How to right-size Microsoft 365 admin roles

Many Microsoft 365 tenants at small firms have more administrators than anyone intended. The office manager who opened the subscription, a former IT contractor, a partner who wanted to reset passwords: each can end up as a Global Administrator, the role that can change anything in the tenant. This checklist shows how to cut Microsoft 365 admin roles to what each person needs and keep the record an examiner or auditor will ask for.

Why do admin rights in Microsoft 365 matter to a regulator?

Admin accounts control every mailbox, file and log in the tenant, so they are the first thing an attacker wants and one of the first things a reviewer checks. A compromised Global Administrator can change sign-in rules, create new accounts that outlast the original intrusion and, because Microsoft lets the role elevate its own access to read data, reach client email and files.

The written expectations are specific. NIST CSF 2.0 subcategory PR.AA-05 says access permissions, entitlements and authorizations should be defined in a policy, managed, enforced and reviewed, and should incorporate least privilege and separation of duties. For financial firms covered by the FTC Safeguards Rule, 16 CFR 314.4(c)(1) requires access controls that limit each authorized user to the customer information needed for their duties, reviewed periodically. For SEC-registered advisers, the Division of Examinations lists access controls and account management among the cybersecurity areas it will review in its fiscal year 2027 examination priorities.

How many Global Administrators should a firm have?

Microsoft recommends assigning the Global Administrator role to fewer than five people. It also recommends two cloud-only emergency access accounts, often called break-glass accounts, permanently assigned the role. Those accounts are not assigned to any one person and exist for the day normal admin sign-in fails.

At a small firm, that can mean one or two named people with Global Administrator, plus the two emergency accounts. Everyone else who does admin work gets a narrower role. The Microsoft Entra admin center shows an alert when five or more accounts hold Global Administrator, which makes a quick first check.

Which Microsoft 365 admin roles cover everyday work?

A handful of built-in roles cover most daily work at a small firm. Microsoft publishes a list of least privileged roles by task, and these are the ones that come up most:

• Password Administrator: resets passwords for non-admin users. A fit for the office manager who handles lockouts.
• User Administrator: creates and manages users and groups, and resets passwords for limited admins.
• License Administrator: assigns and removes licenses.
• Exchange Administrator, SharePoint Administrator and Teams Administrator: each manages one service.
• Reports Reader: reads sign-in and audit logs without changing anything.
• Global Reader: sees every setting with no ability to change it. Useful for a chief compliance officer or an outside auditor reviewing configuration.

Microsoft's own guidance defines least privilege as granting administrators exactly the permission they need to do their job. A partner who only unlocks staff accounts has no use for the role that can rewrite the tenant's security settings. Separation of duties applies too: the person who approves new admin roles should not be the only person who can grant them.

Should administrators use a separate account for admin work?

The CIS Controls say yes. CIS Safeguard 5.4 calls for restricting administrator privileges to dedicated administrator accounts and doing general computing, such as browsing, email and productivity suite use, from the user's primary, non-privileged account. It sits in Implementation Group 1, the baseline tier meant for every organization.

In practice, each admin keeps a normal licensed account for daily work and gets a second account that holds the admin role and has no mailbox. Microsoft recommends cloud-only accounts for Entra role assignments, so a compromise of the office's on-premises Active Directory does not carry into the tenant. CIS Safeguard 6.5 requires MFA for all administrative access, including access managed through a service provider. Microsoft has also made MFA mandatory for its admin portals: the Entra, Intune and Azure portals starting October 2024, and the Microsoft 365 admin center starting February 2025, rolled out gradually across tenants.

Does a small firm need Privileged Identity Management?

It helps, but it costs extra on most small-firm plans. Privileged Identity Management (PIM) makes admin roles eligible instead of permanent: the person activates the role when they need it, for a limited time, and the activation is logged. Microsoft recommends PIM and states it requires Microsoft Entra ID P2 or Microsoft Entra ID Governance. Microsoft 365 Business Premium includes Entra ID P1, so a Business Premium firm would need an add-on license for its admins.

Without PIM, the same goals can be met by hand: keep standing assignments few, remove a role when the project that needed it ends, and record each change with who approved it. Microsoft's access reviews can automate the recurring check of admin roles, though they also carry Entra ID Governance licensing.

How do you find out who has admin rights today?

Start from the Roles and admins page in the Microsoft Entra admin center and export every role that has an assignment. For each one, record the person, the role, the reason, the date granted, and whether the account is a dedicated admin account or someone's everyday login. Then look for the patterns that most often show up:

• Global Administrator held by five or more accounts, or by a former employee or vendor.
• Admin roles on everyday accounts that also send and receive email.
• Admin roles assigned to accounts synced from on-premises Active Directory.
• Shared logins or service accounts holding an admin role with no named owner.
• No emergency access accounts, or emergency accounts used for routine work.
• An outside IT provider holding Global Administrator with no written record of why.

What should you do this quarter?

Work through these steps in order. The first five change the tenant, and the last two create the record.

1. Export every Entra role assignment and save it with today's date. This is your before picture.
2. Create two cloud-only emergency access accounts, store their credentials securely, and monitor any sign-in to them.
3. Reduce named Global Administrators so the total stays under five, and remove the role from anyone who no longer needs it.
4. Move each remaining admin to the narrowest built-in role that covers their tasks.
5. Create dedicated admin accounts, confirm MFA on each, and take admin roles off everyday accounts.
6. Write a one-page admin access standard: which roles exist, who approves a new assignment, and how often assignments are reviewed. This is the policy PR.AA-05 refers to.
7. Put the next review on the calendar. CIS Safeguard 6.8 calls for access control reviews at least annually. Folding admin roles into an existing quarterly access review keeps it from becoming a separate project.

What evidence should you keep?

Keep the dated before and after exports, the written standard, a log of each role change with its approver, and the sign-off from each review. The FTC Safeguards Rule and PR.AA-05 both describe access controls that are reviewed, and a dated record is how a firm shows a review happened. File it where the next exam or audit request will look for it.

Two related checklists cover the next steps: finding and removing stale accounts every month and hardening the rest of the tenant against the CIS Microsoft 365 Benchmark.

How can s90 help?

s90 runs identity posture reviews for firms in Los Angeles and Orange County, including an inventory of every Microsoft 365 admin role, a right-sizing plan and the evidence file that goes with it. If you would like a second set of eyes on your tenant, talk to our team.