Checklist / Microsoft 365

Who Has Administrator Access to Your Microsoft 365 Environment?

Harris Ejiofor, CISM – CyberShield Advisory

Administrator accounts can change settings and reach a great deal of data. This checklist helps you find out who holds that power and whether they still should.

Why this question matters

An administrator in Microsoft 365 can create accounts, change security settings, read or export data and turn protections off. That makes administrator accounts the most valuable ones in your environment, for an attacker and for an honest mistake alike. In some small organizations the list of administrators has grown without anyone deciding it should. A former IT contractor, a founder who set things up years ago and an assistant who needed one task done may all still hold broad rights.

Find out who holds power

You have a current list of every person and service with an administrator role.
The list shows which role each person holds, not only that they are an administrator.
Your IT provider or outside vendor is on the list only if they should be, with a named contact.
Former employees, former contractors and former vendors have been removed.
There are no shared administrator accounts that several people sign in to.

Reduce what each person can do

Each person holds the narrowest role that lets them do their job, rather than the most powerful one.
The number of people with the most powerful roles is small.
Administrators use a separate account for administrative work rather than their everyday mailbox, where practical.
Temporary access has an end date.

Protect the accounts themselves

MFA is required for every administrator, using a method that is hard to trick, such as an authenticator app with number matching or a security key.
Administrators sign in only from managed devices where your license and setup allow it.
You have two or more emergency accounts, stored securely and monitored, so a mistake cannot lock everyone out.

Watch and review

Someone reviews the administrator list on a schedule, such as every quarter, and records that they did.
Changes to administrator roles would produce an alert or a record you can find.
You know what happens to access when an administrator leaves, and it happens the same day.

What to do with your answers

Mark each item yes, no or not sure. Treat not sure as no. If you cannot get a list of administrators in a few minutes, that is the first thing to fix. Then remove access that is not needed, require MFA where it is missing, and put a review date on the calendar.

Features such as role-based limits, privileged access controls and device conditions vary by license, so ask what your plan includes before assuming a control is available.

Take the next step

Our free Microsoft 365 security assessment asks five quick questions, including whether everyone, administrators too, needs a second step to sign in, and shows where to start. It is a short check, not a full review of your settings.