Give us Microsoft 365 admin access
How to safely grant our team administrative access to Microsoft 365 (Office 365) to configure domain DNS and ensure email deliverability.
If your business uses Microsoft 365 for professional email and collaboration, we may need administrative access to configure your domain's DNS records, authenticate your email deliverability (SPF/DKIM/DMARC), or assist with a website-to-email migration.
Step-by-step instructions
Log in to the Admin Center. Go to admin.microsoft.com and sign in with your administrator credentials.
Navigate to Users. In the left-hand menu, click Users, then select Active users. (If the top of the admin center says Simplified view rather than Dashboard view, you'll see an Add user button on the page instead.)
Add a new user. Click the Add a user button.
Set up our account. Fill out the basics with:
- First Name: Chykalophia
- Last Name: Support
- Username: Create something functional like
webmaster,admin, orit-supportat your domain.
Configure the password. Microsoft selects Automatically create a password and Require this user to change their password when they first sign in by default. Clear both boxes and type a strong, custom password instead, so our team doesn't hit a password-reset loop. See our guide to strong passwords.
Assign the license. Assign a product license if email access is required. If we only need access to the admin settings rather than a mailbox, you can leave the account without a product license.
Assign Admin roles. On the Optional settings step, expand the Roles section and choose the admin role your project lead asked for. Microsoft's own advice is to assign the least permissive role that covers the job, so for mail and deliverability work that's usually Exchange Administrator rather than Global Administrator.
Finish and share securely. Review and finish creating the user. Then, use a secure link tool like Onetime Secret to send us the password. See our guide on sharing passwords safely.
Go easy with Global Administrator
Microsoft describes Global Administrator as a highly privileged role and advises limiting it to emergency scenarios, or to cases where no other role can do the job. Most website and email work has a narrower role that covers it. If your project lead does ask for Global Administrator, expect it to be temporary, and revoke it when the work is done.
Common questions
Which admin role do you need?
It depends on the work. Configuring mailboxes, Microsoft 365 Groups and Exchange Online settings is covered by the Exchange Administrator role. Adding, changing or removing a domain inside Microsoft 365 needs the Domain Name Administrator role. Your SPF, DKIM and DMARC records themselves are DNS records, so some of that work happens wherever your DNS is hosted rather than inside Microsoft 365. Your project lead will tell you the smallest role that covers your project.
Can you read my company's private emails?
An administrator with mailbox permissions can technically grant themselves access to a mailbox, which is exactly why we ask for the narrowest role that does the job. We operate with strict security and privacy protocols: we only access the domain and Exchange settings we need, never individual user mailboxes.
Related guides
Learn more
Was this page helpful?
Go deeper on chykalophia.com
Need a hand?
Stuck? We'll help.
Email us with your website address and a screenshot if you can, and we’ll take it from there.
Last updated