small orgs (under 25 users) where IT only handles 1-2 user operations per month, the math may not justify the tool — you're better off just keeping the workflow in IT.

For everyone else — the SMB band where HR is involved in routine M365 ops and IT is over-permissioned to compensate — the security argument and the cost argument both point the same direction. We laid out the full provisioning-approach comparison in Microsoft 365 User Provisioning: 4 Approaches Compared if you want to verify the delegation pattern fits your specific situation.

UserDesk for M365 is built for this exact rollout. Single admin consent, focused interface for delegates, immutable audit log, OAuth-based with no stored credentials. 14-day trial, no credit card required.

See the HR-delegate view: interactive demo at /demo. Click through what HR sees — and crucially, what they can't see. No signup. 2 minutes.