How to Restrict access to Microsoft Entra admin center

Why do users have access to Microsoft Entra admin center by default? You only want administrators to have access and restrict users to access Microsoft Entra admin center. It’s not relevant for standard users to have access to all kinds of information. In this article, we will look at how to restrict access to Microsoft Entra admin center.

Check current access to Microsoft Entra admin center

Check how it looks like if a user signs in to the Microsoft Entra admin center without restricting access by following the below steps:

1. Sign in to Microsoft Entra admin center as a User
2. Click on Identity > Overview
3. In the Overview screen, the user can see the Microsoft Entra ID organization

4. Click in the menu on Users > All users
5. All the users are visible to the user

6. Click in the menu on Groups > All groups
7. All the groups are visible to the user

8. Click in the menu on Roles & admins > Roles & admins
9. Verify the user’s role (in our case, it’s the role User)
10. Click on Your Role

11. The user does not have any roles assigned

In the next step, we will look at restricting users from accessing the Microsoft Entra admin center.

Restrict access to Microsoft Entra admin center

To restrict users from accessing the Microsoft Entra admin center, follow these steps:

1. Sign in to Microsoft Entra admin center as a Global Administrator
2. Click on Identity > Users > User settings
3. Go to the setting Restrict access to Microsoft Entra admin center and set it to Yes
4. Click Save

Give the setting a few minutes to apply the changes on Microsoft’s servers.

Verify no access to Microsoft Entra admin center

Check that the user access to the Microsoft Entra admin center is restricted by following the below steps:

1. Sign in to Microsoft Entra admin center as a User
2. The sidebar menu is not available

3. Go to a direct link in Microsoft Entra admin center (for example, All users)
4. The You do not have access message appears

Verify access to PIM (Privileged Identity Management)

You can access the PIM blade, even if you have restrictions everywhere else in the Microsoft Entra admin center. So you can always manage your privileged access.

Note: Every user can access the Privileged Identity Management (PIM) blade.

Let’s look at activating the Global Administrator role using PIM:

1. Sign in to the PIM blade as a User
2. Click My roles

3. Select Activate

4. Fill in a reason
5. Click Activate

6. It will process the request, activate the role, and refresh automatically once it is complete

7. The completion is successful, and all the options, including the sidebar menu, are available in Microsoft Entra admin center

Block user access with Conditional Access policy

Using the Restrict access to Microsoft Entra admin center switch is not a security measure.

The correct way is to create a Conditional Access policy and target Windows Azure Service Management API that blocks non-administrators access.

This will target the following:

• Azure Resource Manager
• Azure portal
• Microsoft Entra admin center
• Azure Data Lake
• Application Insights API
• Log Analytics API

Sign in to Microsoft Entra admin center as a user. The You don’t have access to this message appears.

That’s it!

Read more: Install and configure Azure AD Connect »

Conclusion

You learned how to restrict access to Microsoft Entra admin center. The option is by default set to No. But we highly recommend setting it to Yes and restrict user access to Microsoft Entra admin center for non-administrator accounts.

The next time you manage a Microsoft Entra tenant or create a new Microsoft tenant, check the restrict access to Microsoft Entra admin center setting and ensure to turn it on.

Did you enjoy this article? You may also like Microsoft 365 disable stay signed in prompt. Don’t forget to follow us and share this article.