Too Many Admins: The Quiet Risk in Your Microsoft 365

Ask most business owners how many people have administrator rights in their Microsoft 365 tenant, and the honest answer is "I'm not sure". Ask the same question of the IT manager and the number is often higher than either of them expected.

Admin rights accumulate. A consultant needed access for a migration and never lost it. A director asked to be "made an admin" so they could stop waiting for IT. A finance user was given Global Administrator because it was the quickest way to fix a licensing problem. Years later, nobody remembers why.

This matters because an administrator account is the one an attacker most wants. If a standard user is phished, the damage is usually limited to that person's mailbox and files. If an administrator is phished, the attacker can create new accounts, change mail rules, switch off protections and read almost anything in the tenant.

Why admin sprawl happens

Sprawl is rarely negligence. It is usually the side effect of getting things done quickly.

• Convenience grants. Giving someone the highest role is faster than working out which narrower role they actually need.
• Project leftovers. Access granted for a migration, an audit or a vendor engagement is not removed when the work ends.
• Shared admin accounts. A single "admin@" login used by several people means nobody is accountable and MFA often gets weakened to keep it convenient.
• Day-to-day use of admin accounts. The IT team reads email and browses the web with the same account that can reconfigure the tenant.

None of these look dangerous on the day. Together they leave you with many accounts that can do serious damage, and very little visibility of who holds them.

The principle: least privilege

Least privilege means every person has the access they need for their job, and no more. For administrators, that translates into a few practical rules.

Use specific roles, not Global Administrator

Microsoft 365 has many built-in admin roles, such as Exchange Administrator, User Administrator, Helpdesk Administrator and Security Reader. Most tasks need one of these, not the Global Administrator role. Keep Global Administrator for a very small number of people, and review that list regularly. Microsoft's own guidance recommends limiting the number of Global Administrators and using roles with the fewest permissions wherever possible.

Separate admin accounts from daily accounts

Anyone with admin rights should have two identities: a normal account for email and browsing, and a dedicated admin account used only for administration. The admin account should not have a mailbox and should not be used to open links or attachments. This single change removes the most common route from a phishing email to a compromised tenant.

Protect admin accounts harder than everyone else

Admin accounts should have the strongest sign-in controls you can apply. Phishing-resistant MFA is the target, as we explain in our article on MFA fatigue attacks. Add Conditional Access policies so that admin sign-ins are only accepted from managed devices and expected locations, and block legacy authentication entirely.

Make elevation temporary

Where your licensing allows it, Privileged Identity Management lets people hold an admin role only when they need it, for a limited time, with an approval step and a record of what was done. Standing access becomes the exception rather than the rule. If you do not have that licensing, a documented process that grants a role for a task and removes it afterwards achieves much of the same effect.

Keep break-glass accounts, and keep them safe

You do need a couple of emergency accounts that bypass normal Conditional Access, so you are never locked out of your own tenant. Give them long, unique credentials stored securely offline, exclude them from nothing else, and set up alerts so that any sign-in to them is investigated immediately.

A practical review you can do this month

You do not need a large project to start. A first pass looks like this:

1. List every account holding an admin role in the Microsoft Entra admin centre, including guests and service accounts.
2. Ask why each one has it. If nobody can answer, that is your first removal candidate.
3. Downgrade where possible. Replace Global Administrator with the specific role the person actually uses.
4. Check for shared and unused admin accounts. Disable anything that has not signed in for a long time and confirm the owner before deleting.
5. Confirm MFA on every admin account, and that it is not the weakest method available.
6. Set a review date. Quarterly is realistic for most small and mid-sized businesses.

Pay particular attention to leavers and third parties. Our piece on employee offboarding covers how lingering access builds up, and the same discipline applies to suppliers who were given admin rights for a project.

Where this fits in the bigger picture

Reducing admin rights will not stop every attack, but it shrinks the blast radius of the ones that get through. It also supports other work you may already be doing, from tightening Microsoft 365 security settings to meeting the access control expectations that come with insurance questionnaires, ISO 27001 and POPIA.

If you would like a second pair of eyes on who holds the keys in your environment, our cybersecurity team can run an access review as part of a wider assessment.

The takeaway

Count your administrators this week. If the number surprises you, that is useful information, and the fix is usually a series of small, sensible changes rather than a big project. Fewer admins, narrower roles, separate accounts and stronger sign-in controls will make your tenant a much harder target.