Microsoft 365 Global Admin account hardening — a practical guide

If an attacker compromises a Global Administrator account in your Microsoft 365 tenant, they have the keys to everything — every mailbox, every SharePoint site, every user account. They can disable your CA policies, remove MFA, create new accounts, and exfiltrate data at will.

Yet in most tenants we scan, Global Admin accounts are less protected than they should be. The reasons are usually not negligence — it is that nobody has done a structured audit of who has the role and whether each account is properly secured.

The four signals that matter

1. MFA registration

Every Global Administrator must have MFA registered and enforced. This sounds obvious, but it is the most common finding in our Admin Hardening Report. Admin accounts are sometimes created for specific tasks and never have MFA properly set up — the account was provisioned in a hurry, MFA registration was skipped, and the account has been sitting there since.

Check in Entra ID: Identity → Users → Authentication methods → User registration details. Filter to Global Admins. Any account showing "MFA not registered" is your highest priority.

2. Privileged Identity Management (PIM)

With PIM, Global Admin rights are not permanently assigned. Instead, administrators have an eligible assignment and must activate the role on demand — typically for a defined time window with a business justification. This means a compromised account does not automatically have admin rights; the attacker would also need to pass the activation step (which can include additional MFA and approval).

Permanent Global Admin assignments — where the role is always active — are the less secure alternative. Cyber Essentials Plus and ISO 27001 both expect you to justify permanent admin assignments. In most cases, there is no good reason for them.

3. On-premises synchronisation

If a Global Admin account is synchronised from on-premises Active Directory via Entra Connect, then a compromise of your on-premises environment extends to your cloud tenant. An attacker who gains domain admin rights on-premises inherits cloud admin rights through the synchronised account.

Best practice is that cloud admin accounts should be cloud-only — not synchronised from AD. If you have on-premises synced accounts with Global Admin rights, this is a structural risk that should be remediated.

4. Last sign-in activity

A Global Admin account that has not been used in 90 days or more is a ghost account — an attack surface with no legitimate use. These accounts often belong to former employees, contractors, or service accounts that were given admin rights temporarily and never removed.

Any admin account that has not signed in within 90 days should be reviewed. If it is not actively needed, revoke the Global Admin role. If it is a break-glass emergency access account, it should be documented as such and tested periodically.

How many Global Admins should you have?

Microsoft recommends two to four Global Administrators for most organisations. Fewer than two creates a single point of failure — if the sole admin is unavailable, you may be locked out. More than four increases the attack surface unnecessarily.

One of the two minimum admins should be a dedicated break-glass emergency access account — a cloud-only account with a strong password stored securely, used only if all other admin access is lost. This account should be excluded from CA policies (otherwise you risk locking yourself out) and its sign-in activity should be monitored closely.

What Cyber Essentials requires

Cyber Essentials (and Cyber Essentials Plus) require that administrator accounts are only used for administrative tasks, that admin accounts are separate from standard user accounts, and that access to admin tools and functions is controlled and audited. A Global Administrator who uses the same account for email and administration is non-compliant with this requirement.

Practical steps for a complete admin account audit

1. List all Global Administrators: Entra ID → Roles and administrators → Global Administrator → Assignments
2. For each account, check MFA registration status in User registration details
3. Check whether each account has a PIM eligible assignment or a permanent assignment
4. Check whether each account is synchronised from on-premises AD (identityInfo → onPremisesSyncEnabled)
5. Review last sign-in date for each account in the sign-in logs
6. Remove the Global Admin role from any account that cannot be justified
7. Create a break-glass account if one does not exist, and document it