In this guide · 8 sections
- 01Why admin accounts are the accounts attackers want
- 02How many admins a small business should have
- 03Separate admin accounts from everyday accounts
- 04Emergency access (break-glass) accounts
- 05Giving your IT provider admin access safely
- 06Admin rights outside Microsoft 365 and Google
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Have at least two, and fewer than five, people with full admin rights. Give each a separate admin account used only for admin tasks, protected by phishing-resistant MFA. Keep an emergency access account in a safe place, and give IT providers their own limited access rather than a shared login.
Why admin accounts are the accounts attackers want
A normal mailbox compromise is bad. An admin compromise is worse: the attacker can create new users, read any mailbox, set up forwarding rules, turn off MFA for others and lock you out. Microsoft describes Global Administrators as having almost unlimited access to your organisation's settings and most of its data.
The usual weak points in small firms are predictable: the owner's everyday mailbox is also the Global Admin, there is only one admin so a lost phone means a lockout, and an old agency or ex-employee still has admin rights nobody remembers granting.
How many admins a small business should have
The vendors agree on a narrow range. Microsoft's Entra role best practices recommend assigning Global Administrator to fewer than five people. Google's admin security best practices say to have more than one super admin, each managed by a separate person, and never to share an admin account.
| Role | Who in a typical SME | How many |
|---|---|---|
| Global Admin / Super Admin | Owner or director, plus one trusted second person (or your IT provider's named account) | 2, at most 4 |
| Limited admin roles | Office manager who resets passwords, finance person who manages billing | As needed |
| Emergency access account | Nobody day to day; credentials stored securely | 2 in Microsoft 365 |
| Everyone else | Normal user accounts | All other staff |
Use limited roles wherever you can. Microsoft's admin roles page gives the example of assigning Password Administrator or Helpdesk Administrator to someone who only needs to reset passwords, instead of full Global Admin. Google Workspace has equivalent prebuilt roles such as User Management and Help Desk Admin.
Separate admin accounts from everyday accounts
Microsoft's guidance on protecting Global Administrator accounts is to create dedicated admin accounts and sign in to them only for admin tasks. Google says the same: give each super admin two accounts and do not stay signed in to the super admin one. CSA's Cyber Essentials mark expects the same separation and MFA on admin access.
The reason is simple. Phishing emails, malicious attachments and dodgy websites reach your everyday account. If that account has no admin rights, a successful phish costs one mailbox, not the whole company.
Create a dedicated admin account for each admin
Use a clear name such as admin.jane@yourcompany.com. In Microsoft 365 it can sit on your domain or the onmicrosoft.com domain. It does not need a mailbox for daily use.
Move the admin role to the new account
Assign Global Admin or Super Admin to the dedicated account, confirm it works, then remove the role from the person's everyday account.
Protect it with the strongest MFA you have
Use a passkey or hardware security key where possible, or an authenticator app. Google calls security keys the most secure form of 2-Step Verification. Avoid SMS for admins.
Store the credentials in a password manager
Keep admin passwords in a business password manager vault that only admins can open, not in a browser or a spreadsheet.
Sign in only when needed, then sign out
Use the admin account for admin tasks only, ideally in a separate browser profile, and sign out afterwards.
Emergency access (break-glass) accounts
An emergency access account is a spare admin you only use when normal admins cannot sign in. Microsoft's emergency access guidance recommends two or more such accounts, cloud-only on the onmicrosoft.com domain, not tied to any one employee, protected by a different strong method from your normal admins (for example a FIDO2 key if admins use the Authenticator app), excluded from Conditional Access policies that could block them, and tested at least every 90 days.
For a small business that can mean two hardware keys kept in two separate safe places, such as the office safe and the director's home, with the procedure written on one page. Set an alert so every sign-in to these accounts emails the other admins.
In Google Workspace, the equivalent is a second super admin with a spare security key and printed backup codes stored securely, as Google's best-practice page suggests.
Giving your IT provider admin access safely
Never give an outside provider your own login, and avoid a shared "it@" admin account that several people use. You lose the record of who did what, and you cannot remove one person without changing it for everyone.
- Microsoft 365 via a partner: use GDAP (granular delegated admin privileges). Microsoft's GDAP overview describes it as least-privileged, time-bound access that the customer must explicitly approve.
- Microsoft 365 or Google without a partner relationship: create a named admin account for the provider with only the roles they need, and disable it when the job ends.
- Website, domain and SaaS tools: add the provider as a staff user or collaborator with limited rights. Keep the owner role, billing and domain registrar login in the business's name.
If an agency currently holds the owner account for your domain or website, see our guide on getting website and domain access back from an agency.
Admin rights outside Microsoft 365 and Google
Your email platform is only one of the places where admin rights matter. The same rules (two owners, named accounts, MFA, no shared logins) apply to:
Where else to check admin rights
For the full Microsoft and Google hardening lists, use our Microsoft 365 security checklist and Google Workspace security checklist.
Do it yourself or get help?
A careful owner can set up separate admin accounts and a second admin in an hour. Keep the work ongoing: review who holds admin rights every quarter, and remove them the same day someone leaves, as in our employee offboarding checklist and quarterly access review checklist.
Our Microsoft 365 / Google Security Lockdown (S$590) sets up separate admin accounts, emergency access, MFA and admin alerts for you. For businesses with many apps and staff changes, the Access Review & Leaver Tool (from S$1,200) tracks who has access to what.
Frequently asked questions
Microsoft recommends fewer than five Global Administrators. For most small businesses, two is right: the owner's dedicated admin account and one trusted second person or named IT provider account. Add two emergency access accounts that are not used day to day, and use limited roles for everyone else.
The owner should hold admin rights so the business never depends on one employee or an outside agency. But the owner's everyday mailbox should not be the admin account. Create a separate admin account for the owner, protected by strong MFA, and use it only for admin tasks.
A break-glass or emergency access account is a spare admin account kept for emergencies, such as when every normal admin is locked out or their MFA devices are lost. Microsoft recommends at least two, cloud-only, protected with a strong method such as a FIDO2 key, and tested at least every 90 days.
No. Sharing a password removes accountability and makes it hard to cut off access later. Give the provider its own named account with only the roles it needs, or for Microsoft 365 use a GDAP relationship, which is time-bound and limited. Remove the access when the engagement ends.
Yes. Microsoft's security defaults require administrator roles, including Global Administrator, Exchange Administrator and Security Administrator, to complete multifactor authentication every time they sign in. Use a passkey, security key or authenticator app rather than SMS where you can, because admin accounts are prime targets.