Global Administrator is the most powerful role in Entra ID. It can read and change almost every setting in your Microsoft 365. Yet few IT teams can say, without looking it up, who holds it.
- The project endedTemporary access was never removed.
- Changing jobsA new role, but the old rights remain.
- ExternalsConsultants and partners with an administrator role.
- A quick fixGlobal Administrator was the fastest way to get the task done.
- No formal governanceNo approval, review or offboarding of roles.
Why the list grows
Nobody decides to have many administrators. It happens because a task had to be solved quickly, and Global Administrator was the fastest fix. The role is rarely taken back once the task is done, and after a few years there are more holders than anyone remembers.
The problem is not only the number. It is whether each assignment can be justified and protected.
Who else can gain Global Administrator access?
The list of who holds the role today is only part of the picture. A Privileged Role Administrator can assign Global Administrator to others and, subject to the applicable rules, to themselves. Apps and service principals with sufficiently powerful Microsoft Graph permissions can also create role assignments. These identities and their permissions must be reviewed alongside the human administrators.
Global Administrator is not the only role to watch either. Microsoft itself points to several privileged roles that should be reviewed regularly. They give different paths to compromise: a Privileged Authentication Administrator can reset authentication methods for highly privileged users, a Conditional Access Administrator can change the access policies, and a Security Administrator can change the settings that protect you. Review all privileged roles, not just the one.
What Microsoft recommends
- Fewer than five Global Administrators. Keep the number low. Include emergency accounts in your inventory, but keep the two emergency accounts you need for recovery.
- Least privilege. Use a more specific administrator role when the task does not need Global Administrator.
- MFA and dedicated accounts. Protect every administrator account with multifactor authentication (MFA), and use it only for administration, separate from the everyday account used for email. A dedicated administrator account usually does not need a Microsoft 365 licence if it is used only for administration. Check the licensing requirements if it is also used for other services.
- Two emergency access accounts, cloud-only and not tied to a person. They should be protected, monitored and tested, so they work when nobody else can sign in.
- Regular review of who holds which roles. With a suitable Entra ID licence (P2), Privileged Identity Management (PIM) can give access that is only activated when needed and expires again.
See Microsoft’s guidance: Best practices for Microsoft Entra roles.
How to get an overview
- Pull the list. Start in the Entra admin center under Roles and administrators. Review active and eligible assignments, including those made through groups. Also identify the identities and apps that have permission to assign privileged roles.
- Find a reason for each. Who owns the assignment, which task does it support, and is it still needed? If nobody can answer, that is a question.
- Move to a more specific role where possible, and remove the role where it is no longer used.
- Put a review in the calendar, for example every quarter, so the list does not quietly grow again.
This is one of the checks in Baseline. Finding the assignments is the easy part. The real work is deciding whether they are justified, adequately protected and documented. You receive a report based on findings from your own tenant, with clear priorities. It is a review of the paths that can be found in the configuration, not proof that no others exist. See what the security review covers or book a 30-minute call.