Use separate administrator accounts in Microsoft 365

Create the separate administrator account

Open the Microsoft 365 admin centre and sign in with an existing Global Administrator account.

• Select Users, then Active users, then Add a user.
• Enter an identifiable name, such as First name: Neil, Last name: Admin, Username: neil.admin.
• Preferably use the tenant’s original Microsoft domain: neil.admin@business.onmicrosoft.com.
• Generate a strong temporary password.
• Select Require this user to change their password when they first sign in.
• Do not assign a Microsoft 365 licence unless the account genuinely requires a licensed service.
• Continue to the role-assignment section.

Using the .onmicrosoft.com domain reduces the admin account’s dependency on the organisation’s public domain and associated DNS configuration.

Do not configure email forwarding or a mailbox for this account. Giving an admin account a mailbox encourages everyday use and exposes it to email-based attacks.

Assign the appropriate administrative role

Do not automatically assign Global Administrator. Use the least-privileged role that allows the administrator to complete their work.

• During account creation, open Roles, select Admin centre access, then select the required role or roles.
• Alternatively, open the Microsoft Entra admin centre, select Entra ID → Users, open the new administrator account, select Assigned roles, then Add assignments.
• Choose the required role, select Next, followed by Assign.

If Microsoft Entra ID P2 or Microsoft Entra ID Governance is available, use Privileged Identity Management (PIM) so powerful roles can be activated only when required instead of remaining permanently active.

Global Administrator provides extensive control over the entire tenant. Limit this role to the smallest practical number of trusted administrators.

Secure the new account

Open a private or InPrivate browser window and go to:

• Sign in using the new administrator account.
• Change the temporary password if prompted.
• Register at least two secure authentication methods where practical.
• Prefer the following methods, in this order: Passkey or FIDO2 security key, Microsoft Authenticator passwordless authentication, Microsoft Authenticator number matching.
• Avoid SMS and voice authentication except as a temporary fallback.
• Store recovery information securely.
• Do not use the same password as the administrator’s everyday account.

Register the authentication methods before enforcing stronger Conditional Access requirements. Enabling a phishing-resistant authentication policy before administrators have enrolled a compatible passkey or security key can lock them out.

Test the new administrator account

Before changing the old account:

• Sign out of all Microsoft sessions.
• Open a new private or InPrivate browser window.
• Sign in to https://admin.microsoft.com with the new administrator account.
• Complete the MFA challenge.
• Confirm the correct admin portals are accessible.
• Perform a safe, non-destructive test relevant to the assigned role, such as opening the active users list, viewing Exchange settings or viewing SharePoint settings.
• Confirm that the account cannot access areas outside its required responsibilities, where applicable.
• Sign out when finished.

Do not proceed if the new account cannot sign in, complete MFA or access the required administration functions.

Remove administrator access from the everyday account

Only complete this step after the separate account has been successfully tested.

• Sign in using the new administrator account.
• Open the Microsoft Entra admin centre.
• Select Entra ID → Users, then select the administrator’s everyday account.
• Select Assigned roles and review every assigned role.
• Remove roles that are no longer required.
• Confirm that the everyday account is now a standard user.
• Sign out and test both accounts: the everyday account should access email and normal Microsoft 365 services; the administrator account should access only the required administration tools.

Removing an administrative role can affect PowerShell sessions, third-party management platforms, backup systems, automated scripts and applications that were improperly configured to use the person’s everyday account.

Establish safe working practices

Administrators should adopt the following habits:

• Use their normal account for email, Teams, Office applications and everyday browsing.
• Use the admin account only when an administrative change is required.
• Open a private browser window or a separate browser profile for admin work.
• Close unrelated browser tabs before signing in as an administrator.
• Never approve an unexpected MFA request.
• Sign out of the administrator account immediately after completing the task.
• Avoid saving the administrator password in the ordinary browser profile.
• Use a secured and fully patched workstation for administration.
• Never share an individual administrator account.
• Regularly review administrator sign-in and audit logs.

Create emergency-access accounts

Microsoft currently recommends maintaining at least two cloud-only emergency-access accounts for recovery if normal administrator accounts become unavailable.

• Use the tenant’s .onmicrosoft.com domain.
• Give the accounts the Global Administrator role.
• Do not assign them to a particular employee.
• Use them only for genuine emergencies and scheduled testing.
• Use phishing-resistant authentication, preferably separately stored FIDO2 security keys.
• Exclude them from Conditional Access policies that could prevent emergency access.
• Monitor them so that any sign-in generates an alert.
• Test them at least every 90 days.
• Store their credentials and security keys securely in separate locations.

Excluding an emergency account from Conditional Access does not mean leaving it weakly protected. It should use strong, phishing-resistant authentication and be closely monitored. Incorrect exclusions may create a route around your organisation’s security controls.