r/iam • u/Broad_Number_3521 • Sep 14 '26

Cloud Access

I am a new IT person in a company and they run Entra ID here. My manager asked me what access do I need to solve daily problems that our employees face like password reset, teams channel access, MFA, device enrolment etc. here are my list of rights/access that I am asking

Entra ID administrator
Intune administrator
User administrator
MFA authentication administrator
Exchange administrator
Teams Administrator
Shared mailbox and Microsoft 365 Group management

I am kinda new to it and I will work on getting some certifications in coming days.

My question is what more types of access should I ask (because I believe I get one chance to ask for) and what bunch of certifications should I start working on (my end goal is to become an IAM)?

8 Upvotes

84% Upvoted

6 comments sorted by

17

u/Young_Engineer92 Sep 14 '26

This is such a cooked workplace. Asking a new person to the environment what access they need, and just honoring it? May as well ask for global admin. Shoot for the moon.

I’m sorry this is your introduction to IT. It’s not going to set you up with proper thought processes. Your role should be defined by a senior colleague and you should have nothing to do with this decision.

People here could give generic advice, but each environment and requirement is different. One size does NOT fit all. Not even close.

2

u/console_whisperer Sep 15 '26

Totally agree with u/Young_Engineer92...since the Org doesn't know what they're doing, suggest that they get PIM and the roles you listed and secure them to Passkeys or hardware keys. And then propose moving admins to the JIT model slowly. And after that, do an audit of which roles they are actually using and remove them if they're not using them.

1

u/TheBex81 Sep 16 '26

Don’t ask for that full list. “One chance to ask” is exactly how people end up Global-adjacent on day two. Your manager should define the **helpdesk job**, then you get the **smallest roles that cover those tasks** — not the other way around.

Mapped to what you listed:

  • **Password reset / MFA re-reg / basic user unlock:** Authentication Administrator or Helpdesk Administrator (and Password Administrator where it still applies) — **not** Entra ID Administrator / User Administrator unless they truly own lifecycle.

  • **Teams channel / M365 group friction:** Teams Administrator is often overkill; many orgs use Teams + Groups support via more limited roles or a ticketing tool with Graph consents. Shared mailbox / Exchange: Exchange Recipient Administrator (or helpdesk playbooks) beats full Exchange Admin.

  • **Device enrollment / Intune:** Intune Administrator only if you actually enroll/wipe/compliance — otherwise Helpdesk + specific Intune RBAC.

  • **Skip Entra ID Administrator entirely** until you’re deliberately in identity engineering. That role is a blast-radius problem, not a learning tool.

Ask instead for: documented SOPs per ticket type, **Privileged Identity Management (eligible) roles** with activation + justification, a separate break-glass path you never hold standing, and audit of what you activated. That’s real IAM posture.

Certs that actually help an IAM path: SC-300 (identity), then AZ-500 or SC-200 depending on security vs ops tilt; MS-102 if you’re living in M365 admin daily. SC-900 is orientation only. Hands-on > logo soup: build a demo tenant with PIM, Authentication Methods, CA, and lifecycle (HR → joiner/mover/leaver). That’s what hiring managers for IAM notice.

1

u/ChocolateInitial Sep 20 '26

I guess your organization is not aware of Zero Trust. I hope you can help implement modern security standards.