What this check looks at
Counts permanent and eligible Global Administrator assignments against the accepted range of two to four.
Global Administrator is the one Microsoft Entra role that can do everything: change any setting, grant itself access to any data, assign any role and remove other administrators. The person who creates a tenant becomes a Global Administrator, and small tenants tend to add more over the years: the IT manager, a director, every MSP engineer, a reseller account. Most of those people only ever need a narrower role.
This check counts every Global Administrator assignment, permanent (standing) and PIM-eligible. The check fails when fewer than two accounts hold the role, because one lost password, phone or departed employee then locks the organisation out, or when more than four accounts hold it permanently (critical above eight). It warns when standing assignments are four or fewer but the total including eligible assignments is above four. The evidence shows the count against CIS (two to four) and CISA SCuBA (two to eight).
Each extra Global Administrator is another password to phish, another phone to SIM-swap and another browser holding a session worth stealing. People who hold the role for convenience usually do their daily work with it, so a malicious link opened from their inbox runs with full tenant rights, and changes made under surplus or shared admin accounts are hard to attribute afterwards.
Why it matters
Too many Global Administrators multiplies the attack surface and makes change attribution impossible. Too few — fewer than two — means a single lost credential locks the organisation out of its own tenant.
In practice: a 60-person accountancy has seven Global Administrators, including two former MSP engineers whose accounts were never removed and a partner who rarely signs in. One dormant account is phished. With Global Administrator the attacker creates a hidden admin account, adds forwarding rules on the partners’ mailboxes and grants an app full mailbox access. The breach is found weeks later and all seven accounts have to be investigated.
At the other extreme, a tenant with a single Global Administrator is one lost phone or one resignation away from a recovery case with Microsoft support, which takes days and needs proof of ownership while nobody can change a setting.
CIS Microsoft 365 Foundations Benchmark 1.1.3 asks for between two and four Global Administrators; CISA SCuBA MS.AAD.7.1 allows two to eight and MS.AAD.7.2 asks for finer-grained roles to be used instead. CIS Controls v8 safeguard 6.8 (role-based access control), ISO 27001 A.8.2 (privileged access rights), the NCSC CAF privileged user management outcome and the Cyber Essentials user access control requirement all expect admin rights limited to the people who need them.
How to fix it
Where: Entra admin centre → Identity → Roles and administrators → Global Administrator
Before you start
- Work out what each Global Administrator actually does, and pick the narrower role that covers it (User, Exchange, SharePoint, Teams or Helpdesk Administrator).
- Keep two to four Global Administrators, including the break-glass accounts.
Step by step
- List the current Global Administrators. In the Microsoft Entra admin centre, go to Entra ID > Roles & admins > Roles & admins, search for Global Administrator and open it. Review its assignments (with Entra ID P2 there are Eligible and Active tabs). For each account, note whether it is a named person, an emergency access account or a shared account, and when it last signed in.
- Choose a narrower role for each person. For each holder who is not an emergency access account, write down what they actually do in the admin centres and pick the least-privileged role that covers it: User Administrator for accounts and licences, Helpdesk Administrator for password resets, Exchange, SharePoint or Teams Administrator for those services, Security Administrator or Security Reader for Defender, Billing Administrator for invoices. Agree the change with each person first.
- Move MSP access to GDAP. Where some Global Administrators are MSP engineers’ named accounts in the client tenant, set up a granular delegated admin privileges (GDAP) relationship in Partner Center (Customers > the customer > Admin relationships) with the specific roles each support team needs, assign them to the MSP’s security groups, and then remove the named accounts from Global Administrator.
- Assign the narrower roles. Open each chosen role under Roles & admins > Roles & admins, select Add assignments, pick the person and save. With Entra ID P2, make the assignment Eligible rather than Active so it is activated through Privileged Identity Management. Ask each person to sign in and confirm they can still do their job before going further.
- Remove the surplus Global Administrator assignments. Back on the Global Administrator role, select each assignment that is no longer needed and choose Remove. Leave between two and four in total, normally the two cloud-only emergency access accounts plus one or two named administrators who really need the role, ideally as PIM-eligible assignments.
- Add a second holder if there is only one. If the check failed because only one account holds the role, create a cloud-only emergency access account (see the emergency access finding) and assign it Global Administrator permanently, rather than giving the role to another everyday account.
- Confirm the count. Reopen Global Administrator under Roles & admins and count the assignments: there should be between two and four, with no more than four active. The Microsoft 365 admin centre shows the same list under Roles > Role assignments > Global Administrator. The finding clears at the next assessment.
What users will notice
People moved to a narrower role lose access to admin areas outside it. Agree this with them first.
How to confirm it worked
Entra ID, Roles and administrators, Global Administrator lists no more than four active assignments.
Frameworks and controls
This check maps to controls in 19 frameworks. Passing it is evidence that the setting is in place, not a certification against any of them.
| Framework | Control |
|---|---|
| Cyber Essentials | User access control |
| Cyber Essentials Plus | Account separation test: admin accounts used only for administrationUser access control |
| NCSC CAF | B2.c Privileged user management |
| DSPT | Standard 4: Managing data access |
| DORA | Art. 9(4)(c) Limiting logical access to what is required |
| NIS2 | Art. 21(2)(i) Access control and asset management |
| Microsoft Cloud Security Benchmark | PA-1 Separate and limit highly privileged/administrative users |
| Zero Trust | Identities |
| Secure Score | Designate more than one global adminUse least privileged administrative roles |
| SOC 2 | CC6.3 Role-based access and least privilege |
| PCI DSS 4.0.1 | 7.2.2 Access is assigned by job function with least privilege |
| NIST SP 800-171 | 3.1.5 Employ the principle of least privilege3.1.2 Limit system access to the types of transactions and functions authorised users may execute |
| CMMC Level 2 | AC.L2-3.1.5 Least PrivilegeAC.L2-3.1.2 Transaction & Function Control |
| ISO 27001:2022 | A.8.2 Privileged access rights |
| CISA SCuBA | MS.AAD.7.1v1 Between two and eight Global AdministratorsMS.AAD.7.2v1 Finer-grained roles used instead of Global Administrator |
| CIS M365 | 1.1.3 Ensure that between two and four global admins are designated |
| CIS Controls v8.1 | 6.8 Define and maintain role-based access control (IG3) |
| NIST CSF 2.0 | PR.AA-05: Access permissions, entitlements, and authorizations are defined in a policy, managed, enforced, and reviewed, and incorporate the principles of least privilege and separation of duties |
| NCSC 10 Steps | Identity and access management |
The framework mappings were last checked against the published standards in October 2026.
Microsoft’s documentation
- Best practices for Entra roles (Microsoft Learn)