What this check looks at
Checks that accounts holding an administrator role have no licence beyond Entra ID, so they have no mailbox, OneDrive or Teams to be phished through.
An administrator role and an everyday working life do not mix well on one account. A licence such as Microsoft 365 Business Premium or E3 gives the account a mailbox, OneDrive, Teams and the Office apps, so the account that can change everything in the tenant also receives email from strangers, opens attachments and browses the web. Microsoft and CIS recommend a separate, cloud-only admin account for each administrator, with no application licence: at most Microsoft Entra ID P1 or P2, for Conditional Access and PIM.
The check takes every user account with an active assignment of one of twelve administrator roles (Global, Privileged Role, Security, Conditional Access, Exchange, SharePoint, User, Helpdesk, Authentication, Application, Cloud Application and Billing Administrator) and looks at the licences it holds. It fails when any of them holds a licence that includes anything beyond Entra ID, such as Exchange Online, SharePoint, Teams or the Office apps, and lists them. It warns when an administrator could not be found among the accounts read.
Phishing reaches people through their inbox, Teams chat and shared documents. When the admin account has none of those, a phishing email can only reach the everyday account, which holds no admin rights, and an attacker who compromises that account still has to start again to reach the administrator.
Why it matters
An administrator account with a mailbox reads email and opens links, which is how most administrator accounts are taken over. Keeping admin accounts for administration only, with no apps, means a phishing email never reaches the account that can change everything.
In a typical case the IT manager of a 60-person firm uses one account for everything, with Global Administrator on it. A fake e-signature email lands in that inbox, a phishing kit captures the session, and within minutes the attacker is a Global Administrator: they add their own MFA method, create a second admin account and start exporting mailboxes. Had the admin rights sat on a separate account with no mailbox, the same email would have compromised only an ordinary user.
There is no licence cost to the change: the admin account needs no Microsoft 365 licence, so the person keeps a single licence on their everyday account. The price is the small inconvenience of signing in to a second account, usually in its own browser profile, for admin work.
Cyber Essentials requires administrative accounts to be used only for administration, not for email or web browsing. The CIS Microsoft 365 Foundations Benchmark (1.1.4) asks for administrative accounts to hold no application licence, and the rule maps to NIST CSF 2.0 PR.AA-05.
How to fix it
Where: Microsoft 365 admin centre → Users → Active users → Licences and apps
Before you start
- For each account listed, check the person has a separate everyday account for mail, Teams and files.
- Check the admin account’s mailbox and OneDrive hold nothing that is needed: content is deleted 30 days after the licence goes.
Step by step
- Work out each listed account’s situation. Start from the accounts in this finding’s evidence. In the Microsoft 365 admin centre, go to Users > Active users, open each and look at Licences and apps, and at the roles it holds. Decide whether it is the person’s everyday account (mailbox in daily use) or an admin account that has simply been given a licence.
- Create a separate admin account where the person has only one. In the Microsoft 365 admin centre, go to Users > Active users > Add a user. Use the tenant’s .onmicrosoft.com domain and a clear name such as adm-jsmith@contoso.onmicrosoft.com, so the account depends on neither mail nor directory synchronisation. On the licence page, choose to create the user without a product licence. Have the person register MFA on it, ideally a passkey or security key, at https://aka.ms/mysecurityinfo.
- Move the roles to the admin account. In the Microsoft Entra admin centre, go to Entra ID > Roles & admins, open each role the everyday account holds and select Add assignments to add the new admin account (as eligible through PIM if the tenant has Entra ID P2). Have the person sign in with the admin account and confirm it works, then remove the role assignments from the everyday account.
- Check a licensed admin-only account’s content first. Where the admin account is already separate but licensed, check its mailbox and OneDrive hold nothing that is needed, and export or share anything that is. Once the licence is removed, Exchange keeps the mailbox for 30 days and then deletes it.
- Remove the application licences. In the Microsoft 365 admin centre, go to Users > Active users, select the admin account, open Licences and apps, untick every Microsoft 365 or Office 365 licence and select Save changes. If the account needs licensing for Conditional Access or PIM, assign a standalone Microsoft Entra ID P1 or P2 licence instead, which this check accepts. Switching off individual apps inside Business Premium or E3 is not enough: the suite licence itself is what is counted.
- Set up how the administrator works day to day. Show each administrator how to keep the two accounts apart: a separate browser profile signed in with the admin account and used only for the admin centres. Update the client’s documentation and the MSP’s credential records with the new account names.
- Confirm. In the Microsoft 365 admin centre, Users > Active users, filter on the admin roles: each admin account should show no licence, or only Microsoft Entra ID P1 or P2. Re-run the assessment to confirm the finding passes.
What users will notice
Administrators sign in to their admin account only for admin work; it has no mailbox, OneDrive or Teams.
How to confirm it worked
Microsoft 365 admin centre, Active users, filter on the admin roles: each admin account shows no licence, or only Microsoft Entra ID P1 or P2.
Frameworks and controls
This check maps to controls in 16 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials Plus | Account separation test: admin accounts used only for administration |
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-1 Separate and limit highly privileged/administrative users |
| Zero Trust | Identities |
| SOC 2 | CC6.3 Role-based access and least privilege |
| PCI DSS 4.0.1 | 7.2.2 Access is assigned by job function with least privilege |
| NIST SP 800-171 | 3.1.6 Use non-privileged accounts for non-security functions |
| CMMC Level 2 | AC.L2-3.1.6 Non-Privileged Account Use |
| ISO 27001:2022 | A.8.2 Privileged access rights |
| CIS M365 | 1.1.4 Ensure administrative accounts use licences with a reduced application footprint |
| CIS Controls v8.1 | 5.4 Restrict administrator privileges to dedicated administrator accounts (IG1) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Protect your Microsoft 365 administrator accounts (Microsoft Learn)