Microsoft 365 Global Admin Best Practices

Here’s the short version: Microsoft 365 Global Admin best practices are few standing admins, separate accounts for email, phishing-resistant MFA, and a break-glass door. Living in GA with SMS is how tenants get stolen. Least privilege is the job, even at 15 people.

Microsoft’s Entra role best practices and how to assign roles are the product docs. Privileged roles is the list of what can actually hurt you. This page is the SMB version: what we actually change in a tenant review.

If you just read break-glass and passkeys, this is the standing-privilege post that sits between them.

Why Global Admin is a blast radius

GA can reset anyone, change Conditional Access, add more GAs, read mail if mailbox access is granted, and empty the tenant. A phish against that account is not “someone’s Outlook.” It is the firm.

Most small tenants have:

• The owner’s daily mailbox as GA
• An MSP leftover still GA
• A consultant from 2022 still GA
• No alert when a new GA is added

That list is the incident. MFA on staff does not help if the admin never enrolled. A questionnaire that says “we use MFA” does not revoke the consultant.

Microsoft’s security planning for roles is written for larger directories. The physics is the same at 15 people: fewer standing privileged accounts, stronger proof of identity, a way in when CA fails.

Microsoft 365 Global Admin best practices that hold

1. Two named humans with GA or the ability to become GA, plus two emergency accounts.
2. Separate admin accounts (admin-alex@) that do not receive the daily firehose of mail.
3. Phishing-resistant MFA on those admin accounts.
4. Least privilege for everyone else. Help desk is Helpdesk Administrator, not GA.
5. Alert when a role assignment changes.
6. Review quarterly. If they left, they are gone. Offboarding.

PIM (eligible, activate for a few hours) is better when licensed. Without PIM, the split account plus fewer GAs is still a large upgrade. Do not wait years for a license to take the owner’s mailbox off GA.

What “two people” means in a five-person firm: the owner and one other, not five. The second person can be an office manager with an admin account they rarely use, plus a provider with a named account, plus break-glass. Do not make everyone GA “in case.” In case is the emergency accounts.

Roles you should actually use

You do not need to memorize every Entra role. You need to stop using GA for password resets and mailbox tweaks.

If a task fails without GA, grant the smaller role, not GA “to be safe.” Safe is the opposite.

Help desk is not GA

Password resets, group membership, and “unlock this account” do not require Global Admin. Give Helpdesk Administrator or Password Administrator. If help desk also runs Intune, that is a second role, still not GA. The first time help desk is GA “just for today,” today becomes the steady state.

You can assign roles to groups instead of to people one by one. Microsoft documents group-based role assignment. In a 20-person firm a group named role-helpdesk is enough. Do not nest that group into GA “to make it easier.”

Guest admins from vendors should be time-bound. Vendor risk includes Entra roles, not only a BAA.

Separate admin accounts, then stronger MFA

Daily mail and Teams should be a non-admin UPN. The admin UPN does not get the invoice phish, the “wire this today” thread, or the Teams GIF channel. You sign into the admin account when you need to change the tenant. Then you sign out.

That split is more important than a new logo. A phish against the mailbox you live in should not be a phish against Global Admin.

Then put phishing-resistant MFA on the admin account. Passkeys or FIDO2 keys. SMS and sleepy push prompts are how admin accounts fall. Number matching is better than blind approve. Keys are better than number matching.

Do this before you demote the daily mailbox, or you will lock the only person who can still click through a bad CA change. Order: admin accounts exist, MFA on them, break-glass exists, then demote.

A one-week cleanup

Run it in order. Do not demote the only GA before the new admin accounts can sign in.

