How Many Global Administrators Should Your Microsoft 365 Tenant Have?
Two to four Global Administrators is the right number for most Microsoft 365 tenants. Most Australian SMBs have significantly more - often five, seven, or ten - because Global Admin is the path of least resistance whenever someone needs access to anything. Each excess account is a potential compromise point: an attacker with those credentials has full control of your entire Microsoft 365 environment. Auditing and reducing your Global Admin count is one of the highest-return security actions available, and it takes less than an hour.
What the right number is
Microsoft's own security guidance recommends a maximum of two to four Global Administrators for most organisations. For a small business with under 100 users, two Global Admins is typically sufficient. For a business with 100 to 300 users, two to four is appropriate.
The two-admin minimum exists for operational resilience: if a single Global Admin account is compromised, locked out, or the person leaves unexpectedly, you need a second account to recover access. Beyond four, the incremental resilience benefit diminishes while the attack surface grows with each additional account.
Why most tenants have too many
Global Admin assignments accumulate for the same reason all excessive permissions accumulate: they are easy to grant and rarely reviewed. When someone needs admin access to configure something, Global Admin is the path of least resistance. It grants access to everything, which means the person can definitely do what they need to do. The alternative - figuring out which specific role grants just enough access - requires more effort.
The result is that many Australian SMBs have five, seven, or more Global Admins - often including people who were granted the role years ago for a one-off task and have held it ever since.
The security risk of excess Global Admins
Each Global Admin account is a potential compromise point. If an attacker obtains the credentials for any Global Admin account - through phishing, credential stuffing, or session hijacking - they have full control of your Microsoft 365 tenant. They can create new admin accounts, disable MFA for all users, access every email in every mailbox, export all SharePoint content, and lock you out of your own environment.
Global Admin accounts are specifically targeted by threat actors because of the access they provide. A compromised standard user account is a foothold. A compromised Global Admin account is game over.
How to audit your current Global Admin assignments
To see who currently holds Global Admin in your tenant: go to the Microsoft 365 admin centre (admin.microsoft.com), then Users → Active users. Filter by Role and select Global Administrator. This shows every user with the role assigned.
Alternatively, in Microsoft Entra ID (entra.microsoft.com), go to Roles and administrators, find Global Administrator, and review the Assignments tab. This shows both permanent and eligible role assignments if you have Entra ID P2.
The principle of least privilege for Microsoft 365 admin roles
Most tasks that people use Global Admin for have a more targeted role that provides only the necessary access. Microsoft 365 has over 60 built-in admin roles. The commonly needed ones are:
Targeted admin roles and what they replace Global Admin for
| Task | Correct role (instead of Global Admin) |
|---|---|
| Managing users, passwords, licences | User Administrator |
| Managing Exchange and email settings | Exchange Administrator |
| Managing SharePoint sites | SharePoint Administrator |
| Managing Teams settings | Teams Administrator |
| Managing security policies and alerts | Security Administrator |
| Managing Intune and device policies | Intune Administrator |
| Billing and licence purchases | Billing Administrator |
| Reviewing security reports and alerts | Security Reader |
| Managing Conditional Access policies | Conditional Access Administrator |
| Resetting passwords only | Helpdesk Administrator |
Protecting the Global Admin accounts you keep
- 1
Use a separate dedicated account for Global Admin tasks
Global Admin accounts should not be the same as the administrator's day-to-day work account. A dedicated account used exclusively for admin tasks limits the exposure of credentials that are used for regular browsing, email, and Teams.
- 2
Enforce phishing-resistant MFA on all Global Admin accounts
SMS-based MFA is insufficient for Global Admin accounts. Use FIDO2 security keys or certificate-based authentication. At minimum, use the Microsoft Authenticator app with number matching rather than SMS or voice call.
- 3
Configure Conditional Access to require compliant devices for admin access
Create a Conditional Access policy requiring that Global Admin sign-ins occur from a specific, managed device. This prevents credential theft leading to admin access from an attacker's device.
- 4
Enable Privileged Identity Management (PIM) if you have Entra ID P2
PIM allows just-in-time admin role activation: Global Admin access is not permanently assigned but activated on demand for a limited time window. This means the account is not a permanent Global Admin - only when a specific task requires it.
- 5
Create a break-glass account
Maintain one emergency Global Admin account that is excluded from all Conditional Access policies, has a strong password stored securely offline, and is monitored for any sign-in activity. This account exists to recover access if all other admin accounts are locked out.
Reducing your Global Admin count from seven to two and applying phishing-resistant MFA to those accounts is one of the highest-return security actions available to most Australian SMBs. It is low cost, it does not disrupt users, and it directly addresses a common initial access vector used in Microsoft 365 compromise attacks.
Sources & accuracy
Last reviewed: 5 October 2026 · Microsoft product capabilities, licensing and configuration options change regularly. Verify current details at learn.microsoft.com.
Next step
Cloud Security Baseline
The Cloud Security Baseline reviews your admin role assignments, MFA configuration, Conditional Access policies, and over 30 other Microsoft 365 security controls - and gives you a prioritised remediation plan.
Learn more