Microsoft 365 Admin and Emergency Access Accounts

In many small businesses, the person who opened the Microsoft 365 subscription still works every day with a Global Administrator account. They read email, open attachments and browse the web with rights that can change everything. And on the day that account is locked out, nobody can get into the console. Microsoft and the Canadian Centre for Cyber Security both say how to avoid these two situations.

1. An ordinary account for everyday work

For small businesses, Microsoft is clear: use ordinary user accounts for regular work tasks, and your admin account only as needed (Microsoft Learn, admin account security). The same page notes that an account used only for administration does not need a licence.

The Canadian Centre agrees. It recommends administrative accounts separate from users’ normal access, which cannot access the internet or email, and applying the principle of least privilege (ITSAP.10.094). The idea is simple: a booby-trapped email opened with an ordinary account does less damage than one opened with an account that can change everything.

2. Few Global Administrators

Microsoft recommends assigning the Global Administrator role to fewer than five people (Microsoft Learn, roles best practices). For routine tasks, such as resetting a password or managing licences, more limited roles exist. Every extra Global Administrator account is one more door into the whole environment.

3. Multifactor authentication for every administrator

Microsoft says to turn on multifactor authentication for all administrator accounts (Microsoft Learn, roles best practices), and so does the Canadian Centre (ITSAP.10.094). For the admin consoles it is no longer a choice: Microsoft has been enforcing it gradually since 2024, and for the Microsoft 365 admin center since February 2025 (Microsoft Learn, mandatory MFA). Our article on mandatory MFA explains what this requirement covers, and what it does not.

4. Two emergency access accounts

This is the point many businesses miss. If the only administrator loses their phone, leaves the company or gets blocked by a security rule, nobody can administer the subscription. Microsoft therefore recommends keeping at least two emergency access accounts (Microsoft Learn, emergency access accounts). What Microsoft’s page says, as read on 7 October 2026:

• cloud-only accounts that use the *.onmicrosoft.com domain, not your own domain;
• accounts not associated with any individual user;
• passwordless sign-in, with a passkey (FIDO2) or a certificate, methods that satisfy the mandatory multifactor authentication requirements;
• credentials kept in fireproof safes, in secure and separate locations.

5. Exclude them only from what blocks

One piece of guidance has changed, and older pages still say the opposite. Emergency access accounts must also sign in with multifactor authentication, and exceptions configured in the past no longer apply (Microsoft Learn, mandatory MFA). What Microsoft asks today is to exclude them only from the Conditional Access policies that block or restrict sign-in (Microsoft Learn, emergency access accounts). Note that Conditional Access requires a Microsoft Entra ID P1 licence (Microsoft Learn, roles best practices).

6. An alert on every use, a test every 90 days

An emergency account is almost never used. Microsoft therefore recommends an alert for every use, and validating that it works at least every 90 days, as well as after staff changes (Microsoft Learn, emergency access accounts). The alert procedure Microsoft describes goes through Azure Monitor. The Canadian Centre also says to log actions on privileged accounts (ITSAP.10.094).

In short

An ordinary account for work. Fewer than five Global Administrators, all with multifactor authentication. Two emergency accounts, passwordless, stored apart, with an alert and a test every 90 days. If your business is moving to Microsoft 365 or is already there, our Microsoft 365 page describes how we work on accounts and access.

Frequently asked questions

How many emergency access accounts are needed?

Microsoft recommends keeping at least two, cloud-only, on the *.onmicrosoft.com domain.

Should emergency access accounts be excluded from MFA?

No: they must also sign in with multifactor authentication, ideally with a FIDO2 passkey or a certificate. Microsoft only asks to exclude them from Conditional Access policies that block or restrict sign-in.

How many Global Administrators in Microsoft 365?

Microsoft recommends assigning the Global Administrator role to fewer than five people.

What now?

Not sure how many accounts hold Global Administrator rights in your business, or whether anyone could get in on the day the administrator is locked out? Ask for MPJM’s free network analysis, offered to businesses with 10 or more workstations: it looks at exactly that, your Microsoft 365 accounts.

P.S. Sixteen questions, eight domains, a clear picture of your strengths and blind spots: start the assessment.