Global admins and Power Platform admins can administer without a license

By default, all Global admin and Power Platform admins who do not have a license are granted the following two levels of permission in model-driven apps in Dynamics 365, such as Dynamics 365 Sales and Customer Service.

  • System administrator security role
  • Administrative access mode

The System administrator security role is typically granted to administrators giving them unrestricted access to the administrative (Settings) areas, which are used for managing and configuring features of model-driven apps in Dynamics 365.

Administrative access mode limits access to those areas of Dynamics 365 apps used to configure or customize the system.

To give these administrators access to additional areas, such as the Sales, Marketing, and Service areas, a license must be added to the Microsoft 365 Global administrator or Power Platform admin user account, by using the Microsoft 365 admin center. Note that Administrative access mode cannot be changed on the user form.

Create a Power Platform admin account

  1. Sign in to the Microsoft 365 admin center, and then choose Users > Active Users.

  2. Select an existing user in the list. If you want to create a new administrative user, see Create or edit users and Assigning admin roles.

  3. Next to Product licenses, click Edit.

  4. Make sure a license is not assigned to this user, and then click Save.


    Unlicensed Microsoft 365 Global and Power Platform admins have access to the administrative areas. However, if the administrator also needs access to additional areas you must select a license for the user.

  5. Select Manage roles, and then select either Global administrator or Show all by category > Power Platform admin. For more information about these roles, see Assigning admin roles.

  6. Select Save changes.


Global and Power Platform admins who don't have a license are automatically synced into the environment with an access mode of 'Administrative' while administrators who have a license are synced into the environment with an access mode of 'Read-Write'. These administrators are assigned a System Administrator security role.

Unlicensed administrators who need to work with Power Apps for Admins PowerShell module or management connectors need to sign into the Power Platform admin center at least once before invoking these administrative commands.

See also

Assigning admin roles
Create an Administrative user account