What the User Administrator role actually grants
Per the Microsoft Entra role reference, the User Administrator role grants the following on non-administrator users:
- Create and delete users
- Update user properties (name, title, manager, etc.)
- Reset passwords (for non-admins by default)
- Update passwords for limited admin roles
- Manage user licenses
- Manage group membership (security + Microsoft 365 groups)
- Manage group properties (name, description, etc.)
- Read all user, group, contact, and device properties
- Invalidate user refresh tokens (force re-authentication)
- Manage service requests + monitor service health
What it doesn't grant (Microsoft updated these defaults in 2024 to fix earlier privilege-escalation gaps):
- Cannot reset passwords for users in protected admin roles (Global Admin, Privileged Role Admin, etc.) by default
- Cannot modify Conditional Access policies, app registrations, or anything in Microsoft Entra ID Protection
- Cannot create role-assigned groups or assign roles to others
- Cannot modify billing, subscriptions, or domain settings
- Cannot manage cross-tenant access or partner relationships
For the routine user-management work HR or an office manager typically does — new hires, password resets, license changes, group membership — the permission set is fine. The problem isn't what's permitted. It's what the delegate sees when they sign in.
The UI surface problem
When you assign the User Administrator role to HR, the next time they sign in to admin.microsoft.com, they land in the full Microsoft 365 Admin Center. That UI shows:
- The full left-rail navigation: Users, Teams & groups, Billing, Setup, Reports, Health, Marketplace, plus every Microsoft service icon (Exchange, SharePoint, Teams, Entra, Intune, Defender, Purview, etc.)
- The Settings → Org settings panel — 60+ toggles covering search, reports, calendar, mail, modern auth, partner relationships
- Service health and incident reports for the entire tenant
- Domain configuration (read-only but visible)
- The Marketplace, where they can request apps for the tenant
- Direct links into Microsoft Entra (where role assignments live)
Most of those panels return permission errors when HR tries to change anything, but the buttons are right there. Plenty are actionable enough to be confusing — Service Requests can be opened, marketplace apps can be reviewed, user reports can be exported. None are things HR needs. All add up to a UI that looks like "do not touch" to someone whose job is elsewhere.
What about Custom RBAC roles? Microsoft Entra supports custom roles with granular permission scoping. They address the permission side of the problem — you can limit a role to specific actions and even scope to Administrative Units (similar to OUs in Active Directory). They don't address the UI side: the delegate still lands in the same broad admin center, just with more things greyed out. Custom RBAC adds complexity without improving the user experience for the HR / office-manager delegate.
Side-by-side comparison
Same delegate. Same daily work (reset password for Adele, create account for new hire, add user to Sales team). Two different ways to expose it.
| Feature | User Admin role + Admin Center | UserDesk |
|---|---|---|
Cost | Free (included with M365) | $79/mo Starter, $149/mo Pro per tenant |
Permission scope What actions the delegate can perform | Users (non-admin), groups, licenses | Users, groups, licenses, shared mailbox conversion |
UI surface exposed to delegate What they actually see on screen | Full M365 Admin Center (60+ panels) | Focused portal: users list + scoped actions only |
Risk of misclick affecting the tenant | Real — Conditional Access, Org Settings, service requests all reachable from nav | Near-zero — those surfaces aren't exposed at all |
Per-delegate audit ('what did Sarah do?') | Requires unified audit log query | Built-in per-delegate view in the portal |
Onboarding templates (pre-fill new hire setup) | No | Yes |
Mobile experience | Functional, not designed for it | Built mobile-first (HR is often on a phone) |
Scoping to specific departments / OUs | Only via Custom RBAC role + Administrative Units | Three role tiers; scope by group not yet native |
Delegate setup time | 1 min in Entra → assign role to user | 2 min admin consent + share portal link |
Microsoft-supported | Yes | Built entirely on Microsoft Graph + OAuth |
Comparison verified
The audit problem in detail
One question every IT director eventually asks: "What did HR do this week?" With the User Administrator role + Admin Center, the answer involves the unified audit log.
The unified log is real and queryable. It captures every action across the tenant — Entra changes, Exchange operations, SharePoint activity, all of it. You can filter by user, by activity type, by date range. It's a powerful tool. It's also not built for "quick weekly check on what HR touched."
To answer that question via the unified log, you:
- Open Microsoft Purview (or the legacy audit log search)
- Set date range
- Filter by the HR person's UPN
- Filter by activity types you care about
- Run the query, wait for results (sometimes minutes)
- Export to CSV if you want a clean view
- Skim through entries that include Office app activity (Word open, Outlook email read, etc.) — there's no built-in "just admin actions" filter without crafting one yourself
UserDesk solves this differently: there's a per-portal audit log built into the UI showing only the actions taken through the portal, with who/what/when in plain English and export-as-CSV. "What did Sarah do this week?" is a 10-second filter on her name. That's not a knock on Microsoft's tooling — Purview is meant for security teams doing comprehensive audits, not for routine delegate review. They're solving different problems.
