English

Home > Get Started > Permissions for Service Account > Service Account Permissions for Microsoft 365 Management

Service Account Permissions for Microsoft 365 Management

Management	Feature	Service Account Permission	Why we need it?
Users	Block users with the Global Administrator role from signing in	Global Administrator	The Global Administrator role is required for service account when calling the API.
Users	Invite users individually or in bulk	Global Administrator	The Global Administrator role is required for service account when calling the API.
Users	Delete users and permanently delete users	User Administrator	The User Administrator role is required for service account when calling the API.
Users	Block user sign-in	User Administrator/Authentication Administrator	The User Administrator and Authentication Administrator is required for service account when calling the API.
Users	Restore deleted users	User Administrator/Global Administrator	The User Administrator role is required for service account when calling the API.To restore deleted users with specific administrative roles, a Global Administrator role is required for service account when calling the API. For more details, refer to Who can perform sensitive actions.
Users	Update user profile and phone numbers	User Administrator/Authentication Administrator/Global Administrator	The User Administrator and Authentication Administrator role is required for service account when calling the API.To update profile and phone numbers for users with specific administrative roles, a Global Administrator role is required for service account when calling the API. For more details, refer to Who can perform sensitive actions.
Users	Reset user passwords	Password Administrator/Global Administrator	The Password Administrator role is required for service account when calling the API.To reset passwords for users with specific administrative roles, a Global Administrator role is required for service account when calling the API. For more details, refer to Who can perform sensitive actions.
Exchange	Update mail users’ phone numbers	Global Administrator	The Global Administrator role is required for service account when calling the API.
Teams	View and update Teams sensitivity	Groups Administrator	The Groups Administrator role is required to call API.
Teams	Access the Call quality report	Teams Administrator	The Teams Administrator role is required to call specific APIs.
Teams	Archive Teams and update the associated SharePoint Online site to read-only status for Team members	Teams Administrator	The Teams Administrator role is required to call specific APIs.
Groups	Manage sensitivity labels for Microsoft 365 Groups	Groups Administrator	The Groups Administrator role is required for service account when calling the API.
Groups	Delete or permanently delete Microsoft 365 Groups and security groups	Groups Administrator	The Groups Administrator role is required for service account when calling the API.
Groups	Restore deleted Microsoft 365 Groups	Groups Administrator	The Groups Administrator role is required for service account when calling the API.
SharePoint	Manage SharePoint sites, including:Create Group team sitesConnect sites to new Microsoft 365 GroupsUpdate hub settings for sites in multi geo tenants	SharePoint Administrator	The SharePoint Administrator role is required to call rest API and CSOM API.
SharePoint	Create sites with the Visio Process Repository template	Global Administrator	Sites with these two templates are not available to be created with app profiles or service accounts with the SharePoint administrator role.
OneDrive	Pre-provision OneDrive with workflows	SharePoint Administrator	The SharePoint Administrator role is required to call CSOM API.

The following service account permissions can now be replaced by permissions assigned to app profiles. To switch to app profile usage, refer to Quick Start Setups.

EnPower Functionality	Service Account Permission	App Profile Permission(Microsoft Graph API)
Block user sign-in	Authentication AdministratorUser AdministratorGlobal Administrator	User.ReadWrite.All(Read and write all users' full profiles)
Update user profile and phone numbers	Authentication AdministratorUser AdministratorGlobal Administrator	User.ReadWrite.All(Read and write all users' full profiles)
Update users’ MFA settings	Authentication AdministratorGlobal Administrator	UserAuthenticationMethod.ReadWrite.All(Read and write all users' authentication methods)
Update users’ MFA settings	Authentication AdministratorGlobal Administrator	Policy.ReadWrite.AuthenticationMethod(Read and write all authentication method policies)
Invite users	Global Administrator	User.Invite.All(Invite guest users to the organization)
Reset user password	Global AdministratorPassword Administrator	User.ReadWrite.All(Read and write all users' full profiles)
Delete users or permanently delete users	User Administrator	User.ReadWrite.All(Read and write all users' full profiles)
Restore deleted users	User Administrator	User.ReadWrite.All(Read and write all users' full profiles)
Restore deleted users	User Administrator	User.DeleteRestore.All(Delete and restore all users)
Manage sensitivity labels for Teams and Microsoft 365 Groups	Groups Administrator	Group.ReadWrite.All(Read and write all users' full profiles)
Delete or permanently delete Microsoft 365 and security Groups	Groups Administrator	Group.ReadWrite.All(Read and write all groups)
Restore deleted Microsoft 365 Group	Groups Administrator	Group.ReadWrite.All(Read and write all groups)
Create Group team sites	SharePoint Administrator	Group.Create(Create groups)or Group.ReadWrite.All (Read and write all groups)
Create Group team sites	SharePoint Administrator	Sites.ReadWrite.All(Read and write items in all site collections)
Archive Teams and update the associated SharePoint Online site to read-only status for Team members	Teams Administrator	TeamSettings.ReadWrite.All(Read and change all teams' settings)