Why global admin is a target
Attackers who steal an ordinary user's password can read that person's email. Attackers who steal a global admin's password can create new accounts, turn off security settings, give themselves access to every mailbox, change where email goes and delete data across the whole business. That is why phishing campaigns deliberately aim at directors and the person known to manage IT.
In many small businesses the owner's normal email account is also the global admin, because that is how the tenant was set up when the first licence was bought. Every phishing email, every dodgy attachment and every reused password on that account therefore puts the entire tenant at risk. Separating the admin role from the everyday mailbox removes that link.
Separate admin accounts
Create a dedicated admin account, such as an address only used for administration, with no mailbox licence where possible and no use for browsing or email. Protect it with a phishing-resistant method such as a passkey or security key. Staff who need admin rights sign in with that account only when doing admin work, then sign out.
This feels like extra friction at first, but in practice most office managers only need admin rights a few times a month. Signing in with a second account to add a new starter is a small price for knowing that a malicious link clicked in their normal inbox cannot hand over the whole tenant. Browser profiles make switching between the two accounts quick.
Smaller roles that cover most jobs
Microsoft 365 has many built-in admin roles, each limited to a particular area. User administrator can create users, reset most passwords and manage groups. Billing administrator can buy and manage subscriptions. Exchange administrator manages mailboxes and mail flow. SharePoint administrator manages sites and sharing. Helpdesk administrator can reset passwords for non-admin users and little else.
Match roles to tasks. An office manager who sets up new starters probably needs user administrator and nothing more. The person who pays the bills needs billing administrator. Your IT provider might need several roles, granted to named individuals rather than a shared login. The aim is that no one holds more power than their job requires.
How many global admins?
Microsoft recommends a small number of global administrators, enough that one person being unavailable does not lock you out, but few enough to keep the risk contained. For a small business that often means two named global admin accounts plus an emergency access account, rather than five people who were given full rights for convenience at some point.
Review the list of role holders in the admin centre every quarter. It is common to find former staff, a past IT contractor, or an accountant who needed temporary access years ago and still holds global admin. Remove anything that is no longer needed. With Entra ID P2 you can use Privileged Identity Management to grant admin roles just in time, but even without it, a regular review works.
Emergency access accounts
An emergency access account, sometimes called break glass, is a cloud-only global admin account kept for the day normal admin sign-in fails, such as a Conditional Access mistake, a lost security key or an outage of the multi-factor service. It uses a long random password or a security key stored securely, often split between two people, and is excluded from the policies that could lock everyone out.
Because it is powerful and rarely used, set up an alert for any sign-in to it. If it is ever used, someone should know immediately and confirm it was legitimate. Test it once or twice a year to make sure the credentials still work, then record the test and store them again. An emergency account whose password nobody can find is no help on the day the normal admin accounts are locked out.
Who owns the tenant?
Ownership of the tenant matters when you change IT providers or when a key person leaves. Make sure at least one global admin account belongs to the business itself, not to a contractor, and that the business has the credentials. The business owner should also be listed as a contact for billing and security notifications from Microsoft.
If an IT provider manages your tenant through a partner relationship, you can see that relationship and the permissions it grants in the admin centre. Review it, and remove relationships with providers you no longer use. A good provider will welcome this, because clear ownership protects both sides when things change.
In short
- Keep global admin on a separate account used only for admin work.
- Use narrower roles such as user or billing administrator for everyday tasks.
- Limit global admins to a small number of named people.
- Set up a monitored emergency access account and test it.
- Make sure the business, not a contractor, owns admin access.