Microsoft's guidance is clear: a Microsoft 365 tenant should have between two and four permanent Global Administrators. Two because you need a backup if one account is compromised or unavailable. Four as an outer limit because every permanent Global Admin is a standing target — an account that, if compromised, gives an attacker unlimited access to your entire Microsoft 365 environment with no expiry and no activation step required.
Most tenants have more than four. Some have significantly more — ten, fifteen, twenty permanent Global Admins accumulated over years of "it's easier to just make them a Global Admin" decisions.
Global Administrator is the most powerful role in Microsoft 365. A Global Admin can read all mailboxes, reset any password, grant any permission, and access any data in your tenant — continuously, without needing to activate it and without expiry. The alternative is Privileged Identity Management (PIM), available on Entra ID P2 and higher plans, where a user is eligible for Global Admin without holding it permanently. When they need elevated access, they activate it for a time-limited period — typically 1–8 hours — with MFA required.
The difference from a security perspective is significant. A permanently assigned Global Admin account that gets phished gives the attacker permanent Global Admin access. A PIM-eligible account that gets phished gives the attacker the ability to activate Global Admin — but only if they also pass MFA, and only for the activation window.
The guest admin problem: Guest accounts — external users invited to your tenant — should never hold the Global Administrator role. A guest account with Global Admin means your tenant's most powerful role is held by someone whose primary identity lives outside your control. M365Clarity flags this as an immediate critical finding regardless of how many other Global Admins exist.
Organisations rarely set out to have fifteen permanent Global Admins. A consultant needs access during a project. A department head wants to manage their own licences. A vendor says they need Global Admin for their integration. IT says yes because Global Admin is the path of least resistance. The contractor finishes their project but nobody removes their access. The accounts accumulate.
In the Entra admin centre, go to Roles & admins → Global Administrator. Under Assignments, the Active tab shows permanent assignments — anyone listed here holds Global Admin continuously. Note this view only shows direct role assignments, not group-based assignments. M365Clarity checks both.
The goal is two permanent accounts: emergency break-glass accounts never used for day-to-day administration, with strong passwords, hardware MFA, and monitored for any sign-in activity. Everything else — day-to-day admin tasks, vendor access, project work — should use PIM or a more limited role. Exchange administrators, SharePoint administrators, and User Administrators all have scoped roles that don't require Global Admin. When reducing count, don't just remove the role — replace it with the minimum role needed for that person's actual tasks.
Before you remove access: Verify the account is not used for service authentication. Some older integrations were set up using a user account with Global Admin rather than a dedicated service principal. Check the sign-in logs for non-interactive sign-ins before removing any role assignment.
M365Clarity scans your directory roles and counts permanent Global Administrator assignments — including guest accounts and group-based assignments.
Run a free scan →Related articles