Microsoft 365 Global Admins: How Many You Need and How to Check

What Microsoft recommends

• Fewer than five Global Administrators. Microsoft's Entra overview shows a warning above that number.
• Two or more emergency access ('break-glass') accounts: cloud-only accounts on the tenant's onmicrosoft.com domain, permanently assigned Global Administrator, protected with a phishing-resistant method such as a passkey, and tested at least every 90 days.
• Separate admin accounts. Administrators sign in to their daily mailbox with a normal account and use a separate account, without a mailbox, for admin work.
• Cloud-only admin accounts. An account synchronised from on-premises Active Directory hands an attacker in the local network a path into the cloud.
• The least-privileged role that does the job: Exchange Administrator, User Administrator, Helpdesk Administrator or Billing Administrator are enough for most tasks.

How to check

1. In the Entra admin center, go to Entra ID > Roles & admins > All roles > Global Administrator and open Assignments. Look at both the Active and the Eligible tab.
2. For every account, ask: is this a named person, do they still need it, is it a separate admin account, and is it cloud-only?
3. Repeat for the other highly privileged roles: Privileged Role Administrator, Privileged Authentication Administrator, Security Administrator, Exchange Administrator and SharePoint Administrator.
4. In the Microsoft 365 admin center, open Settings > Partner relationships to see which partners hold delegated admin access, and with which roles.

With Microsoft Graph PowerShell, list who holds Global Administrator (the ID is the role's fixed template ID):

Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
Get-MgRoleManagementDirectoryRoleAssignment -All `
  -Filter "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'" `
  -ExpandProperty Principal |
  ForEach-Object { $_.Principal.AdditionalProperties.userPrincipalName }

How to fix it

1. Create the two break-glass accounts first, so you cannot lock yourself out while cleaning up. Exclude them from Conditional Access policies that could block them, and alert on every sign-in to them.
2. Remove Global Administrator from everyone who does not need it, and give them the narrower role that matches the work.
3. With Entra ID P2 or Entra ID Governance, use Privileged Identity Management (PIM): admins are eligible for a role and activate it for a few hours when needed, with MFA and a reason. Nobody holds standing Global Admin rights.
4. Require phishing-resistant MFA for all admin roles. Conditional Access has a template for it: 'Require phishing-resistant multifactor authentication for administrators'.

For MSPs: delegated access is admin access too

Partner access through the Microsoft Partner Center should use granular delegated admin privileges (GDAP): time-bound relationships with only the roles your technicians need, assigned to security groups in your own tenant. Old relationships that granted Global Administrator by default are exactly the kind of standing access an attacker who compromises an MSP account will use against every client at once. Review them with the client, and remove what is no longer used.

Frequently asked