Follow these steps to elevate access for a Global Administrator using the Azure portal.

1. Sign in to the Azure portal as a Global Administrator.

   If you are using Microsoft Entra Privileged Identity Management, activate your Global Administrator role assignment.

2. Open Microsoft Entra ID.

3. Under Manage, select Properties.

   

4. Under Access management for Azure resources, set the toggle to Yes.

   

   When you set the toggle to Yes, you are assigned the User Access Administrator role in Azure RBAC at root scope (/). This grants you permission to assign roles in all Azure subscriptions and management groups associated with this Microsoft Entra directory. This toggle is only available to users who are assigned the Global Administrator role in Microsoft Entra ID.

   When you set the toggle to No, the User Access Administrator role in Azure RBAC is removed from your user account. You can no longer assign roles in all Azure subscriptions and management groups that are associated with this Microsoft Entra directory. You can view and manage only the Azure subscriptions and management groups to which you have been granted access.

    Note

   If you're using Privileged Identity Management, deactivating your role assignment does not change the Access management for Azure resources toggle to No. To maintain least privileged access, we recommend that you set this toggle to No before you deactivate your role assignment.

5. Click Save to save your setting.

   This setting is not a global property and applies only to the currently signed in user. You can't elevate access for all members of the Global Administrator role.

6. Sign out and sign back in to refresh your access.

   You should now have access to all subscriptions and management groups in your directory. When you view the Access control (IAM) pane, you'll notice that you have been assigned the User Access Administrator role at root scope.

   

7. Make the changes you need to make at elevated access.

   For information about assigning roles, see Assign Azure roles using the Azure portal. If you are using Privileged Identity Management, see Discover Azure resources to manage or Assign Azure resource roles.

8. Perform the steps in the following section to remove your elevated access.

To remove the User Access Administrator role assignment at root scope (/), follow these steps.

1. Sign in as the same user that was used to elevate access.

2. In the navigation list, click Microsoft Entra ID and then click Properties.

3. Set the Access management for Azure resources toggle back to No. Since this is a per-user setting, you must be signed in as the same user as was used to elevate access.

   If you try to remove the User Access Administrator role assignment on the Access control (IAM) pane, you'll see the following message. To remove the role assignment, you must set the toggle back to No or use Azure PowerShell, Azure CLI, or the REST API.

   

4. Sign out as Global Administrator.

   If you are using Privileged Identity Management, deactivate your Global Administrator role assignment.

    Note

   If you're using Privileged Identity Management, deactivating your role assignment does not change the Access management for Azure resources toggle to No. To maintain least privileged access, we recommend that you set this toggle to No before you deactivate your role assignment.