Control: 1.1.3 Ensure that between two and four global admins are designated

Description

More than one global administrator should be designated so a single admin can be monitored and to provide redundancy should a single admin leave an organization. Additionally, there should be no more than four global admins set for any tenant. Ideally global administrators will have no licenses assigned to them.

If there is only one global tenant administrator, he or she can perform malicious activity without the possibility of being discovered by another admin. If there are numerous global tenant administrators, the more likely it is that one of their accounts will be successfully breached by an external attacker.

Remediation

To correct the number of global tenant administrators:

1. Navigate to the Microsoft 365 admin center https://admin.microsoft.com.
2. Select Users > Active Users.
3. In the Search field enter the name of the user to be made a Global Administrator.
4. To create a new Global Admin:
   1. Select the user's name.
   2. A window will appear to the right.
   3. Select Manage roles.
   4. Select Admin center access.
   5. Check Global Administrator.
   6. Click Save changes.
5. To remove Global Admins:
   1. Select User.
   2. Under Roles select Manage roles.
   3. De-Select the appropriate role.
   4. Click Save changes.