Summary

Somebody handed you Global Administrator rights to your business's Microsoft 365 subscription, and the portal looks like a spacecraft cockpit. It is not. About six tasks account for nearly everything a small-business owner ever does in there. This guide names the areas that matter, tells you which ones you will use in a normal month, and marks the handful you want to research before touching.

In this guide

• 1. Getting there, and what you are looking at
• 2. The five areas you will actually use
• 3. The main admin center versus the specialist portals
• 4. The six tasks that make up almost everything
• 5. Message center and Service health, and why to check them
• 6. The areas to leave alone until you have read up
• 7. Set up a second Global Administrator today

Before You Start

• An account with Global Administrator rights. If you signed up for the subscription yourself, that is you.
• No prior IT experience assumed. Every term below is explained the first time it appears.

Instructions

1. Getting there, and what you are looking at

Go to admin.microsoft.com and sign in with your work account. Bookmark it — the address is not something you will remember when you are in a hurry.

If you sign in and land on a normal Outlook or Office page instead of a dashboard, your account does not hold admin rights. The Admin tile in the app launcher (the grid of dots in the top-left corner) only appears for accounts that have them.

The first thing to do is fix the navigation. By default, the left sidebar hides most of itself.

Click Show all at the bottom of the left navigation. The list expands to show every section, including Settings, Reports, and Health. Leaving it collapsed is why most owners believe a feature is missing when it is one click away.

Across the top of the home page you see cards Microsoft chose for you — a Setup progress score, a billing summary, a service health tile. You can drag and remove these. Nothing on the home page is load-bearing; everything real lives in the left navigation.

One word to learn, because Microsoft uses it constantly: your tenant is your company's own private area of Microsoft's cloud. Your users, mailboxes, files, and subscription all live inside it. When an article says "your tenant", it means "your company's Microsoft 365".

2. The five areas you will actually use

There are more sections than this. These are the ones a small-business owner opens.

Users — the list of every person in your business, and the section you will use most. Users > Active users shows everyone with an account. Clicking a name opens a panel on the right with tabs for their Account, Devices, Licenses and apps, and Mail. This is where you add someone, remove someone, reset a password, change a display name, or check what you are paying for on their behalf. Users > Deleted users holds anyone removed in the last 30 days.

Billing — what you pay and what you get for it. Billing > Your products lists your subscriptions and is where you add or remove seats. Billing > Licenses shows assigned against total, which is how you catch seats you are paying for and nobody is using. Billing > Bills & payments holds downloadable invoices for your accountant and your saved card details. Check the Licenses page once a quarter; it is the most common place small businesses quietly overspend.

Teams & groups — despite the name, this is not only about Microsoft Teams. Teams & groups > Active teams and groups lists distribution lists, Microsoft 365 groups, and the SharePoint sites attached to them. More importantly, Teams & groups > Shared mailboxes is where you create addresses like info@ and accounts@ that several people share and nobody pays a license for.

Settings — organisation-wide configuration. Two pages matter. Settings > Domains is where you add your business domain and where you check whether your mail records are still healthy. Settings > Org settings holds your company name, the address that appears on invoices, your release preferences, and per-service switches such as whether people can share files with outsiders. Everything else on this page is a preference you can leave at its default indefinitely.

Health — is it me, or is it Microsoft? Health > Service health shows whether Exchange, Teams, SharePoint, or sign-in are currently degraded, with a status and a running commentary from Microsoft's engineers. Check it before you spend an hour troubleshooting. Health > Message center is covered in its own section below.

3. The main admin center versus the specialist portals

Microsoft splits administration across several portals. The main admin center handles everyday tasks; the specialist portals handle the deep settings. You get moved between them automatically when a task needs it, which is disorienting the first time it happens.

Portal	Address	What it is genuinely for	How often you need it
Microsoft 365 admin center	admin.microsoft.com	Users, licenses, billing, shared mailboxes, domains, service health	Weekly
Exchange admin center	admin.exchange.microsoft.com	Mail flow rules, mailbox permissions, quarantine, forwarding, out-of-office set by an admin	A few times a year
Teams admin center	admin.teams.microsoft.com	Meeting policies, calling plans, phone numbers, guest access rules	Rarely
Microsoft Entra admin center	entra.microsoft.com	Sign-in security, multi-factor authentication, Conditional Access, app permissions	At setup, then rarely
SharePoint admin center	Reached from Show all > SharePoint	Site storage limits, external sharing defaults, site creation policies	Rarely

The practical rule: start in the main admin center every time. If the setting you want is not there, it is in one of the others, and searching for it in the admin center's search bar at the top of the page usually links you straight across.

