If an attacker phishes the person who reads email, browses the web and runs your Microsoft 365 tenant all from one account, they get the whole tenant in one move. Following Microsoft 365 admin account best practices is mostly about breaking that link: daily work happens on one account, and admin work happens on another that never touches an inbox.

It sounds like extra hassle. In practice it adds a few seconds to admin tasks and removes the single most damaging failure I see in small business tenants.

Why one account for everything is the real risk

A Global Administrator can change almost every setting in Microsoft Entra ID and Microsoft 365, create new admins, disable security policies and read data. When that power sits on the same account that receives invoices and LinkedIn messages, every phishing email is a potential tenant takeover.

The pattern I see most often in tenants I review looks like this:

• The owner or office manager set up Microsoft 365 years ago and is still Global Administrator on their everyday account.
• An outside IT person or former contractor also has Global Administrator, sometimes on an account nobody remembers.
• There are five, eight or more Global Administrators because “it was easier”.
• Nobody has a plan for what happens if MFA breaks or the only admin leaves.

Microsoft recommends fewer than five Global Administrators and shows an alert card on the Entra overview page when you reach five or more. Most businesses under 500 people need two, plus emergency accounts.

The target setup: three kinds of accounts

Named admin accounts

Create these as cloud-only accounts, not synced from on-premises Active Directory. If your on-premises domain is compromised, a synced admin account goes with it. Use a clear naming convention, such as adm-jsmith@yourtenant.onmicrosoft.com, so admin activity stands out in the logs.

Do not give admin accounts a mailbox. If an admin account cannot receive email, it cannot be phished through email. Admin notifications can go to a shared address or the person’s daily account.

Emergency access accounts

Microsoft recommends two cloud-only emergency access accounts with permanent Global Administrator, not assigned to any individual. Their job is to get you back in if Conditional Access is misconfigured, MFA is down, or your only admin is unavailable. Exclude at least one of them from Conditional Access policies that could block sign-in, protect them with phishing-resistant methods different from your normal admins, and alert on every sign-in.

Use the smallest role that does the job

Global Administrator is rarely needed for day-to-day work. Microsoft 365 and Entra ID have dozens of scoped roles. These cover most small business tasks:

• User Administrator: create users, reset passwords, manage groups.
• Helpdesk Administrator: reset passwords for non-admins. Ideal for a front-line support person.
• Exchange Administrator: mailboxes, mail flow, shared mailboxes.
• SharePoint Administrator: sites, sharing settings, OneDrive.
• Teams Administrator: Teams policies and settings.
• Intune Administrator: device management.
• Security Administrator: Defender, security policies, Conditional Access visibility.
• Global Reader: read everything, change nothing. Great for auditors and for an owner who wants visibility.

Review assignments in the Microsoft Entra admin center at Entra ID > Roles & admins, or in the Microsoft 365 admin center under Roles > Role assignments. Open Global Administrator first and work down.

A step-by-step cleanup plan

This is the order I use. It can be done in an afternoon for most tenants.

1. Create the two emergency access accounts first, test them, and store the credentials securely. This protects you if anything later in the plan goes wrong.
2. List every privileged role assignment. Export Global Administrator, Privileged Role Administrator, Exchange Administrator, SharePoint Administrator, Security Administrator and User Administrator members.
3. Remove anyone who no longer needs access, including former staff, old vendors and test accounts.
4. Create a named, cloud-only admin account for each remaining admin and assign the narrowest role that fits their work.
5. Remove admin roles from daily user accounts. Confirm each person can still do their admin tasks with the new account before you strip the old one.
6. Enforce phishing-resistant MFA for admins. Microsoft provides a Conditional Access template that requires phishing-resistant strength for admin roles. Passkeys in Microsoft Authenticator or FIDO2 security keys work well.
7. Block admin sign-ins from risky places. Consider requiring a compliant, Intune-managed device for admin roles.
8. Set up alerts for new Global Administrator assignments and for any emergency account sign-in.

What about your IT provider’s access?

Outside IT providers are a common source of forgotten Global Administrator accounts. If a Microsoft partner manages your tenant, their access should come through granular delegated admin privileges (GDAP), which grants specific roles for a set period instead of permanent, unlimited rights. You can review partner relationships in the Microsoft 365 admin center under Settings > Partner relationships. Ask your provider which roles they hold and why, and remove any relationship you no longer use. A provider who asks for Global Administrator on a shared account is a provider to question.

Making it easy to live with

People push back on separate accounts because switching is annoying. A few habits make it painless:

• Use a separate browser profile for the admin account. Microsoft Edge profiles keep sessions apart, so you never sign in to the admin portal with the wrong identity.
• Bookmark the admin portals only in the admin profile.
• Do not browse the web or read email from the admin profile. Ever.
• If you have Entra ID P2, move to Privileged Identity Management so admin roles are eligible, not permanent, and are activated only when needed.

On licensing: Conditional Access requires Entra ID P1, which is included in Business Premium. Microsoft’s licensing guidance treats licenses as per user account, so check that your admin accounts are covered by the policies that protect them.

Microsoft’s own guidance is in Best practices for Microsoft Entra roles, which is worth reading alongside your own admin policy.

If you want help putting this in place, our MFA enablement service includes admin account separation and phishing-resistant MFA, and our Microsoft 365 managed service keeps role assignments reviewed every quarter. A Microsoft 365 security assessment will show exactly who holds admin rights in your tenant today.

Frequently asked questions

Do admin accounts need a Microsoft 365 license?

Admin roles do not require a Microsoft 365 license, and admin accounts should not have a mailbox. However, features like Conditional Access are licensed per user, so plan for the accounts covered by those policies to be licensed appropriately.

How many Global Administrators should a small business have?

Microsoft recommends fewer than five. For most businesses with 20 to 500 people, two named Global Administrators plus two emergency access accounts is the right number. Everyone else should hold a scoped role.

Should emergency access accounts use MFA?

Yes, but with a method different from your normal admins, such as a FIDO2 security key stored securely. At least one emergency account should be excluded from Conditional Access policies that could lock you out, and every sign-in should trigger an alert.

Not sure who has admin rights in your tenant? Book a free Microsoft 365 security assessment and we will map every privileged account and show you how to lock them down.