When I review tenants, I still find far too many users holding Global Administrator rights. Sometimes it's habit, sometimes nobody can say who actually needs them. Microsoft has recommended for years that you reduce Global Administrators to fewer than five per tenant, but getting there takes a process rather than a quick fix. This is how I approach it in real projects. I find every GA assignment, map tasks to the least-privileged roles, and then use Privileged Identity Management (PIM) together with regular access reviews so the number stays low.
Your first job is to get the real list of Global Administrators
Start in the Entra admin center under Roles & admins → Global Administrator. Active assignments are only part of the picture, so include all eligible assignments via PIM and check for group-based roles as well. Plenty of tenants overlook the fact that anyone with an eligible PIM assignment can activate full GA at any time. I export both active and eligible assignments regularly so I always have the complete set to review.
Pulling the list only takes a minute:
- Entra admin center → Roles & admins → Global Administrator
- Show all assignments (active and eligible)
- Export as CSV
Every clean-up builds on this. If you don't know who you're dealing with and how they got the role, you can't reduce Global Administrators in any meaningful way. A documented, complete list also matters for audits and for figuring out who really uses which privileges.
Most admin tasks don't need a Global Administrator
The bulk of everyday admin work runs fine without Global Admin. What you have to do is match each task to the right built-in role, and Microsoft documents this well (role-based access control best practices, delegate by task). The strongest resistance I run into comes from legacy processes ("we've always done it this way") and from individual onboarding or offboarding steps that default to GA when a narrower role would do.
These are the roles I reach for first:
- User Administrator: user and group management, password resets
- Exchange Administrator: mailbox and distribution group control
- Security Administrator: incident visibility, security config
- Global Reader: view-only access to all settings and data
People often ask for GA just to finish one task that a least-privileged role would handle easily. Question those requests and map each business process to the minimum role it needs. In nearly every case you'll find something that fits better than GA.
A cheat sheet maps common tasks to least-privileged roles
To make this workable day to day, I keep a cheat sheet that lists frequent admin tasks next to their least-privileged roles. This is a simplified version from my projects:
| Task | Role(s) |
|----------------------------------------|-------------------------------|
| Create/delete users | User Administrator |
| Manage groups | User Administrator |
| Assign licences | User Administrator, License Admin|
| Manage MFA/authentication | Authentication Administrator |
| Exchange Online configuration | Exchange Administrator |
| Security config/incidents | Security Administrator |
| Read-only (no changes) | Global Reader |
Global Reader in particular has become much broader and more useful over the past few years. I lean on it for audits, documentation and senior support. When something looks like it needs GA, check whether it's actually a protected action or whether a time-limited PIM activation would cover it.
PIM with approval and protected actions makes GA available on demand
Running with fewer Global Administrators really depends on Privileged Identity Management (PIM) in Entra ID. Most of my customers now have only a handful of users eligible for GA, and even they must activate on demand, often with a justification and an approval step. For Global Admin this matters most. With approval in place (the four-eyes principle), the risk of mistakes and of abuse drops to almost nothing.
Protected actions fit well alongside this, and I cover them in Protected actions in Entra ID: Step-up security for admin ops. With protected actions, even eligible users need a stronger authentication or have to meet other conditions before they can run sensitive operations, for example resetting authentication methods or managing break-glass accounts. I consider that essential for truly critical operations, and PIM is the mechanism that enforces it.
The diagram below shows a PIM activation with optional approval:
flowchart TD
Request["Request PIM activation"] --> Approval["Approval required?"]
Approval -- "Yes" --> Approver["Approver reviews request"]
Approver --> Activate["Role is activated"]
Approval -- "No" --> Activate
Activate --> Expiry["Role expires after set time"]
Figure: How a PIM activation with optional approval works for privileged roles.
In most tenants I work with, GA requires approval, and the difference is noticeable. Activation logs are simple to audit, and you always have a record of who did what and why.
Access reviews keep privileged roles clean over time
Cutting down Global Administrators isn't something you do once. You have to keep checking who holds which privileged roles, whether directly, through groups or through PIM eligibility. Entra ID's built-in Access Reviews make that manageable. I recommend reviewing the Global Admin, Security Admin, Exchange Admin and User Admin roles at least quarterly and always including eligible assignments. Group-based admin access slips through very easily, so make sure the reviews cover every path to privileged access.
My tip: Give someone clear ownership of running Access Reviews and acting on the results, instead of reviewing and then forgetting about it. Otherwise privileges creep back over time.
You don't need extra products for this. The review workflows built into Entra ID are good enough for most scenarios. What makes the difference is discipline, because regular, documented reviews are what keep your admin setup in order.
Reducing GA remains ongoing work rather than a one-off project
When you reduce Global Administrators, you change how people think about admin rights as much as you change the configuration. It means taking least privilege seriously, saying no to "just in case" assignments, and properly using what we already have: role mapping, PIM with approval, protected actions and regular reviews. A small GA footprint lowers risk, makes compliance easier and takes pressure off everyone who runs the tenant.
For more depth, have a look at Privileged Identity Management in Entra ID: Moving from Standing Admin Rights to Just-in-Time Access – Lessons from the Field for practical PIM advice, and at Protected actions in Entra ID: Step-up security for admin ops for the details on protected actions.