Three of these have older names you will meet in support articles and forum answers. Microsoft Entra ID was called Azure Active Directory or Azure AD until 2023. The Exchange admin center is often shortened to EAC. Both refer to what is described above.

4. The six tasks that make up almost everything

Nearly every visit you make to the admin center is one of these.

Add a person. Users > Active users > Add a user. Fill in the name and username, assign a license, finish. The mailbox exists within about 15 minutes. Full walkthrough: How to Add or Remove Users in Microsoft 365 Admin Center.

Remove a person. Same list, click their name, then the Delete user icon at the top of the panel. The wizard offers to hand their OneDrive files to someone else and to convert their mailbox into a shared mailbox so incoming mail keeps arriving. Take both offers. Tick the box that removes their license, or you keep paying for an empty seat every month.

Reset a password. Users > Active users, hover over the person's row, and click the key icon that appears — or open their panel and click Reset password. You can auto-generate a password or set one, and choose whether they must change it at next sign-in. This is the single most common thing an owner does in the admin center. It is also the task worth removing from your plate entirely with How to Set Up Self-Service Password Reset (SSPR).

Assign or unassign a license. Open the person, click the Licenses and apps tab, tick or untick the subscription, click Save changes. Unassigning frees the seat for someone else but does not reduce your bill — for that you go to Billing > Your products and lower the quantity you are buying. That distinction catches nearly everybody once. How to Manage Microsoft 365 Subscriptions and Billing covers it properly.

Create a shared mailbox. Teams & groups > Shared mailboxes > Add a shared mailbox. Name it, give it the address, then add members. It costs nothing, holds up to 50 GB, and replies go out from the shared address rather than the person who typed them. See How to Set Up a Shared Inbox for a Small Business.

Restore a deleted user. Go to Users > Deleted users, select the person, and click Restore user. You have 30 days from deletion — after that the account and its mailbox are gone permanently and Microsoft cannot bring them back. Restoring returns the account and its mailbox, but you have to reassign the license yourself.

Note: That 30-day window is the reason to pause before deleting someone in a hurry. If you are unsure, block their sign-in instead — open their panel, click Block sign-in, and their access stops immediately while everything stays recoverable.

5. Message center and Service health, and why to check them

These two live under Health and they answer different questions.

Service health answers "is it broken right now?". It lists every Microsoft 365 service with a status: Healthy, Advisory, or Incident. When Outlook will not send for three people at once, this page tells you in ten seconds whether the problem is yours. Each active issue has an ID (something like EX123456), a plain description, and updates as Microsoft works on it. If your issue is listed there, stop troubleshooting and tell your team the timeline — What to Do When Microsoft 365 Is Down covers how to keep working through an outage.

Message center answers "what is Microsoft about to change?". It is a rolling feed of upcoming changes to features you use — a button moving, a policy default changing, an old feature being retired. Most entries are irrelevant to a five-person business. The ones that matter carry an Act by date and describe something that will stop working.

Reading every Message center post is a waste of your time. A workable habit: open it once a month, sort by the Act by column, and read anything with a date in the next 90 days. You can also set it to email you a weekly digest — click the gear icon on the Message center page, then Preferences, and choose Email.

Tip: When something breaks and Service health says everything is healthy, the problem is local — one person's app, one device, or one mailbox. That is a genuinely useful signal, not a dead end. It tells you to stop looking at the service and start looking at the machine.

6. The areas to leave alone until you have read up

Nothing here is forbidden. These are the settings where a five-second click has consequences that take days to unwind, so read before you change them.

• Exchange admin center mail flow rules. These silently redirect, block, or rewrite mail for the whole business. A misconfigured rule loses messages without an error anywhere. If you need one, write down exactly what you expect it to do first, then test with your own address.
• Deleting a domain in Settings > Domains. Removing a domain breaks every mailbox and sign-in that uses it. Domains are added far more often than they need removing.
• Conditional Access policies in Entra. These decide who can sign in, from where, and on what. A policy that excludes nobody can lock every account out of the tenant, including yours. Microsoft offers a Report-only mode for exactly this reason — always run a new policy in report-only for a week first.
• External sharing defaults in the SharePoint admin center. Turning sharing off entirely breaks every link you have already sent to clients. Turning it fully open exposes files to anyone with a URL.
• Data loss prevention and retention policies. Retention policies in particular can prevent deletion for years, which is exactly what they are for and exactly what surprises people. Set them deliberately or not at all.
• Removing your own admin role. Changing your own account's roles while signed in as that account is how people lock themselves out. Make the change from a second admin account instead.

