of the
Back in Tip 276 we talked about the challenges of administering CRM Online/Dynamics 365 without being a global admin. There really hasn’t been a good answer for companies that don’t want their deployment admin to be a global administrator.
The good news is this has changed with the introduction of the Dynamics 365 Service Admin role. This new Office 365 role allows you to grant users permission to administer Dynamics 365 tenants without having to be an Office 365 administrator. Users with the Dynamics 365 Service Admin role can perform the following tasks:
- Configure new instance
- Backup and restore
- Sandbox copy
- Approve email addresses
- Create and access support requests
- Access the service health
- Access message center
You can also restrict Dynamics 365 Service Admins to specific organization instances by assigning a security group for which the admin is not a member to the instances you do not want them to access. Also, Dynamics 365 Service Administrators do not consume a Dynamics 365 user license.
While this will be welcome news for many, keep in mind that you still have to be nice to your Office 365 Global Admin, as you will still need him or her to:
- Test and enable mailboxes
- Add licenses to users
- Access service settings for other Office 365 apps, like SharePoint or Exchange.
For more details see “Use the Dynamics 365 Service admin role to manage your tenant” on TechNet.
Approve email addresses is huge. One of the biggest complaints and certainly a head scratcher, this task can now be offloaded to a CRM Administrator who would be adding the user’s security role anyway. If there was only a way to add license with that role, but that doesn’t have to be a global admin either.