3 min read

How To Secure Admins in Microsoft 365

Picture of Nick Ross Nick Ross : Oct 27, 2025 10:00:00 AM

Microsoft 365 Security

Privileged accounts are the #1 target for attackers. One compromised Global Administrator can mean full control of mail, SharePoint, Teams, Defender…everything. The fallout is real: downtime, legal exposure, regulatory headaches, and direct financial loss.

A pattern I see often: IT teams feel safe because they’ve rolled out MFA and Conditional Access for users… while the most powerful accounts in the tenant still have gaps and exceptions. This post shows you exactly how to find those gaps and level-up admin security from “basic” to “mature,” step by step.

The Hidden Problem: Strong Users, Weak Admins

blog_secure_admins_1

Even in well-run environments, I routinely find:

Too many Global Admins (often created during migrations or vendor setups)
Service accounts with GA for third-party integrations (left out of Conditional Access)
MFA exceptions for “testing” or “it might break automation”
Global Admin tied to a daily driver user (email, Teams, SharePoint)
Shared credentials saved in notes, chats, or unsecured vaults

Attackers live for these cracks. One bad exception can unravel the strongest user controls.

The Admin Security Framework

Today I am going to take you through a progressive, 8-step framework for securing Global Admin accounts. Think of this as a progress bar for your tenant. Each level adds resilience. Your goal is to move from red → yellow → green.

Level 1 — Inventory Every Admin

Goal: Know what you’re defending.

Why it matters: You can’t protect what you can’t see.

Where to look:

Entra admin center → Roles & administrators → Global administrator
Export active assignments and review Last sign-in, User type, and Usage

Questions to answer (per account):

Is it active?
Does it have mfa? What mfa is on the account?
Who has access?
Where are the credentials stored?
Is it tied to a regular user logging in every day?
Which users are our break glass users?

Quick win: Remove/disable any GA created for retired integrations. Shrinks attack surface immediately.

Level 2 — Establish & Name Break-Glass Accounts (Emergency Access)

Goal: Don’t get locked out.

Why it matters: Prevent lockout during Conditional Access failures or outages.

Best practice:

Create two cloud-only break-glass accounts with long, random passwords
Exclude exactly one from Conditional Access; include the other
Store in a secure vault (consider splitting password/keys among custodians)
Use a clear naming convention (e.g., EMERGENCY-GA-01, EMERGENCY-GA-02)
Monitor them like crown jewels (no interactive use outside emergency)
Check out my full guidance on this here: Best Practices for Break Glass Accounts

Level 3 — Validate MFA (and Move Toward Phishing-Resistant)

Goal: Make admins harder to compromise

Why it matters: Not all MFA is equal.

Actions:

Review Authentication methods → User registration details for admins
Disable weak methods tenant-wide (Email OTP, SMS where feasible)
Enable phishing-resistant options (FIDO2 passkeys, Windows Hello for Business, CBA)
Create a Conditional Access policy for admin roles that requires an Authentication strength: Phishing-resistant

Level 4 — Enforce Least Privilege (Ditch “Permanent GA”)

Goal: Reduce your attack surface

Why it matters: Fewer standing privileges = smaller blast radius.

Do this:

Convert “always-GA” users to role-appropriate rights (e.g., Intune Admin, Exchange Admin, Global Reader)
Replace user-based service accounts with Service Principals / App Registrations / Managed Identities using delegated or application permissions scoped to the minimum required
Target: 2–4 Global Admins max per tenant (Microsoft & CIS guidance)

“ Vendor pushback? Challenge “needs Global Admin” claims. Most integrations can run on least-privilege Graph permissions.

Level 5 — Dedicated Admin Workstations (PAWs) or Secure VMs

Goal: Isolate Admin duties to secure/isolated devices

Why it matters: Admins shouldn’t manage tenants from the same device they browse the web on.

Options (good → better → best):

Good: Conditional Access requiring Compliant device for admin roles
Better: Isolated admin VM (device or Azure) with hardened baseline
Best: Full Privileged Access Workstation (PAW) model + named locations

Level 6 — Just-in-Time Admin with PIM (P2)

Goal: JIT access

Why it matters: Removes standing privilege. Elevate only when needed.

PIM setup checklist:

Make admins Eligible (not Active) for roles
Require justification and (optionally) ticket ID for activation
Configure approval for sensitive roles
Limit activation duration (e.g., 1–4 hours)
Notify security contacts on activation

Result: Even if credentials are stolen, no admin rights exist until PIM activation occurs.

Level 7 — Alerts for Role Assignments & Unusual Sign-Ins (P2)

Goal: Proactive Monitoring for New GAs

Why it matters: Early detection = fast containment.

Where/how:

In PIM, enable notifications when members become Eligible or Active
In Microsoft 365 Defender, create custom alert policies for “Add member to role” events and route email to a shared SOC mailbox
(Advanced) Stream AADAuditLogs to Log Analytics/Sentinel and alert on Global Admin changes (KQL) Configure a Log Analytics workspace and a custom workbook – Microsoft Entra ID | Microsoft Learn

Level 8 — Access Reviews (P2)

Goal: Proactive, consistent reviews

Why it matters: Prevents “permissions creep.”

Set it and (don’t) forget it:

Identity Governance → Access Reviews → New review
Scope to Global Administrator (Active + Eligible)
Frequency: Quarterly (14–15 day review window)
Reviewers: Selected owners/security (not “self” for service accounts)
Auto-apply: Optional—recommend caution for service accounts
Require reason; enable reminders; notify via ticketing

Admin Inventory Checklist (Copy/Paste)

Use this in your internal wiki or as a shared doc for every tenant:

List all Global Admin assignments (active + eligible)
For each GA: Active? Still needed?
MFA present? Which methods? (Aim for phishing-resistant)
Credential storage: where, who has access, rotation cadence
Tied to daily user? (Move to separate admin identity)
Service accounts: replace with Service Principal/App Reg
Break-glass: 2 cloud-only accounts, naming, storage, monitoring
Least privilege: reduce GA count; use scoped roles
PAW/Compliant device enforced for admin sign-in
PIM enabled with approvals/justification
Alerts configured for role changes & unusual admin sign-ins
Access Reviews scheduled (quarterly)

CloudCapsule: Automated Checks for Global Admins

blog_secure_admins_2

blog_secure_admins_3

See the exact best practices from this post…automated. CloudCapsule scans your tenants for Global Admin risks (excessive admins, weak/absent MFA, daily-use identities, CA exclusions) and runs a step-by-step Admin Hardening Playbook to close gaps fast. Perfect for MSPs who want consistent, provable outcomes across every client.

Ready to level up your admin security?

Book a Demo