Short answer
Give every admin a separate, cloud-only admin account with no mailbox, protect it with phishing-resistant MFA, and assign the narrowest role that does the job. Keep Global Administrator to a small handful of people, make roles just-in-time with Privileged Identity Management where licensed, and keep two monitored emergency access accounts for when everything else fails.
Key facts
- Admin work should happen from a separate account, never from the account that reads email.
- Microsoft recommends fewer than five Global Administrators.
- Phishing-resistant MFA is the right standard for any privileged role.
- Privileged Identity Management needs Entra ID P2 or Entra ID Governance licensing.
- Two cloud-only emergency access accounts, monitored on every sign-in, are standard practice.
Separate admin accounts from daily accounts
Most admin account compromises start with a phishing email or a malicious link opened in a browser. If the same account reads email and holds Global Administrator, one bad click hands over the tenant. Create a dedicated admin account for each person who needs privileged access.
Make admin accounts cloud-only, not synced from on-premises Active Directory, so a compromise of the local domain does not flow into Microsoft 365. Use the onmicrosoft.com domain or a clear naming pattern, give them no mailbox and only the licences they truly need, and do not use them for web browsing.
Use least privilege, not Global Administrator for everything
Microsoft Entra ID has dozens of built-in roles. Most daily tasks need far less than Global Administrator. A help desk technician resetting passwords needs Helpdesk Administrator or User Administrator. Someone managing mail needs Exchange Administrator. Billing staff need Billing Administrator.
- Review role assignments at least quarterly and remove anyone who changed jobs.
- Use administrative units to limit regional or departmental admins to their own users.
- Check for service principals and app registrations with high-privilege Graph permissions; they are admin accounts too.
| Task | Typical role |
|---|---|
| Reset passwords and MFA for users | Helpdesk Administrator or Authentication Administrator |
| Create users and manage groups | User Administrator |
| Manage mailboxes and mail flow | Exchange Administrator |
| Manage devices and policies | Intune Administrator |
| Manage Conditional Access | Conditional Access Administrator or Security Administrator |
| Review settings without changing them | Global Reader |
Require phishing-resistant MFA for admins
Push notifications and one-time codes can be phished through adversary-in-the-middle sites. For admin roles, build a Conditional Access policy that targets directory roles and requires the built-in phishing-resistant MFA authentication strength. That allows FIDO2 security keys, passkeys, Windows Hello for Business and certificate-based authentication.
Add a second policy that requires a compliant or managed device for admin sign-ins, and set a short sign-in frequency for admin portals. Microsoft also enforces MFA on its admin portals, so make sure admins are registered before that catches them out.
Make privilege just-in-time with PIM
Standing admin rights mean an attacker who steals a session gets the role immediately. Privileged Identity Management makes users eligible for a role instead of permanently assigned. They activate it for a set time, with a reason, MFA and optional approval, and every activation is logged.
PIM requires Entra ID P2, included in Microsoft 365 E5, or Microsoft Entra ID Governance. For tenants on Business Premium or E3, a separate admin account with phishing-resistant MFA and tight role scoping is still a large improvement, and P2 can be added only for the admins who need it.
Build and test emergency access accounts
Emergency access, or break-glass, accounts exist for the day Conditional Access is misconfigured or the MFA service is unavailable. Create two cloud-only accounts with Global Administrator, protect them with FIDO2 security keys stored securely, and exclude them only from policies that could lock you out.
Alert on every sign-in to these accounts, through an alert rule in Microsoft Sentinel, Defender XDR or a Log Analytics query on the sign-in logs. Test them on a schedule, record who holds the keys, and document the procedure outside the tenant.
How Accred Consulting approaches it
Accred Consulting reviews and rebuilds admin access as part of security work. Discovery inventories every role assignment, service principal and emergency account. The proposal sets a clear scope, fixed price and timeline. US-based specialists then create separate admin accounts, move people to least-privilege roles, add phishing-resistant MFA and device policies for admins, set up PIM where licensed, and build monitored break-glass accounts. Handover includes a role matrix, the emergency procedure, documentation and knowledge transfer, with optional support retainers for ongoing reviews.
Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies
Related questions
Want this scoped for your environment?
Book a free consultation. After discovery you get a written plan with scope, a fixed price and a timeline.
Book a free consultation