Office 365 - Password Reset Permissions

[Strawdog]

Is it possible to provide password reset rights to a user for only specific accounts?

 

We have a number of technicians that I'd like to be able to reset student Office 365 account passwords but not staff ones.

 

Having looked at the generic roles (https://support.office.com/en-us/article/about-office-365-admin-roles-da585eea-f576-4f55-a1e0-87090b6aaa9d) it appears to be password reset rights to all accounts or no accounts (unless I want to designate all staff as admins).

 

I'm presuming it's going to require tinkering with Azure AD to get it setup but I've only just got my hands on Global Admin (after BTLS refused to enable the mobile device security settings for us because apparently ticking the box was just too hard) and haven't really tinkered with any of that side yet.

Edited July 10, 2018 by Strawdog

[localzuk]

Are your accounts all AD linked to a normal AD? If so, you could give delegated rights in ADUC to reset passwords on specific OUs?

[Strawdog]

Unfortunately not - we've only just taken over Global Admin so that was never previously an option and now it is it's further complicated by there being 2 schools on campus that share a domain but have separate Office 365 tenancies.

[Boredguy]

You might want to look into merging the tenancys, but otherwise in 365 you can not restrict which accounts can have the password reset by a valid admin account if I remember correctly.

[Strawdog]

We need to maintain separation as the schools are legally separate entities (I suspect under GDPR we probably shouldn't even have both schools running under one domain) and I'm not sure how O365 handles multiple URLs....