# Super admin count is restricted to 2 or fewer

- Source: https://support.icompaas.com/support/solutions/articles/a_1781206735979242-super-admin-count-is-restricted-to-2-or-fewer
- Section: [Solutions](https://support.icompaas.com/support/solutions) › [Identity Provider (IDP)](https://support.icompaas.com/support/solutions/c_1781206270516942) › [Microsoft 365 (MS365)](https://support.icompaas.com/support/solutions/folders/f_1781206551953491)
- Last updated: 2026-06-12
- Publisher: iCompaas, Inc. (https://www.icompaas.com)

Description:  
This control ensures that the number of Microsoft 365 Global Administrator accounts is restricted to two or fewer. Limiting the number of Global Administrators reduces the risk of unauthorized changes, privilege misuse, and account compromise while maintaining sufficient administrative coverage.

  

Rationale:  
Global Administrators have unrestricted access to Microsoft 365 and Microsoft Entra ID settings, users, security configurations, and services. Restricting the number of Global Administrators helps enforce the principle of least privilege, reduces the attack surface, and improves accountability for administrative actions.

  

Impact:

-   Reduces the risk of unauthorized administrative changes.
    
-   Limits exposure of highly privileged accounts.
    
-   Improves accountability and administrative oversight.
    
-   Supports compliance requirements related to privileged access management.
    
-   May require the use of delegated administrative roles for routine administrative tasks.
    

  

Default Value:  
Not restricted by default. Organizations must manually limit the number of users assigned the Global Administrator role.

  

Remediation

Test Plan

1.  Sign in to the Microsoft Entra admin center with administrative privileges.
    
2.  Navigate to Roles & administrators.
    
3.  Select Global Administrator.
    
4.  Review the list of assigned users.
    
5.  Count the total number of users assigned the Global Administrator role.
    
6.  Verify that no more than two users are assigned the Global Administrator role.
    
7.  If more than two users are assigned the Global Administrator role, follow the Implementation Steps to remediate the issue and repeat the test.
    

  

Implementation Steps:

1.  Sign in to the Microsoft Entra admin center with Global Administrator privileges.
    
2.  Navigate to Identity → Roles & administrators.
    
3.  Select Global Administrator.
    
4.  Review the list of assigned users.
    
5.  Identify users who do not require Global Administrator privileges.
    
6.  Remove the Global Administrator role from users exceeding the approved limit.
    
7.  Assign lower-privileged administrative roles as required for operational responsibilities.
    
8.  Ensure that no more than two users retain the Global Administrator role.
    
9.  Save the configuration changes if prompted.
    
10.  Verify that the total number of Global Administrators is two or fewer.
     

  

Backout Plan:

1.  Sign in to the Microsoft Entra admin center with Global Administrator privileges.
    
2.  Navigate to Identity → Roles & administrators.
    
3.  Select Global Administrator.
    
4.  Click Add assignments.
    
5.  Assign the Global Administrator role to additional authorized users as required.
    
6.  Save the configuration changes.
    
7.  Verify that administrative access functions according to the updated configuration.
    

  

References:

-   [Microsoft Entra Administrator Roles Documentation](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/permissions-reference)
    
-   [Microsoft Entra Assign Administrator Roles Documentation](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/manage-roles-portal)
    
-   [Microsoft 365 Privileged Access Best Practices Documentation  
      
    ](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-planning)

## Related compliance guidance

- [SOC 2 compliance: a practical implementation guide for cloud-native SaaS teams](https://support.icompaas.com/compliance/soc-2-trust-services-criteria): Configuration checks like this one are the technical half of a SOC 2 / ISO 27001 programme — the guide shows where they fit, what else an auditor expects, and how to evidence them.
- [ISO/IEC 27001:2022 compliance: a practical implementation guide](https://support.icompaas.com/compliance/iso-27001-2022): ISO 27001 Annex A.8 (technological controls) is where cloud hardening evidence lands; the guide shows how to run the ISMS around it.