Microsoft Entra ID · M365 Workloads & Services
Service Support Administrator
Can create and manage support requests with Microsoft for Azure and Microsoft 365 services.
Scope: Support ticket creation and service health monitoring for Azure and M365
Permissions
- Create Azure support tickets
- Create M365 support tickets
- View service dashboard
- Read Message Center posts
- Monitor service health
- Manage support request lifecycle
Common use cases
- Opening support cases with Microsoft
- Service health monitoring
- Incident communication
- Escalation management
- Message Center monitoring
Best practices
- Document issues before opening tickets
- Monitor service health proactively
- Track open support requests
- Communicate incidents to stakeholders
- Review Message Center regularly
Security considerations
- Support tickets may contain sensitive info
- Verify Microsoft support identity
- Use Customer Lockbox for data access
- Document support interactions
Common questions
When should I assign the Service Support Administrator role?
Assign Service Support Administrator when you need to: Opening support cases with Microsoft; Service health monitoring; Incident communication; Escalation management; and Message Center monitoring. It is part of Microsoft Entra ID and should be granted as a least-privilege alternative to broader roles like Global Administrator.
What can someone with the Service Support Administrator role do?
The Service Support Administrator role grants permissions including: Create Azure support tickets; Create M365 support tickets; View service dashboard; Read Message Center posts; Monitor service health; and Manage support request lifecycle. See the Permissions section above for the full list.
What are the security risks of the Service Support Administrator role?
Key considerations when assigning Service Support Administrator: Support tickets may contain sensitive info; Verify Microsoft support identity; Use Customer Lockbox for data access; and Document support interactions. Review the Security considerations section before assignment, and pair with Privileged Identity Management (PIM) for just-in-time access where possible.