Who this is for
- You are not certain who has administrative rights.
- The tenant was set up by somebody who has left.
- A provider holds the only administrative account.
- You are being asked to demonstrate access control to a customer or an insurer.
Common problem
Who owns your admin account?
Administrative rights are usually handed out for a reason and then never reviewed. Years later nobody is certain who holds them, or whether the business could get in without asking somebody else.
Facts checked
Ownership and access are different things, and confusing them is what strands businesses. Plenty of people can be given administrative access. Only one entity should own the tenant, and that entity is the business.
The test is not who knows the password today. It is whether the business could still administer its own Microsoft 365 tomorrow if a particular person or supplier stopped answering the phone.
This page is for businesses that can still sign in as an administrator and want that checked. If nobody can, start with getting your Microsoft 365 admin access back.
What good looks like
- The tenant belongs to the business. Not to an employee, not to a contractor, and not to a provider's account.
- Each administrator has their own admin account. In their name, used only for admin work and kept apart from the account that reads email all day. Microsoft recommends a dedicated account for each person with admin rights, so every change can be traced to someone.
- Global administrator is rare. Two or three people, not everybody who once needed to do one job.
- Two emergency access accounts exist. Not assigned to anyone, kept for emergencies and excluded from the policies that could lock them out, credentials stored somewhere controlled.
- MFA is on every administrative account. Without exception, including the ones people forget exist.
- Recovery details are reachable by the business. Not a phone number belonging to somebody who left in 2023.
- Somebody reviews it. Twice a year is enough to stop the list drifting back.
How it goes wrong
Nobody sets out to lose control of their own tenant. It happens the same few ways.
It was set up on a personal account
Fastest at the time, and it means the business is now a guest in its own environment. Getting out of this is getting your admin access back.
The admin left
With the authenticator app on their phone and the recovery email pointing somewhere nobody reads. The access half of this is former employee access.
Everybody became an admin
Because it was quicker than working out which permission was actually needed. Each grant was reasonable. The total is not.
The provider holds everything
Which works perfectly until the relationship ends, at which point it is the only thing anyone can talk about.
How to check it this week
-
List who holds administrative roles
Not who you think. What the tenant actually reports.
-
Ask which of them still work there
This question alone usually finds something.
-
Check where recovery goes
The recovery email and phone number on the administrative accounts.
-
Confirm MFA on every admin account
Including any account that exists for a system rather than a person.
-
Create or confirm two emergency access accounts
And write down where their credentials live, in a place that is not the tenant.
-
Remove what is not needed
Roles first, accounts second, and record what you removed.
When this is not the right fit
- You have lost admin access entirely. Start with getting your Microsoft 365 admin access back instead, because the route is different.
- You want access to a tenant your business does not own.
Common questions
Should our admin account belong to a person?
Each person who administers Microsoft 365 should have their own admin account, in their name, used only for admin work and kept apart from the account they use for email every day. Microsoft recommends a dedicated account for each person with admin rights. Every change can then be traced to someone, and when that person leaves you remove one account and nothing else breaks.
What should never depend on one person is the tenant itself. The business owns it, holds the recovery details, and keeps two emergency access accounts that are not assigned to anyone, so it can always get back in.
How many global administrators should we have?
Fewer than most tenants have. Two or three people who genuinely need it, each with their own admin account, plus two emergency access accounts, covers almost every small business.
What we usually find instead is five or six, several of whom got the role once for a specific task in 2022 and never had it removed.
What is an emergency access account?
Sometimes called a break glass account, it is an administrative account that exists only to get you back in when normal access fails: the person with the authenticator app has left, or a policy has locked everybody out.
It is excluded from the policies that could lock it out, its credentials are stored somewhere physical and controlled, and its use is something you would notice. It is deliberately boring and it is the thing people wish they had set up.
Our IT provider holds the admin account. Is that normal?
It is common, and it is fine for them to hold administrative access. It is not fine for them to hold the only administrative access.
The test is simple: if that relationship ended tomorrow, could your business still get into its own tenant? If the answer is no, that is worth fixing while everyone is still friendly.
What happens first, and what do you need from us?
A first assessment. Someone who can sign in as an administrator gives us read only access, and we list every account with admin rights, when each last signed in, whether it has MFA, and where its recovery details go.
From that you get a short list of what to change and a quote for doing it. Scope and price are agreed before we change anything.
Related
Microsoft 365 Security and Cost Review
A fixed scope review of who has access, how sign-in is protected, where mail goes and what you are paying for.
Getting admin access back
For businesses that have lost Microsoft 365 admin access: finding the route back, then cleaning up and documenting what is in it.
Former employee access
What to check when somebody has left and you are not certain their access is closed.
Get a Quote
Find out who actually holds it
The first assessment lists every account with administrative rights, when each last signed in, and which belong to people who have left. Scope and price are agreed before we change anything.