Too Many Global Admins in Microsoft 365? How to Cut Them Back

Most Microsoft 365 tenants should have fewer than five Global Administrators, two of them emergency accounts nobody uses day to day. If you cannot name every Global Administrator in your tenant and say why each one needs the role, you have more than you need.

The short answer

Open the Global Administrator role in your Microsoft Entra admin center and count the names. Microsoft recommends keeping that number below five. Everyone else should do their daily work in narrower roles, such as User Administrator, Helpdesk Administrator or Exchange Administrator, that cover the job in front of them and nothing more.

The fix is rarely technical. It is a list, a reason for every name on it, and the discipline to remove the role when the reason ends.

How the role spreads

Nobody sets out to have eight Global Administrators. The number grows one sensible-sounding decision at a time:

• The migration consultant. A project needed full access for a weekend. The project finished. The access did not.
• The manager who asked once. Someone needed to add a user while IT was on leave, so they were given the top role because it was quicker than finding the right one.
• The shared admin account. An account called "admin" was created when the tenant was set up. Three people know the password, and nobody is sure whose phone the sign-in prompts go to.
• The account that came across from the server room. An on-premises administrator account was synchronised to Microsoft 365 and given cloud admin rights along the way.
• The person who left. Their mailbox was converted, their licence was reassigned, and their role assignment stayed where it was.

Each decision made sense at the time. Together they leave a tenant where several accounts can change anything, and the organisation can only explain some of them.

What a Global Administrator can actually do

Global Administrator is the broadest role in Microsoft 365. According to Microsoft's own guidance, it can read and change almost every administrative setting in Microsoft Entra ID and most configuration settings across Microsoft 365, and it can elevate its own access to read data.

In practical terms, one compromised Global Administrator account can reset other people's passwords, switch off security policies, add new administrators, and give an attacker a quiet way back in after the original password has been changed. That is why the number of these accounts matters more than the number of ordinary user accounts.

What Microsoft recommends

Microsoft's published best practices for Microsoft Entra roles are specific:

• Fewer than five Global Administrators. When five or more are assigned, the Entra admin center shows an alert on its overview page.
• Two emergency access accounts. Cloud-only accounts, permanently assigned the role, not tied to any one person, and used only when normal administrator accounts cannot sign in.
• Fewer than ten privileged role assignments in total, across all the powerful roles, not just Global Administrator.
• Multifactor authentication on every administrator account. Microsoft states that an account is 99.9% less likely to be compromised when MFA is used.
• Cloud-only accounts for administrator roles. A synchronised on-premises account that holds a cloud admin role means a compromise on the local network can reach Microsoft 365 as well.
• Regular access reviews, because people change jobs and keep the access they no longer need.

Narrower roles for everyday work

Most of what people use Global Administrator for can be done with a smaller role. A starting map:

• Create and manage user accounts: User Administrator
• Reset passwords for staff: Helpdesk Administrator
• Assign licences: License Administrator
• Manage subscriptions and invoices: Billing Administrator
• Mailboxes and mail flow: Exchange Administrator
• Teams settings and policies: Teams Administrator
• SharePoint sites and sharing: SharePoint Administrator
• Conditional Access policies: Conditional Access Administrator
• Read everything, change nothing, for audits: Global Reader

One person can hold two or three of these roles if their job needs them. That is still a smaller blast radius than the top role, and it makes the audit log easier to read.

The trouble with a shared admin account

A shared administrator account is the hardest one to defend. The audit log records the account, not the person, so when something changes nobody can say who did it. The password has to be shared, so it is written down or sent in a chat. And multifactor authentication only works if the prompt goes to a device the right person holds.

The fix is to give each administrator a named account of their own, move the shared account's role to them, and then disable the shared account. If the shared account was serving as an emergency account, replace it with proper emergency access accounts that follow Microsoft's guidance.

A clean-up you can do this week

1. List them. In the Microsoft Entra admin center, open Roles and administrators, then Global Administrator, and export or note every assignment.
2. Put a name and a reason next to each one. If nobody can give a reason, that account goes to the top of the list.
3. Keep two emergency access accounts. Cloud-only, strong credentials stored securely, sign-ins monitored, and not used for daily work.
4. Move everyone else to narrower roles. Use the list above as a starting point and give each person only the roles their work needs.
5. Remove access that belonged to a project. Consultants and contractors should lose the role when the work ends, or be given time-limited access in the first place.
6. Retire the shared account. Named accounts for every administrator, then disable it.
7. Require MFA on every admin role. If you have not checked whether MFA is enforced rather than just enabled, see our article on MFA enabled versus enforced.
8. Put a review in the calendar. Every quarter, run the same count. Role assignments drift back if nobody looks.

Frequently asked questions

How many Global Administrators should a Microsoft 365 tenant have?

Fewer than five, according to Microsoft. For most small and mid-sized organisations that means two emergency access accounts plus one or two named administrators who genuinely need tenant-wide control.

Is one Global Administrator enough?

No. If the only Global Administrator is locked out, leaves, or loses their phone, nobody can fix it from inside the tenant. Microsoft recommends two cloud-only emergency access accounts for exactly this reason.

Can our IT provider manage Microsoft 365 without being a Global Administrator?

Yes. Most day-to-day administration can be done with narrower roles such as User, Exchange or Helpdesk Administrator. Ask your provider which roles they hold in your tenant and why each one is needed.

Does Microsoft 365 warn us when there are too many?

Yes. The Microsoft Entra admin center shows a Global Administrators alert on its overview page when five or more are assigned, and a warning on the Roles and administrators page when privileged role assignments go above ten.

What is Privileged Identity Management?

Privileged Identity Management, or PIM, lets you make someone eligible for a role instead of holding it permanently. They activate it when needed, for a set time, and it is removed automatically afterwards. It requires Microsoft Entra ID P2 or Microsoft Entra ID Governance licences, so check your plan before you count on it.

Where to start

Counting your Global Administrators takes ten minutes, and it is one of the first things we check in a cloud security posture assessment. If the list surprises you, we can help you move each person to the role they actually need, set up proper emergency access accounts, and put a review cycle in place.

Onprem2Cloud IT Solutions Co. is a Microsoft CSP partner based in Muntinlupa City, Metro Manila. See our cybersecurity services or send us an enquiry.