Description:
This control ensures that the number of Microsoft 365 Global Administrator accounts is restricted to two or fewer. Limiting the number of Global Administrators reduces the risk of unauthorized changes, privilege misuse, and account compromise while maintaining sufficient administrative coverage.
Rationale:
Global Administrators have unrestricted access to Microsoft 365 and Microsoft Entra ID settings, users, security configurations, and services. Restricting the number of Global Administrators helps enforce the principle of least privilege, reduces the attack surface, and improves accountability for administrative actions.
Impact:
Reduces the risk of unauthorized administrative changes.
Limits exposure of highly privileged accounts.
Improves accountability and administrative oversight.
Supports compliance requirements related to privileged access management.
May require the use of delegated administrative roles for routine administrative tasks.
Default Value:
Not restricted by default. Organizations must manually limit the number of users assigned the Global Administrator role.
Remediation
Test Plan
Sign in to the Microsoft Entra admin center with administrative privileges.
Navigate to Roles & administrators.
Select Global Administrator.
Review the list of assigned users.
Count the total number of users assigned the Global Administrator role.
Verify that no more than two users are assigned the Global Administrator role.
If more than two users are assigned the Global Administrator role, follow the Implementation Steps to remediate the issue and repeat the test.
Implementation Steps:
Sign in to the Microsoft Entra admin center with Global Administrator privileges.
Navigate to Identity → Roles & administrators.
Select Global Administrator.
Review the list of assigned users.
Identify users who do not require Global Administrator privileges.
Remove the Global Administrator role from users exceeding the approved limit.
Assign lower-privileged administrative roles as required for operational responsibilities.
Ensure that no more than two users retain the Global Administrator role.
Save the configuration changes if prompted.
Verify that the total number of Global Administrators is two or fewer.
Backout Plan:
Sign in to the Microsoft Entra admin center with Global Administrator privileges.
Navigate to Identity → Roles & administrators.
Select Global Administrator.
Click Add assignments.
Assign the Global Administrator role to additional authorized users as required.
Save the configuration changes.
Verify that administrative access functions according to the updated configuration.
References: