Last Updated: March 2026

One of the most critical security responsibilities for any Microsoft 365 administrator is controlling who has Global Administrator privileges.

The Global Administrator role provides full control over an entire Microsoft 365 tenant, including:

• User and identity management
• Security configuration
• Data access across services
• Licensing and billing
• Microsoft Entra ID configuration
• Conditional Access and security policies

Because of this broad authority, Global Admin accounts are a high-value target for attackers. A compromised Global Administrator can potentially lead to a full tenant breach.

Despite the importance of this role, many organizations unknowingly accumulate too many Global Admin accounts over time due to:

• Legacy administrators
• Temporary project access
• IT staff changes
• Third-party integrations
• Emergency troubleshooting access

In this guide, we will walk through how to audit Global Administrator access in Microsoft 365, identify potential risks, and implement best practices to secure privileged roles.

This article focuses on real-world IT operations, not just theory, and includes practical steps that enterprise administrators can implement immediately.

Quick Fix Summary

If you need to quickly review Global Administrator access in Microsoft 365:

• Check Microsoft Entra ID → Roles and Administrators → Global Administrator
• Export the list of users assigned to the role
• Review Privileged Identity Management (PIM) for eligible admins
• Audit sign-in activity for privileged accounts
• Reduce permanent Global Admin accounts to 2–4 maximum

Regular audits of privileged roles significantly reduce the risk of account compromise.

Step-by-Step Guide to Auditing Global Admin Access

Step 1: Review Global Administrator Role Assignments

The first step is to identify every account currently assigned the Global Administrator role.

How to Check Global Admins

1. Open the Microsoft Entra Admin Center
2. Navigate to:

Identity
→ Roles & administrators
→ Global Administrator

3. Review the Assigned users list.

You will see:

• Permanent administrators
• Service accounts
• Privileged access groups
• Possibly guest users

What to Look For

During this review, check for:

• Users who no longer work in IT
• Accounts assigned during temporary projects
• Third-party support vendors
• Disabled accounts still assigned roles
• Duplicate admin accounts

A common real-world issue is former IT staff accounts still holding privileged roles.

Step 2: Review Privileged Identity Management (PIM)

If your organization uses Privileged Identity Management, administrators may have eligible access rather than permanent Global Admin roles.

Eligible roles must be activated when needed.

How to Check PIM Access

Navigate to:

Microsoft Entra ID
→ Privileged Identity Management
→ Azure AD roles
→ Global Administrator

Here you can view:

• Eligible administrators
• Active administrators
• Activation history

Why PIM Matters

PIM dramatically improves security by:

• Eliminating permanent privileged access
• Requiring MFA for role activation
• Providing approval workflows
• Logging all admin activity

In mature environments, no user should have permanent Global Admin access unless absolutely required.

Step 3: Audit Global Admin Sign-In Activity

Having Global Admin access is one risk — actively using that access is another.

Administrators should regularly review sign-in activity.

Where to Check

Navigate to:

Microsoft Entra ID
→ Monitoring
→ Sign-in Logs

Filter results by:

• Role: Global Administrator
• Risky sign-ins
• Location anomalies
• Failed login attempts

Indicators of Risk

Watch for:

• Sign-ins from unfamiliar countries
• Sign-ins outside normal working hours
• Legacy authentication usage
• Multiple failed attempts

Many real-world breaches begin with credential theft followed by privileged login attempts.

Step 4: Review Role Assignment History

Understanding when and why privileged access was granted is essential.

Audit logs reveal this information.

How to Access Role Changes

Navigate to:

Microsoft Entra ID
→ Audit Logs

Filter by activity:

• Add member to role
• Remove member from role
• Update role assignment

This allows administrators to track:

• who granted the access
• when the role was assigned
• whether the change was legitimate

Step 5: Identify Non-Human Accounts with Global Admin

Service accounts and automation tools sometimes receive Global Admin privileges unnecessarily.

Examples include:

• migration tools
• backup software
• monitoring platforms
• automation scripts

Why This is Dangerous

Service accounts typically:

• lack MFA
• have long-lived credentials
• run unattended

If compromised, they provide attackers persistent privileged access.

Best Practice

Instead of Global Admin privileges, use:

• Least privilege roles
• App registrations with scoped permissions
• Managed identities

Additional Security Best Practices

Limit the Number of Global Admin Accounts

Microsoft recommends maintaining fewer than five Global Administrator accounts.

Typical configuration:

• 2 permanent break-glass accounts
• 2–3 privileged administrators via PIM

This reduces the attack surface significantly.

Create Break-Glass Emergency Accounts

Emergency accounts are used when identity services fail.

Best practices include:

• No Conditional Access policies applied
• Strong passwords stored securely
• Accounts monitored but rarely used

These accounts should only be used during identity service outages or lockouts.

Enable Multi-Factor Authentication for All Admins

MFA is non-negotiable for privileged accounts.

Security breaches frequently occur because:

• MFA was disabled
• legacy authentication was allowed
• service accounts bypassed policies

Use Conditional Access policies to enforce MFA on all administrative roles.

Monitor Privileged Activity with Alerts

Security teams should configure alerts for events such as:

• new Global Admin assignments
• suspicious sign-ins
• PIM activations
• high-risk logins

These alerts allow organizations to respond quickly to potential threats.

Real-World IT Experience: The Hidden Risk of Global Admin Sprawl

In many organizations, Global Admin accounts slowly accumulate over time.

This typically happens during:

• Microsoft 365 migrations
• mergers and acquisitions
• vendor support access
• IT team transitions

Without regular audits, environments that should have three or four Global Admin accounts may end up with ten or more privileged users.

From a security perspective, this significantly increases the likelihood that one compromised credential could expose the entire tenant.

Mature organizations treat privileged access management as a continuous security process, not a one-time configuration.

FAQ

How many Global Administrators should a Microsoft 365 tenant have?

Microsoft recommends keeping between two and four Global Administrators. Additional administrators should use Privileged Identity Management for temporary access.

How do I see who has Global Admin rights?

You can view Global Administrator assignments in the Microsoft Entra Admin Center under:

Roles & administrators → Global Administrator

What is Privileged Identity Management (PIM)?

Privileged Identity Management allows administrators to receive temporary elevated privileges instead of permanent role assignments, improving security and auditability.

Should service accounts have Global Admin access?

No. Service accounts should use least privilege permissions or app registrations rather than full Global Administrator privileges.

What happens if a Global Admin account is compromised?

If a Global Administrator account is compromised, an attacker may gain complete control of the Microsoft 365 tenant, including data access, user management, and security configuration.

Conclusion

Global Administrator accounts represent the highest level of privilege within Microsoft 365, making them a primary target for cyber attackers.

Regular auditing of privileged roles is one of the most effective ways to reduce the risk of tenant compromise.

By implementing best practices such as:

• limiting Global Admin accounts
• using Privileged Identity Management
• monitoring sign-in activity
• auditing role changes
• enforcing MFA

organizations can significantly improve the security of their Microsoft 365 environments.

For IT professionals managing enterprise tenants, privileged access auditing should be a routine operational task rather than an occasional review.

Last Updated

Last Updated: March 2026

This guide reflects current Microsoft 365 and Microsoft Entra ID administrative best practices.

Daniel Lutton

From my early days on the helpdesk through roles as a service desk manager, systems administrator, and network engineer, I’ve spent more than 25 years in the IT world. As I transition into cyber security, my goal is to make tech a little less confusing by sharing what I’ve learned and helping others wherever I can.