Privileged access
Entra ID privileged access: admin roles, PIM and break-glass accounts
Who holds admin rights, how they get them, and what happens when everything else fails. A practical approach for small and mid-size tenants.
On this page
An attacker who compromises an ordinary user can read that user's mail and files. An attacker who compromises a Global Administrator can read everyone's, create new admin accounts, disable logging and lock the rightful owners out. Privileged access is the part of a Microsoft 365 tenant where a small amount of effort buys the most protection.
Step 1: Inventory who holds which role
In the Microsoft Entra admin center, open Roles & admins and sort the roles by assignments. For each role with members, record:
- Who holds it, and whether the assignment is active (permanent) or eligible (through PIM).
- Whether each holder is a person, a shared account, a guest, or a service principal (applications can hold directory roles too).
- When each account last signed in, and which authentication methods it has registered.
Pay particular attention to the roles that can take over the tenant indirectly: Privileged Role Administrator and Privileged Authentication Administrator (can grant roles or reset admin credentials), Application Administrator and Cloud Application Administrator (can add credentials to powerful apps), and Conditional Access Administrator or Security Administrator (can weaken policies). Microsoft marks many of these as privileged in the built-in roles reference.
Step 2: Move to least-privileged roles
Most people with Global Administrator don't need it. Map what they actually do to the smallest role that allows it:
| Task | Least-privileged role (typical) |
|---|---|
| Reset passwords for regular users | Helpdesk Administrator or Password Administrator |
| Create users, manage groups and licenses | User Administrator (plus License Administrator where needed) |
| Manage mailboxes and mail flow | Exchange Administrator |
| Manage SharePoint and OneDrive settings | SharePoint Administrator |
| Manage Teams policies | Teams Administrator |
| Manage devices and apps in Intune | Intune Administrator |
| Review settings and reports without changing them | Global Reader, Security Reader, Reports Reader |
Microsoft's least privileged roles by task lists the recommended role for many more tasks. Where a team only manages part of the organization (one region, one subsidiary), administrative units scope a role to those users and devices.
How many Global Administrators? Microsoft's best practices for Microsoft Entra roles recommend fewer than five. In practice, small tenants often end up with two named people plus the two emergency accounts.
Step 3: Separate, cloud-only admin accounts
- Separate from daily accounts. The account someone uses for email and browsing is the one most likely to be phished. Admin roles belong on a separate account, such as
adm-jsmith@contoso.onmicrosoft.com, that isn't used for email. - Cloud-only. Don't assign Entra admin roles to accounts synchronized from on-premises Active Directory. If on-premises AD is compromised, synchronized admins go with it.
- Phishing-resistant MFA. Require passkeys (FIDO2), Windows Hello for Business or certificate-based authentication for admin roles with a Conditional Access authentication strength. See phishing-resistant MFA.
- Minimal licensing. An admin account usually doesn't need a mailbox or Office apps; fewer services means a smaller attack surface.
Step 4: Just-in-time access with PIM
Microsoft Entra Privileged Identity Management (PIM) replaces permanent role assignments with eligible ones. An eligible admin activates the role when they need it, for a limited time, and the activation is logged. PIM requires Microsoft Entra ID P2 (included in Microsoft 365 E5) or Microsoft Entra ID Governance for the people who use it.
A sensible starting configuration for each privileged role:
- Activation maximum duration: a few hours, not a full day.
- On activation, require: MFA (or a Conditional Access authentication context requiring phishing-resistant MFA) and a justification.
- Require approval for the most powerful roles (Global Administrator, Privileged Role Administrator), with at least two approvers.
- Notifications to a monitored mailbox or security team when those roles are activated.
- Access reviews of eligible assignments every quarter, so people who changed jobs lose eligibility.
Without P2, you can still reduce the risk by keeping assignments few, reviewing them monthly and removing roles as soon as a task is done. Record that decision in the assessment rather than leaving it unmentioned.
Step 5: Emergency access (break-glass) accounts
Emergency access accounts exist for the day something goes wrong: a Conditional Access policy locks everyone out, the MFA service is unavailable, or the only Global Administrator leaves. Microsoft's guidance is in manage emergency access accounts in Microsoft Entra ID. The essentials:
Create two. Cloud-only accounts on the
.onmicrosoft.comdomain, not tied to a person, with the Global Administrator role permanently active.Give them strong credentials that don't depend on one person. Microsoft recommends phishing-resistant methods such as FIDO2 security keys or certificate-based authentication for these accounts, since Microsoft now requires MFA for access to its admin portals. Store keys and any recovery material securely, in more than one location.
Exclude them from policies that could lock you out, and only those. Document each exclusion.
Alert on every sign-in. Send sign-in logs to Log Analytics and create an alert rule, so any use is investigated immediately.
Test them on a schedule (for example, twice a year) and after any change to authentication or Conditional Access.
A note for MSPs
If you manage customers through Microsoft Partner Center, use granular delegated admin privileges (GDAP) with the least-privileged roles each team needs, time-limited relationships, and security groups rather than individual assignments. Avoid asking customers for Global Administrator unless a specific task requires it, and remove it afterwards.
Keep it that way
- Review role assignments monthly, or let PIM access reviews do it.
- Watch the audit log for role assignments outside PIM and for new credentials added to applications.
- Check that service principals don't hold directory roles they don't need, and review app permissions as part of the same exercise. See finding risky OAuth apps and consent grants.
Common findings and how to fix them
| Finding | Why it matters | Fix |
|---|---|---|
| Six or more Global Administrators | Every extra account is another way in | Move people to task-specific roles; keep two named admins plus two emergency accounts |
| Admin roles on everyday mailbox accounts | Phishing the user compromises the admin | Create separate cloud-only admin accounts; remove roles from daily accounts |
| Admins without MFA or with SMS only | A password or intercepted code is enough | Register passkeys or Windows Hello; enforce an authentication strength |
| Permanent assignments with P2 licensed | Standing access is always exploitable | Convert to eligible assignments in PIM with activation rules |
| No emergency access accounts | A policy mistake can lock everyone out | Create two, with strong credentials and sign-in alerts |
| Former staff or vendors still holding roles | Access outlives the relationship | Remove now; add a leaver step and quarterly reviews |
A 30-day plan for a typical small tenant
- Week 1: inventory role holders, create the two emergency access accounts and set up sign-in alerts for them.
- Week 2: create separate admin accounts, register phishing-resistant methods for them, and move roles off everyday accounts.
- Week 3: reduce Global Administrators to the minimum and assign task-specific roles; enable a Conditional Access policy requiring phishing-resistant MFA for admin roles, in report-only first.
- Week 4: with P2, convert remaining assignments to eligible in PIM; without it, schedule a monthly role review. Re-run the assessment and record the result.
How M365Assessments helps
M365Assessments reads directory role assignments, PIM eligibility and assignment schedules, and admin MFA registration with read-only permissions, and flags issues such as permanent Global Administrators or administrators without MFA. Run it again after your changes to show the before and after. See the permissions we request and how to read the report.