Why one Global Admin for everything is risky
In many SME tenants the first user — often the director or the IT contact — is also Global Administrator. Convenient at the start: one login for Outlook, Teams, licences and the admin centres. The downside is simple: that account sees mail, can change users, domains and security, and sits at the top of the privilege ladder. If that session or password leaks, it is no longer “just the mailbox” — it is the tenant.
The problem is rarely “we need an administrator”. It is “we use that administrator for afternoon email and a Teams chat”.
What you should decide
Keep it short enough to decide this quarter:
- every person has a normal named-user account for mail, Teams and Office — without Global Administrator;
- privileged work uses a separate admin account (different username), only when needed;
- who may hold Global Administrator — preferably two or three people, not the whole board “just in case”;
- least privilege: prefer Exchange Administrator, User Administrator or Helpdesk roles over default Global Administrator;
- break-glass: one or two emergency accounts, stored securely, not for daily work, with logging — and who may open them.
Write those five points on one page. That is your admin policy; the tenant follows that text.
What Floor ICT configures — and what you decide
In the Microsoft 365 tenant we typically: inventory who holds which directory role, remove unnecessary Global Administrator assignments, enforce MFA on admin roles (where your licences and Conditional Access allow), and set expectations for audit and sign-in logging. On joiner and leaver we remove admin roles too — not only the mailbox account.
You still decide: who in your company may hold a privileged account, whether the MSP (Floor ICT) manages on your behalf with delegated access, and how strict the break-glass procedure is. Technical role cleanup without policy does not fix “everyone is admin”; policy without configuration does not either.
Break-glass, MFA and least privilege
A break-glass account is not a second daily login. It is the key when Conditional Access, MFA or MSP access fails. Store credentials outside staff’s normal password-manager workflow, rarely test that the account still works, and log every sign-in.
MFA for ordinary users stays; for admins it matters even more. See also our pieces on MFA in Microsoft 365 and the joiner and leaver checklist.
More depth
Checklist for SME directors
1) List who is Global Administrator today. 2) Split mail and admin per person. 3) Remove surplus Global Admin. 4) Enforce MFA on admin. 5) Document break-glass and who may open it. 6) Schedule a half-yearly role review.
MSP access versus your own admin
Floor ICT often manages via partner or guest access with limited roles — not via your personal Global Admin mailbox. That keeps your daily account clean and admin work auditable.
Link to phishing and awareness
Separate admin accounts shrink the blast radius; they do not replace training. Staff who recognise phishing remain necessary — see security awareness.