Too many Global Administrators: finally applying least privilege in Entra ID
In many tenants, a dozen or more accounts hold the Global Administrator role. Each of them can change anything, including security itself. Reducing that number is one of the most cost-effective steps in any hardening plan.
How it gets this way
The causes are almost always the same: the partner who set up the tenant, an administrator who "needed everything" for a migration, a role granted because nobody knew the right one, a service account created in a hurry. Nobody removes the role afterwards, because nobody knows exactly what would stop working.
What Microsoft recommends
Microsoft recommends having fewer than five Global Administrators, plus at least two emergency access accounts excluded from policies that could lock you out. Other administrators should receive more specific roles. Ideally, even the remaining Global Administrators do not hold the role permanently but activate it on demand through Privileged Identity Management, which requires Entra ID P2 or Governance.
Mapping tasks to roles
The method is to start from the tasks actually performed, not from people:
| Task | Suitable built-in role |
|---|---|
| Reset passwords for standard users | Helpdesk Administrator |
| Create and manage users and groups | User Administrator |
| Manage authentication methods | Authentication Administrator |
| Administer email | Exchange Administrator |
| Administer SharePoint, Teams or Intune | SharePoint, Teams or Intune Administrator |
| Assign licences | License Administrator |
| Review security configuration | Security Reader or Global Reader |
| Manage Conditional Access policies | Conditional Access Administrator |
For auditors and read-only tools, Global Reader covers most needs without any write permission.
Caution. Some lesser-known roles are almost as powerful as Global Administrator: Privileged Role Administrator, Privileged Authentication Administrator, Application Administrator. They deserve the same level of scrutiny.
Custom roles and administrative units
When no built-in role fits, custom roles (Entra ID P1 minimum) let you grant only specific permissions. Their scope is still limited to a subset of objects, notably applications and some user operations, so check the available permissions before designing a model. Administrative units complete the picture by restricting a role to a subset of users, such as a subsidiary or a site.
Where to start
- list the current role holders, including through role-assignable groups;
- ask each holder about their actual tasks over the last three months, backed by audit logs;
- assign the targeted role, then remove Global Administrator after an observation period;
- separate administrative accounts from everyday productivity accounts;
- move the remaining roles to eligible assignments if your licence allows it.