1. Export who is GA. Every account, including guests and onmicrosoft.com leftovers. Name an owner for each. Entra audit logs show when roles were last assigned if you need the story, not only the current list.
2. Create admin accounts and emergency accounts if they do not exist. Break-glass is a separate pair: cloud-only, no mail, alerted.
3. Stronger MFA on admin accounts. Keys or passkeys. No SMS.
4. Demote. Remove GA from daily mailboxes and dead consultants. Assign smaller roles. Confirm help desk can still reset staff.
5. Alert and write it down. Role-change alert to a mailbox that is not GA. A one-page “who is GA” list next to the incident sheet.

Cloud-only admin UPNs

Standing admin accounts should be cloud-only when you can. A synced admin dies with the AD problem you might be there to fix. The daily mailbox can stay hybrid. The nuclear role should not.

Help desk must know they are not GA. If they need a password reset role, give that, not the keys to Conditional Access.

A new client we reviewed had six Global Admins: the owner, the office manager, both on daily mail, a former MSP shared mailbox, a consultant UPN nobody recognized, and an onmicrosoft.com leftover. We exported, created admin-owner and admin-manager accounts with keys, built break-glass, demoted the daily mailboxes, disabled the ghost consultant, and left our own access on a named least-privilege account plus GA only when the contract said so. Role-change alerting went to help desk. Quarterly review went on the calendar. Nobody lost the ability to reset a staff password. Several people lost the ability to destroy the tenant by accident.

That cleanup is usually a half-day plus enrollment, not a six-week program.

Consultants, MSPs, and PIM

If we are your MSP, we should not be standing GA on a shared mailbox either. Named admin accounts, least privilege, time-bound when possible, offboarding when the contract ends. Ask your current provider how many GA accounts they hold. If they cannot answer, that is an answer.

A prior vendor still in GA is the most common finding we have on new tenants. It is also the easiest win. Disable, then remove the role. Watch sign-in after.

PIM when you have it

Privileged Identity Management lets a person be eligible for GA and activate for a few hours with MFA and a reason. That is the right end state. Many Business Premium tenants do not include PIM. Do not wait for a license to split the daily mailbox off GA. Split now. Add PIM when you have it. Activation alerts are the point of PIM. If nobody reads them, you bought a timer.

Least privilege does not replace legacy auth blocks, the Microsoft 365 security checklist, or backups. A clean GA list on a tenant with IMAP basic auth is still a side door.

Cybersecurity for Microsoft 365 starts at identity. Global Admin is the identity that can undo everything else.

Standing access reviews

Every 90 days: who is GA, who is eligible, which guests have roles, which vendors still have admin. If the contract ended, the role ends. Put it next to guest access reviews. Same muscle.

Global Reader is the role for someone who needs to look, not change. Auditors and vCIOs can live there. They do not need GA to read a Conditional Access screenshot.

Shared mailboxes should never be GA. If a leftover msp@ or admin@ shared mailbox still has the role, that is a standing credential with a distribution list on it. Disable the role, then the mailbox sign-in. Watch the sign-in log for a week in case a script still uses it.

Printable Global Admin checklist

1. Export every GA, including guests and onmicrosoft.com.
2. Two human admin accounts that are not daily mail.
3. Two emergency accounts. See break-glass.
4. Phishing-resistant MFA on standing admin accounts.
5. Demote daily mailboxes and dead consultants.
6. Help desk gets a password role, not GA.
7. Alert on role changes. Watch the audit log.
8. Vendor admin accounts named, time-bound, offboarded with the contract.
9. Quarterly review on the calendar. Same muscle as guest access reviews.
10. Screenshot for insurance: who is GA today.

If step 1 lists more than two humans plus emergencies, you are not done. The extra names are the project.

If you want the GA list cleaned, admin accounts split, and leftover consultants removed, contact Secure Techies. We work from Canoga Park. We will export who is GA today and leave you with two humans, two emergency doors, and no daily mailbox sitting on the nuclear role. Bring a screenshot of Entra roles. The meeting is the screenshot.

Secure Techies

The Secure Techies team brings decades of combined experience in managed IT services, cybersecurity, and cloud solutions. Based in Los Angeles County, we help businesses across Southern California and nationwide protect …