Protecting admin accounts in Microsoft 365

In a business email compromise, a stolen user mailbox lets an attacker read mail and send convincing invoices. A stolen admin account lets them do that across every mailbox, create new accounts, grant themselves consent to apps, switch off auditing and add their own MFA methods. Recovery stops being a password reset and becomes a tenant rebuild.

The same weak points come up again and again in small and mid-sized tenants: the owner's everyday mailbox is a Global Administrator, the IT provider's technicians share one admin login, and nobody has reviewed role assignments since the tenant was set up. Each is fixable in an afternoon.

The Canadian Centre for Cyber Security's baseline controls for small and medium organizations say administrator accounts should be used only for administrative activity, not for email or web browsing (control BC.12.2), and that cloud administrative accounts should use two-factor authentication and differ from internal administrator accounts (BC.10.5). In Microsoft 365 that translates to:

• Every person who administers the tenant has a normal licensed account for daily work and a separate, unlicensed (or minimally licensed) admin account, for example [email protected].
• Admin accounts have no mailbox, are never used to read email or browse, and are only signed in to when needed.
• Admin accounts are cloud-only. Microsoft recommends against using on-premises synced accounts for Entra role assignments, because a compromise of on-premises Active Directory would then extend to the cloud.
• No shared admin logins. Each technician, internal or external, gets a named account so the audit log shows who did what.

Global Administrator is the role everyone asks for and almost nobody needs day to day. Entra ID has dozens of narrower built-in roles. Microsoft's best-practice guidance is to assign the least privileged role that can do the task, keep Global Administrator assignments to fewer than five people, and keep privileged role assignments overall to fewer than ten. The Entra overview page shows an alert card when you exceed five Global Administrators.

Microsoft Entra Privileged Identity Management (PIM) changes admin roles from permanent to 'eligible'. An eligible admin activates the role when needed, for a limited time, with options to require MFA or a phishing-resistant method at activation, a written justification, a ticket number, or approval from another admin. When the time runs out, the role drops away. Every activation is logged.

PIM needs additional Entra licensing beyond P1 (Microsoft lists it under its ID Governance licensing fundamentals). For organizations without it, the next best thing is a small number of permanently assigned, separate admin accounts protected by a Conditional Access policy that requires phishing-resistant MFA, plus a monthly review of who holds what.

1. 01

   Create at least two

   Cloud-only accounts on the .onmicrosoft.com domain with permanent Global Administrator, not tied to a named person.

2. 02

   Protect them differently

   Microsoft recommends passwordless, phishing-resistant methods such as a FIDO2 passkey, different from the method your daily admins use, so one failure can't take out both.

3. 03

   Exclude them from blocking policies

   Exclude a dedicated emergency-access group from Conditional Access policies that block or restrict sign-in, so a bad policy can't lock everyone out.

4. 04

   Store credentials apart

   Keys in separate secure locations, known only to the people authorized to use them.

5. 05

   Alert on every use

   Any sign-in by these accounts should notify several people immediately. Microsoft documents doing this with Azure Monitor alerts on sign-in logs.

6. 06

   Test at least every 90 days

   Confirm they still sign in and can perform admin tasks, and re-confirm who is authorized.

Sources: Microsoft Learn, 'Best practices for Microsoft Entra roles', 'What is Microsoft Entra Privileged Identity Management?' and 'Manage emergency access accounts in Microsoft Entra ID'; Canadian Centre for Cyber Security, 'Baseline cyber security controls for small and medium organizations'.

• Monthly: list every user and group holding a privileged role (Entra ID > Roles & admins). Remove anyone who has left, changed jobs or no longer needs it.
• Monthly: check sign-ins by admin accounts for unfamiliar locations, legacy protocols or devices.
• Quarterly: confirm every admin has a phishing-resistant method registered and that weaker methods are removed.
• Quarterly: review delegated access granted to outside IT providers (GDAP relationships in the Microsoft 365 admin centre) and end any that are no longer used.
• With PIM or ID Governance licensing, schedule recurring access reviews so role holders must be re-approved.