About Global Administrators
Global Administrator is a role assigned within the Microsoft 365 admin center (Entra), not directly within Business Central itself. This role grants comprehensive administrative privileges across all Microsoft 365 services, including Business Central.
Specifically, a Global Administrator can manage user accounts, assign licenses, configure service settings, and oversee security and compliance features.
It is the responsibility of the Customer’s Global Administrator to create users in Entra and assign licenses to the users.
Security Guidelines for Assigning Roles
Because admins have access to sensitive data and files, we recommend that you follow these guidelines to keep your organization's data more secure.
Recommendation | Why is this important? |
Have as few global administrators as possible | Global Admins have almost unlimited access to your organization's settings and most of its data. We recommend you limit the number of Global Admins as much as possible. A Global Admin may inadvertently lock their account and require a password reset. Either another Global Admin or a Privileged Authentication Admin can reset a Global Admin's password. Therefore, we recommend you have at least a Privileged Authentication administrator in the event a Global administrator is locked out of their account. |
Require multi-factor authentication for admins | It's actually a good idea to require MFA for all of your users, but admins should definitely be required to use MFA to sign in. MFA makes users use a second method of identification to verify their identity. Admins can have access to much of customer and employee data. If you require MFA, even if the admin's password gets compromised, the password is useless without the second method of identification. |
The Customer must appoint minimum one (1) but preferably two (2) Global Administrators for Business Central.
Giving too many users global access is a security risk and we recommend that you have as few global admins as possible.
Only global admins can:
Reset passwords for all users
Add and manage domains
Unblock another global admin
Access all Microsoft account/services with full privileges.
Create support tickets for the Partner Center.
View agreements, price lists, and offers.
Do billing.
View, create, and manage partner users.
Purchase and manage cloud services.
Note: The person who signed up for Microsoft online services automatically becomes a Global admin. So, if you are the person who purchased the Microsoft business subscription, you are the global admin. Additionally, only Global admins can view and manage subscriptions purchased through a Partner.
Find and Become the Global Admin
Find your company’s Global Admin
Use the following steps to find your company's Global admin.
Sign in to Partner Center and select Settings (gear).
Select Account settings, and then select User management.
In the search box, filter on Global admin. A list of Global admins in your company appears.
Add More Global Admins
Prerequisite: You must be a global admin to follow these guidelines. Only Global Admins can make others Global Admins.
Use the following steps to add more Global admins
Sign in to Partner Center and select Settings (gear).
Select Account settings, and then select User management.
In the search box, enter the username of the requestor.
Click on the link in the table that matches the requestor.
On the User details screen check the box for "Manage your organization's account as" and select "Global Admin"
Click Update
If your company doesn't yet have a Global admin, anyone who wants to become the Global admin can follow the instructions at Microsoft Entra ID tenant admin takeover.
What to Do When the Global Admin is No Longer Available?
If the global admin of your Microsoft services (such as Microsoft 365 or Azure) has quit the company, and no one else currently has Global Administrator rights, you’ll need to regain access and assign a new global admin. The steps vary depending on whether anyone else has admin access.
Scenario 1: You still have access through another Global Admin
If another user has Global Admin rights
Sign in to the Microsoft 365 Admin Center
Go to: https://admin.microsoft.com
Go to Users > Active Users
Find the user you'd like to promote to Global Admin.
Edit their roles
Click on the user.
Under Roles, click Manage roles.
Select Global Administrator, then click Save changes.
Scenario 2: No Global Admins are available
If the only Global Admin has left and there are no other admins, follow these steps:
Step 1: Try to access the former admin's email
If possible, reset the password of the former admin account (e.g., through your organization's identity provider or email admin).
Use that account to sign in and assign a new Global Admin.
If that’s not possible:
Step 2: Submit a Microsoft Admin Takeover Request
Microsoft allows for tenant recovery in case of admin abandonment. Here's how:
Go to the Admin Takeover Support page
Visit: https://support.microsoft.com/en-us/admin
Choose “Contact Support”
Explain the situation: your only Global Admin has left and no one can access their account.
Microsoft will verify your identity and ownership of the domain.
Be ready to provide:
Proof of domain ownership (via DNS records).
Business registration documents (in some cases).
Your company email under the same domain.
Verify domain ownership
Microsoft may ask you to add a TXT record to your domain's DNS settings to confirm control.
Step 3: Assign a New Global Admin After Verification
Once access is restored:
Sign in to the Admin Center.
Assign at least two Global Admins to prevent future lockouts.
References
"About Admin Roles in the Microsoft 365 Admin Center." Microsoft Learn, Microsoft, https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles .
"Become a Global Admin for Your Company." Microsoft Learn – Partner Center, Microsoft, https://learn.microsoft.com/en-us/partner-center/become-global-admin .
"How Can I Recover Access to a Microsoft Tenant That No Other Administrator Has Access To?" Microsoft Q&A, Microsoft, https://learn.microsoft.com/en-us/answers/questions/2154071/how-can-i-recover-access-to-a-microsoft-tenant-tha .