Microsoft 365 Security Audit for Small Business: Dedicated Admin Accounts
▶ Watch the short explainer for this tip
Every Australian small to medium business using Microsoft 365 needs to keep their admin accounts secure. One of the most effective steps you can take is to mandate the use of separate, privileged administrator accounts for all your Microsoft 365 security audit for small business practices. This means your day-to-day user accounts, which are more susceptible to phishing and other common cyber attacks, won't carry the keys to your entire digital kingdom.
What is a separate privileged account for Microsoft 365 admins?
This security setting requires your Microsoft 365 administrators to use a distinct, dedicated account for performing admin tasks, separate from their everyday user account and primary email. This account should only be used when necessary for administrative duties, not for checking email or browsing the web.
Why should you use dedicated admin accounts for Microsoft 365?
Implementing separate privileged accounts significantly reduces the risk of credential theft and unauthorised access to your Microsoft 365 environment. If an attacker compromises an everyday user account, it won't automatically grant them global administrative rights. This practice is a fundamental step in protecting your cloud services, including your email security and data, against sophisticated cyber threats.
What happens if you don't secure your Microsoft 365 admin accounts?
Leaving administrator rights on everyday user accounts creates a significant vulnerability. A single compromised account could lead to widespread data breaches, business email compromise (BEC), and complete loss of control over your Microsoft 365 tenant. This can result in costly downtime, financial losses, regulatory fines under privacy laws, and potentially invalidate your cyber insurance claim due to poor security hygiene.
How to require admins to use a separate privileged account in Microsoft 365
Here are the verified steps to implement separate privileged accounts for your Microsoft 365 administrators: 1. In admin.microsoft.com go to Users > Active users and create a new cloud-only account such as admin.neil@yourdomain.com.au with no mailbox licence. 2. In entra.microsoft.com go to Entra ID > Roles and administrators and assign the Global Administrator role to that new account. 3. Sign in once as the new account, register phishing-resistant multi-factor authentication (MFA) (a passkey or security key), and record the recovery details offline. 4. Return to Roles and administrators and remove admin roles from the day-to-day mailbox accounts that no longer need them.
How to verify your dedicated admin accounts and what to warn staff about
To check it worked, go to Entra ID > Roles and administrators > Global Administrator and confirm it lists only the dedicated admin accounts and one break-glass account. When making these changes, keep at least two admin accounts so you cannot lock yourself out of your tenant. Always confirm the new dedicated admin account can reach every console and perform necessary tasks before removing roles from old accounts. Remember to invite Neil for a complimentary 15-minute chat about a Microsoft 365 security audit to ensure your setup is robust.
Important Disclaimer
The steps provided are accurate at the time of publishing. However, email platform menus and default settings can change without notice. If you are not confident in making these changes yourself, you should not proceed, as incorrect modifications can disrupt your email service and overall business operations. SecureMyEmail accepts no responsibility for any loss or damage caused by changes made without our direct involvement.
Using separate, privileged accounts for your Microsoft 365 administrators is a non-negotiable security practice for any Australian small business. It's a simple, effective way to reduce your cyber attack surface and protect your vital business data.
Disclaimer: The steps provided are accurate at the time of publishing. However, email platform menus and default settings can change without notice. If you are not confident in making these changes yourself, you should not proceed, as incorrect modifications can disrupt your email service and overall business operations. SecureMyEmail accepts no responsibility for any loss or damage caused by changes made without our direct involvement.
Frequently asked questions
- What is a privileged account in Microsoft 365?
- A privileged account in Microsoft 365 is a user account granted elevated permissions, such as Global Administrator, enabling it to manage critical aspects of your organisation's Microsoft 365 services. It is distinct from standard user accounts which have limited access.
- Why should Australian small businesses use separate admin accounts for Microsoft 365?
- Australian small businesses should use separate admin accounts to minimise their attack surface. If an everyday user account is compromised, the attacker won't automatically gain high-level administrative access, significantly reducing the risk of a widespread breach and protecting sensitive data under Australian privacy laws.
- What is phishing-resistant MFA for Microsoft 365 admin accounts?
- Phishing-resistant multi-factor authentication (MFA) uses methods like FIDO2 security keys or Windows Hello for Business, which are designed to prevent credential theft even if an attacker manages to phish your password. This is a higher level of security than traditional SMS or app-based MFA for your Microsoft 365 admin accounts.
- Can I use my regular email account for Microsoft 365 admin tasks?
- While technically possible, it is a significant security risk and strongly discouraged. Your regular email account is frequently used for day-to-day tasks, making it a more common target for phishing and other attacks. Using it for admin tasks exposes your entire Microsoft 365 tenant to unnecessary risk.
- How often should I review my Microsoft 365 admin roles in my Australian business?
- You should regularly review your Microsoft 365 admin roles, at least quarterly, as part of your ongoing cyber security posture management. This ensures that only necessary accounts retain elevated privileges and helps prevent 'privilege creep' over time, especially during staff changes or project completions.
Sources
Every reference below was link-checked when this article was published.
- 1.Best practices for Microsoft Entra rolesMicrosoft Learn
- 2.Security defaults in Microsoft Entra IDMicrosoft Learn
- 3.What is Conditional Access?Microsoft Learn
Want to know where your own tenant stands?
The audit answers these questions with a dated report on your actual settings — a few questions to start, under a minute.
