I come from an on-premise Active Directory background, but at my new position our company is entirely Microsoft 365 / Azure AD. We have no on-prem anything.
Our people are scattered across the country, all using laptops, and currently use a local account or possibly a personal Microsoft account when using their Windows 10 computer, and only use their AAD credentials to access email, Sharepoint, Teams, etc.
I plan to join the computers to AAD and manage them with Intune, but some of our C-levels have Global Admin access to the M365/AAD systems. With on-prem, we never assigned Domain Admin rights to our regular user accounts, instead using regular accounts for day-to-day work, and a separate account for administration purposes. Am I correct in assuming that I should do the same with AAD - take away their Global Admin rights on their regular accounts? It just seems a recipe for disaster if some malware gets on their domain-joined PC and they're logged in as a Global Admin. Or does this setup have mechanisms in place to safeguard against this type of scenario that I'm not aware of?
To be clear, I trust these people not to misuse their power, but I'm trying to guard against attacks. Any links to a good M365/AAD security best practice document would also be appreciated. (rather than Microsoft's "best practices" article that suggests I upgrade to AAD Prem P2 to subscribe to their security services)