Whoever signs up for Microsoft 365 becomes its first Global Administrator: every password, purchasing and the domains (roles). If that’s one person’s account and they leave, the business can lose its own email and files.
Separate admin accounts
Everyone who administers the tenant gets two accounts: an everyday one, and an admin one. Admin happens in the same browser you read email and browse in, so there’s plenty of room for mischief. Microsoft agrees.
- No partial admin on everyday accounts. Menus come and go and it gets confusing. Helpers get the narrowest role that does the job, such as Password Administrator (guidelines).
- Fewer than five Global Administrators (Microsoft).
- Not admin@. It’s the first name a password spray tries. Pick a name that doesn’t say “admin” at all.
- No shared logins. Multifactor authentication (MFA) makes them impractical, and named accounts make the audit log mean something.
- Licences are optional. Admin-only accounts don’t need one. A cheap licence with a mailbox is handy, though: the admin account gets alerts and can forward them to you. Without one, set an alternate email on each admin account so alerts reach an inbox you read.
- A separate browser profile keeps the admin sign-in handy without staying signed in.
Two break-glass accounts
Keep two emergency access accounts with Global Administrator for the day nobody can sign in, such as when the last admin leaves.
- Cloud-only, on
.onmicrosoft.com. - Not tied to one person or phone.
- A FIDO2 security key, different from your everyday admin method.
- Excluded from Conditional Access policies that block sign-in.
- Credentials in separate safe places more than one trusted person can reach.
- Tested every 90 days, and whenever someone with access leaves.
Microsoft’s small business page still says no MFA and a long password. The Entra page now says a FIDO2 key or certificate-based authentication, which will meet the mandatory MFA Microsoft starts enforcing on its admin portals later this year. Follow Entra.
Partners, billing and the domain
A good partner is often the right call for the work. Hand them the hard jobs, such as moving to a new tenant: they do it every day, and what you’d learn goes stale almost at once.
Still hold your own keys:
- Check partner access under Settings > Partner relationships. Old relationships may still carry Global Administrator; granular delegated admin privileges (GDAP) replace them with specific, expiring roles.
- Removing roles doesn’t stop purchasing. The partner can still buy for you until they turn it off in Partner Center.
- Keep your own Global Administrator. Only a Global Administrator can see subscriptions a partner bought.
- The domain. The business should be the registrant, on a registrar account it controls. A lot of scams target domains, such as fake renewal invoices and transfer notices. If the business can’t be relied on to renew on time and spot those, turn on auto-renew and add a partner you trust as a manager on the account.
- Billing. Pay Microsoft directly where you can, so subscriptions and invoices stay in your name if you change partners. Give whoever pays the bills, such as a bookkeeper, the Billing Administrator role, not Global Administrator. Use partners for the work.
Before you migrate
- Do the free Microsoft Learn admin courses. They don’t take long.
- Buy an hour or two of a consultant to check your plan.
- Pilot with a few users.
- Check security defaults are on. New tenants get them; older ones may not.
- Check the audit log is on. It’s meant to be on by default, but Microsoft says to check it on a new tenant, and you’ll want it to see password sprays.
- Decide who’s local admin on each PC. Whoever joins a PC to Entra ID becomes its local admin and everyone else who signs in is a standard user, so have IT join them and shared laptops just work. The setting is under Device settings; adding support staff as local admin everywhere needs Entra ID P1.
- Coming from an on-premises server? Clean up Active Directory before syncing, and hold off on staff creating Teams until your SharePoint structure is planned.