This list is the toolkit's own and has nothing to do with Microsoft 365 roles. Being a Global Administrator of your tenant does not grant access to the toolkit, and somebody with no admin rights at all can be given full access to it. People sign in with their Microsoft 365 account, but whether they get in, and what they see, is decided here.
Settings > Access Control is the list of people who can sign in to 365 Pro Toolkit, and what each of them can reach.
The Owner
Every install has exactly one Owner, and it is set when you connect your first tenant: the administrator who ran the guided sign-in, or, if you added the tenant manually, the account you named in the Owner field.
The Owner has full control, works in every tenant, and cannot be removed, disabled, or demoted from this page. That is deliberate: it means no combination of clicks here can lock everybody out.
Until a tenant is connected the toolkit is open so that you can set it up. Once one is connected, only the people on this list can sign in. Anyone else who signs in with a Microsoft 365 account is told they have not been granted access.
Grant someone access
- Go to Settings > Access Control.
- Under Grant access, search for the person by name or email. The list comes from your synced users, so a new starter appears once the next sync has run.
- Choose a Role. The picker describes what each one can reach.
- If you have more than one tenant connected, choose which Tenants they may work in. Leave All tenants ticked unless you want to restrict them.
- Click Grant access.
They can sign in straight away. Nothing is emailed to them, so tell them yourself.
Roles
Ordered widest reaching first.
| Role | What it can reach |
|---|---|
| Owner | Full control. Everything an Admin can do, plus connecting and removing tenants and managing other Owners and Admins. |
| Admin | Manages the app. Full access to Tools, Reports and Settings, and can add and manage Member and Report users. |
| Member | Day to day administration. All Tools and Reports. No Settings. |
| Report | Read only. Dashboards and Reports only. No Tools, no Settings. |
| User Admin | Tools > Users only. Full user management: create, edit, reset password, disable, delete, offboard. |
| Group Admin | Tools > Groups only. |
| Mailbox Admin | Tools > Mailboxes only. |
| OneDrive Admin | Tools > OneDrive only. |
| Password Reset | Tools > Password reset only. Can reset a password and enable a disabled account, and nothing else. |
The five narrow roles at the bottom exist for people who should do one job and see nothing else. Password Reset is the tightest of them: it is the helpdesk role, with no user list to browse and no way to edit, disable or delete an account.
Who can grant what
- An Owner can grant and manage every role except Owner.
- An Admin can grant and manage Member, Report and the five narrow roles, but not other Admins.
- Nobody can change the Owner, and nobody can change their own row. You cannot remove your own access by accident.
Only an Owner sees Make Admin, because only an Owner can hand out that role.
Change or remove access
Each row in the table has its own actions.
- Make Admin or Make Member moves somebody between those two roles. For any other role, remove the person and grant access again with the role you want.
- Disable blocks sign-in but keeps the row, which is what you want for someone on leave or where you expect to restore the access later. Enable puts it back.
- Remove deletes the row. They lose access immediately.
Actions only appear on rows you are allowed to manage, so the table looks different depending on who is signed in.
Limit someone to certain tenants
With more than one tenant connected, each person can be restricted to a subset of them. The Tenants column names what they have, and Change edits it.
All tenants is the default and is stored as "no restriction" rather than as a list of every tenant. That matters: somebody on All tenants automatically gets a tenant you connect next year, while somebody restricted to named tenants does not, and has to be edited.
The Owner always works in every tenant and cannot be restricted. Restricting the account that connects and removes tenants would be a trap.
Troubleshooting
"No access to 365 Pro Toolkit. You're signed in as ... but your account hasn't been granted access." The sign-in worked and the account simply is not on this list. Have the Owner or an Admin add them. Note that being a Global Administrator in Microsoft 365 makes no difference here.
Somebody who had access cannot get in any more. Their row is probably disabled. The Status column shows Disabled, and Enable restores it.
The person I want to add does not appear in the search. The search reads the synced user list. If the account was created in Microsoft 365 in the last few minutes, wait for the next sync and try again.
Nobody can sign in at all. This can only happen if the install has a connected tenant but no Owner, which on current versions is prevented when the tenant is added. Contact support, who can restore access.
I want to hand the install over to a different administrator. Ownership is not transferred from this page. Contact support.