I come from an on-premise Active Directory background, but at my new position our company is entirely Microsoft 365 / Azure AD. We have no on-prem anything.

Our people are scattered across the country, all using laptops, and currently use a local account or possibly a personal Microsoft account when using their Windows 10 computer, and only use their AAD credentials to access email, Sharepoint, Teams, etc.

I plan to join the computers to AAD and manage them with Intune, but some of our C-levels have Global Admin access to the M365/AAD systems. With on-prem, we never assigned Domain Admin rights to our regular user accounts, instead using regular accounts for day-to-day work, and a separate account for administration purposes. Am I correct in assuming that I should do the same with AAD - take away their Global Admin rights on their regular accounts? It just seems a recipe for disaster if some malware gets on their domain-joined PC and they're logged in as a Global Admin. Or does this setup have mechanisms in place to safeguard against this type of scenario that I'm not aware of?

To be clear, I trust these people not to misuse their power, but I'm trying to guard against attacks. Any links to a good M365/AAD security best practice document would also be appreciated. (rather than Microsoft's "best practices" article that suggests I upgrade to AAD Prem P2 to subscribe to their security services)

1 Answer 1


Am I correct in assuming that I should do the same with AAD - take away their Global Admin rights on their regular accounts?

You are absolutely correct. This isn't specific to Office 365. This is standard best practice. They (and you) should log onto your computers with "standard" Office 365/Azure AD user accounts (no Office 365 or Azure management roles), and you should use dedicated, named Global Admin accounts for tasks that require that role.

Are there safeguards in place? Only if you put them in place. One of which is using the Office 365 security defaults and also implementing multifactor authentication for all accounts that have Office 365 or Azure AD management roles. A Global Admin is a Global Admin and has all the rights, permissions, and abilities of a Global Admin. There's no protection mechanism to say "Oh, this Global Admin is logging in from an Azure AD joined machine so we'll restrict their Global Admin ability."

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.