When the User Administrator role is enough
Stick with User Administrator + Admin Center when your delegates are IT-fluent.
The native role + admin center is the right answer when:
- Your delegates are helpdesk technicians, junior IT, or anyone comfortable with the M365 admin interface
- You're happy crafting Custom RBAC roles + Administrative Units to scope by department
- Per-delegate audit isn't a routine concern — you trust the delegates and don't need a quick weekly review
- You're a one-person IT team handling everything yourself
- The budget genuinely can't absorb $79/mo for a third-party tool
It's free, it's Microsoft-supported, and for the right delegate it works exactly as designed.
When UserDesk fills the gap
Use UserDesk when the delegate is HR, an office manager, or a team lead.
The signal you need a focused tool:
- The delegate's job isn't IT — they're in HR, operations, office management, or department leadership
- You've trained them on the Admin Center and they still find it confusing or accidentally click things
- You want a clean weekly view of what each delegate did without a Purview query
- Onboarding templates would save real time (Sales Rep gets X licenses + Y groups + Z department, every time)
- The delegate works from a phone often — HR doing a quick password reset while away from a desk is common
- You want to limit the surface area of risk — no path from "HR resets password" to "HR accidentally changes Org Settings"
The ROI math at $79/mo: if the tool saves 1 hour/week of your time (the IT person who otherwise handles the routine ticket), at a $80/hr loaded cost that's $320/mo of value for $79 spent. The real win is usually larger — the interruption-driven workday going away matters more than the dollar count.
What about Helpdesk Administrator?
Helpdesk Administrator is the narrower native role: reset passwords + invalidate refresh tokens, for non-admins only. It's the right call when you only need password reset delegation and nothing else — but you still face the same UI surface problem (the delegate lands in the full Admin Center).
If password reset is the entire workflow, Helpdesk Admin works. The moment you also want new-hire creation, license assignment, or group membership management, you're back to User Administrator and the broader UI question.
Frequently asked questions
Q01Can I scope the User Administrator role to specific OUs or departments?
Yes, via Custom RBAC roles in Microsoft Entra combined with Administrative Units. You create a custom role with the specific permissions you want (e.g. just password reset + license management), then assign it scoped to an Administrative Unit containing the users in that department. The permissions are properly scoped. The UI surface still shows the full Admin Center — the delegate sees everything but can only act within the AU. Right answer when permission scoping is the goal and the broad UI doesn't bother you.
Q02What's the difference between User Administrator and Helpdesk Administrator?
Helpdesk Administrator is narrower: reset passwords + invalidate refresh tokens for non-admins. User Administrator adds creating/deleting users, managing user properties, managing groups, managing licenses. If your workflow is purely password resets, Helpdesk Admin is the cleaner answer. If it includes new-hire setup or group management, User Admin is required.
Q03Can a User Administrator reset Global Admin passwords?
Not by default. Microsoft updated the role in 2024 to prevent privilege-escalation by default — User Administrators cannot reset passwords for users holding protected admin roles (Global Admin, Privileged Role Admin, etc.) unless explicitly granted. This is a good security default; it means a compromised User Admin account can't easily take over the tenant.
Q04Will UserDesk conflict with my existing User Administrator role assignments?
No. UserDesk is additive. Your Microsoft 365 admin role assignments keep working exactly as configured. UserDesk uses delegated OAuth permissions scoped to whoever's signed into the portal — it doesn't modify, read, or rely on the user's M365 admin role. If you want to remove the User Administrator role from HR after switching to UserDesk, you can; UserDesk doesn't need it.
Q05Does the User Administrator role include Microsoft Teams admin actions?
Partially. User Administrator can manage Microsoft 365 group membership (which underlies Teams membership) but it does not include the Teams Administrator role's policy-level powers — Teams calling policies, meeting policies, channel settings at the org level. For Teams-specific delegation, the Teams Administrator role is the native answer. UserDesk covers Teams + Distribution List membership at the user-management level, which is what HR typically needs.
Q06How do I revoke User Administrator if I'm switching to UserDesk?
Microsoft Entra → Roles & administrators → User Administrator → find the user → Remove assignment. Effect is immediate; they lose admin center access on next sign-in. UserDesk continues working independently because it doesn't depend on the M365 admin role at all.
Try it
Free 14-day trial — no card
Connect your Microsoft 365 tenant in 2 minutes. Hand the portal to HR or your team leads. Cancel any time.
Free checklist
M365 Delegation Checklist
What to delegate, what to keep, and how to set it up without breaking your tenant.