In this comprehensive tutorial, I will walk you through the distinct administrative frameworks within Azure, show you the step-by-step process to grant admin rights securely via the Azure Portal, and share production-level governance strategies to keep your cloud environment secure.
How to Grant Admin Rights to User in Azure Portal
The Two Halves of Azure Administration: IAM vs. Entra ID
Before clicking anything in the portal, you must understand a critical architectural concept. Azure divides administrative privileges into two completely separate control planes:
- Azure Identity Administrators (Microsoft Entra ID Roles): This tier governs your identity perimeter. It includes tenant-level management tasks, such as creating user accounts, adjusting enterprise domain settings, assigning software licenses, and configuring global multi-factor authentication (MFA) rules.
- Azure Resource Administrators (Azure RBAC Roles): This plane controls your actual cloud infrastructure resources. It handles permissions for managing virtual networks, provisioning virtual machines, tuning databases, and deploying storage accounts.
The table below breaks down these two domains side-by-side so you can select the correct path for your team:
| Administrative Scope | Governance Layer | Core Privileged Roles | Primary Operational Actions |
| Directory Tenant Level | Microsoft Entra ID | Global Administrator, User Administrator, Helpdesk Administrator | Managing user accounts, configuring SSO apps, registering corporate domains |
| Infrastructure Resource Level | Azure RBAC | Owner, Contributor, User Access Administrator | Deleting VMs, provisioning storage accounts, altering virtual network routing |
Managing the Infrastructure: Granting Resource Admin Rights (RBAC)
If your goal is to let a cloud engineer manage infrastructure assets—like a cluster of web applications inside a specific subscription—you will use Azure Role-Based Access Control (RBAC).
Step 1: Define Your Target Scope
Azure applied permissions hierarchically: Management Groups $\rightarrow$ Subscriptions $\rightarrow$ Resource Groups $\rightarrow$ Individual Resources.
Always assign roles at the lowest possible level that still allows the user to do their job. If a developer only needs to manage test machines in a dev environment, grant access at the specific Resource Group level—not the entire Subscription.
Step 2: Open Identity and Access Management (IAM)
- Sign in to the Azure Portal using an account that holds Owner or User Access Administrator privileges at the targeted scope.
- Navigate to the top search bar and search for the scope you want to manage (e.g., click S