To manage instances of Dynamic CRM, earlier the user had to be designated as a Global Administrator. But with the Global Administrator, as the name suggests, the user had access throughout Office 365. To resolve this Office 365 now provides the option of assigning the role of Customized Administrator.
With Customized Administrator, you now have the option of choosing the privileges that you need to assign to the user as can be seen below
The Privileges have now been separated per app to ensure granular security.
You can find these options upon editing the User Roles in Office 365 User Management screen
Dynamics 365 service administrator:
A user with this role assigned in the O365 portal is auto-assigned System Administrator security role in Dynamics 365 Customer Engagement. You do not have to manually assign the System Admin role to the user as is the case when you create a user in O365 with User (no admin access) role.