Roles and Permissions

Roles

Administrators for the NHSmail platform will be assigned a role. This role determines permissions when performing activities on the platform. Below outlines the different roles in the NHSmail platform and the matrix highlights the permission assigned to these roles:‌

Important

All enhanced roles and privileged accounts have Multi Factor Authentication (MFA) enforced. These accounts are added to the MFA Conditional Access Standard policy which enables MFA.

All enhanced roles and privileged accounts should be enrolled with the Authenticator Application as the primary authentication method for Multi Factor Authentication (MFA).

  • Local Primary Admin
  • Local Admin
  • Global Admin
  • Tenant Admin
  • Local Helpdesk
  • Global Helpdesk
  • Connectors
  • Authorisations
  • Audit
  • O365 Licence Admin
  • Local Report Admin

User Account and Contact Permissions

Note

It is advised that Local Admin accounts do not need Local Report Admin role, this role is given to Local Admin role as a default. If you do provide both a Local Admin and Local Report Admin roles, this may cause some loss to admin access. You should only provide Local Report Admin role to standard users.

Roles Permissions
Create User Read User Update User Delete User Restore User Create Contact Read Contact Update Contact Delete Contact Licence Assignment
Local Primary Admin Checked Icon Checked Icon Checked Icon Unchecked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Local Admin Checked Icon Checked Icon Checked Icon Unchecked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Local Helpdesk Unchecked Icon Checked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Checked Icon Unchecked Icon Checked Icon
Global Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Global Helpdesk Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Tenant Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Audit Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Authorisations Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Connector Checked Icon Checked Icon Checked Icon Unchecked Icon Unchecked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon Unchecked Icon
O365 Licence Admin Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon
Local Report Admin Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Global Report Admin Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon

Shared Mailbox and Distribution List Permissions

Roles Permissions
Create Shared Mailbox Read Shared Mailbox Update Shared Mailbox Delete Shared Mailbox Restore Shared Mailbox Create Distribution List Read Distribution List Update Distribution List Delete Distribution List
Local Primary Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Local Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Local Helpdesk Unchecked Icon Checked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Checked Icon Unchecked Icon
Global Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Global Helpdesk Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Tenant Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Audit Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon
Authorisations Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Connector Checked Icon Checked Icon Checked Icon Unchecked Icon Unchecked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
O365 Licence Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Local Report Admin Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon
Global Report Admin Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon

Organisation Permissions

Roles Permissions
Create Org Unit Read Org Unit Update Org Unit Delete Org Unit Org Unit Shortname edit Org Unit Registration Limits Read Audit Top-up Updates
Local Primary Admin Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon
Local Admin Unchecked Icon Checked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon
Local Helpdesk Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Global Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Global Helpdesk Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Tenant Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Audit Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon
Authorisations Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon
Connector Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
O365 Licence Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Local Report Admin Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Global Report Admin Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon

Resource Mailbox Permissions

Roles Permissions
Create Resource Mailbox Read Resource Mailbox Update Resource Mailbox Delete Resource Mailbox Restore Resource Mailbox
Local Primary Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Local Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Local Helpdesk Unchecked Icon Checked Icon Checked Icon Unchecked Icon Unchecked Icon
Global Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Global Helpdesk Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Tenant Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Audit Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Authorisations Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Connector Checked Icon Checked Icon Unchecked Icon Unchecked Icon
O365 Licence Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Local Report Admin Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Global Report Admin Unchecked Icon Checked Icon Unchecked Icon Unchecked Icon Unchecked Icon

Reporting Permissions

Roles Permissions
Mailbox Report Contact Report Distribution List Report Mobile Report Possible Duplicate Users Report Top-up Report O365 Licence Report
Local Primary Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Local Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Local Helpdesk Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Global Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Global Helpdesk Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Tenant Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Audit Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Authorisations Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Connector Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
O365 Licence Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon
Local Report Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Global  Report Admin  Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Roles Permissions
ATP User Membership Report Azure AD Allowed list External Organisation Report Azure AD External Federated Groups Report Azure AD Guest Access Report O365 Activations User Detail Report MFA Status Report O365 Privacy Report
Local Primary Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Checked Icon Checked Icon
Local Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Checked Icon Checked Icon
Local Helpdesk Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Global Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Global Helpdesk Unchecked Icon Checked Icon Unchecked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Tenant Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon
Audit Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Authorisations Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Connector Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
O365 Licence Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
O365 Local Report Admin Unchecked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon Checked Icon
Local Report Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Checked Icon Unchecked Icon
Global Report Admin Unchecked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Roles Permissions
O365 Usage Active User Detail Report Teams User Activity Report O365 User Licence Allocation Report OneDrive User Consumption Report Sharepoint Site Usage Detail Report Teams Usage Report ATP Group Management Report
Local Primary Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Local Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Local Helpdesk Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Global Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Global Helpdesk Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Tenant Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Audit Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Authorisations Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Connector Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
O365 Licence Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
O365 Local Report Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Local Admin Report Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Global Admin Report Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Unchecked Icon
Roles Permissions
Organisation Admin Report Dashboard Report Connector Report Organisation Traffic Report Mover Leaver Report Shared Channels Permissions Report
Local Primary Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Local Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Local Helpdesk Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Global Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Global Helpdesk Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Tenant Admin Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Audit Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Authorisations Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Connector Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
O365 Licence Admin Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon Unchecked Icon
Local Admin Report Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon
Global Admin Report Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon Checked Icon

Security Groups

Roles Permissions
Create Security Groups Update Security Groups View Security Groups
Global Admin Checked Icon Checked Icon Checked Icon
Local Primary Admin Checked Icon Checked Icon Checked Icon
Local Admin Checked Icon Checked Icon Checked Icon
Global Helpdesk Checked Icon Checked Icon Checked Icon
Tenant Admin Checked Icon Checked Icon Checked Icon
Local Helpdesk Checked Icon Checked Icon Checked Icon
Local Report Admin Unchecked Icon Unchecked Icon Checked Icon
Global Report Admin Unchecked Icon Unchecked Icon Checked Icon
Audit Unchecked Icon Unchecked Icon Checked Icon
Last Reviewed Date 29/04/2024
Updated on 30/04/2024

Related Articles

Need Support?
Can’t find the answer you’re looking for? Don’t worry we’re here to help!
Contact Support
back to top