The general shape of the risk: settings that affect one person are safe to experiment with, because you can undo them for that person. Settings that affect the whole organisation — mail flow, domains, sign-in, retention — deserve five minutes of reading first.

If you find yourself in this list often — needing a mail flow rule, being asked for a security review by a client, or losing hours a week to things nobody else can do — that is the boundary of running IT yourself, and it is worth pricing rather than pushing through. Understanding When to Hire IT Help for Your Small Business covers the arithmetic, the five shapes outside help comes in, and the two contract traps to check before you sign anything.

7. Set up a second Global Administrator today

This is the strongest recommendation in this guide, and it takes four minutes.

If you are the only Global Administrator and you lose your password and your phone at the same time — stolen bag, dropped phone in a lake, a device wipe that took the Authenticator app with it — nobody can let you back in. Not your team, not your accountant. Recovering a tenant with no reachable admin means opening a support case with Microsoft, proving you own the business with documents, and waiting. Businesses have lost access to their own email for a week this way.

The fix is a second Global Administrator account that uses a different phone for its multi-factor authentication.

Two workable patterns:

• A second person. Give your business partner, co-director, or most trusted long-term employee the Global Administrator role on their existing account. Fastest option, and it means someone else can reset your password on a normal Tuesday.
• A break-glass account. Create a dedicated account such as [email protected] that nobody uses day to day. Register it with a different phone — a cheap prepaid handset kept in a drawer works. Store the password in your password manager and write it down somewhere physically secure. Some owners give a sealed copy to their accountant or solicitor.

To grant the role: go to Users > Active users, click the person, open the Account tab in the panel, click Manage roles, choose Admin center access, tick Global Administrator, and click Save changes.

Note: Microsoft requires multi-factor authentication for admin sign-in. Register the second account's MFA while you set it up, not later — an admin account that has never completed MFA registration cannot be used in the emergency you created it for.

Two Global Administrators is the right number for a small business. More than that and you have widened your attack surface for no benefit; fewer and you have a single point of failure that is you.

Troubleshooting

WARNING

Removing your own Global Administrator role, or deleting the only admin account, locks your business out of its own tenant. Microsoft cannot reverse this from a support chat — it requires an identity-proving support case that takes days. Always make role changes from a second admin account, and keep two Global Administrators at all times.

Symptom / Error	Potential Cause	Solution
No Admin tile in the app launcher	Account has no admin role	You are signed in with a standard account. Sign in with the account you used to buy the subscription, or ask your existing Global Administrator to add the role via Users > Active users > Manage roles.
A section such as Settings or Health is missing	Navigation is collapsed	Click Show all at the bottom of the left navigation. The default view hides most sections.
A setting exists in a support article but not in your portal	Setting lives in a specialist portal	Type its name into the search bar at the top of the admin center. Deep mail settings are in the Exchange admin center, sign-in settings in the Microsoft Entra admin center.
You unassigned a license but the bill did not change	Unassigning is not the same as cancelling	Go to Billing > Your products, open the subscription, and reduce the quantity of seats you are buying.
A deleted user cannot be restored	Past the 30-day window	After 30 days the account and mailbox are permanently gone. In future, use Block sign-in instead of Delete user when the decision is not final.
You are locked out of your admin account	Single admin, lost MFA device	Sign in with your second Global Administrator account and reset the first. If no second admin exists, open a Microsoft support case from support.microsoft.com and expect to prove ownership of the domain.

Related Articles

• Understanding When to Hire IT Help for Your Small Business
• How to Set Up Microsoft 365 for a Small Business
• How to Add or Remove Users in Microsoft 365 Admin Center
• How to Manage Microsoft 365 Subscriptions and Billing
• How to Set Up a Shared Inbox for a Small Business
• How to Set Up Self-Service Password Reset (SSPR)
• Understanding Multi-Factor Authentication (MFA) for Small Business
• Understanding Microsoft 365 Licensing and Plan Differences
• How to Set Up Email on a Custom Domain in Microsoft 365

Did this solve your problem?