Microsoft 365 Admin Access Security: Who Still Has Access?

Who Has Admin Access to Your Microsoft 365 Environment?

Review Microsoft 365 admin account access and privileged roles to improve account security.

A Microsoft 365 administrator can do much more than reset passwords. Depending on the assigned role, an administrator may be able to create and delete users, change security settings, manage email information, control SharePoint access, or assign permissions to provide access to secure information.

The problem is admin creep. Employees provide “temporary” permissions for a project, vendor for and important business initiative or troubleshooting task. Months later, the initiative is complete, but the admin access remains.

In Alpha’s work supporting business IT environments, this is why administrative access should be reviewed, not simply assigned once and forgotten.

For an owner or operations manager, the starting question is simple: Who has admin access? Does this person still need it?

Who Has the Global Administrator Role?

Microsoft describes Global Administrator as a highly privileged role across Microsoft Entra ID and Microsoft 365. Recommendation: keep the number of Global Administrators below five.

For each Global Administrator, confirm:

• Does the account require global admin access?
• Who owns the account?
• Is the employee or consultant still engaged in the role?
• Does their current responsibilities require the role?
• Does MFA protect the account?
• Is the account is shared?

Global admin and other administrative accounts should be kept separate from routine user activity where practical. A highly privileged account used for normal email, browsing, and day-to-day work receives more exposure to phishing and other common threats than an account reserved for administrative tasks.

What Should an Owner Ask Their IT Provider?

You should be able to get clear answers to a few questions:

• How many Global Administrators do we have and who are they?
• Are there other privileged roles are assigned?
• Do any former employees still have access?
• Is MFA enabled on privileged accounts?
• When were these permissions last reviewed or modified?

Alpha Network Systems provides access reviews and can identify unnecessary elevated privileges before they become part of a security problem.

FAQs

How many Microsoft 365 Global Administrators should a business have?

Microsoft recommends a maximum of five global administrator. Businesses should also limit the admin roles to people who only users requiring its broad administrative permissions.

Is removing a Microsoft 365 license enough when an employee leaves?

No. Offboarding a user may also require blocking sign-in, removing administrator roles, revoking sessions, securing company data, transferring resources, and addressing the account itself.

Conclusion

Would you like to know who has admin or elevated access in your IT environment?

Would you like to an IT audit for answers?

Contact Alpha Network Systems to discuss your IT environment.