Global Administrator

microsoft

Azure AD role with unrestricted access to all administrative features in Microsoft 365 and Azure AD.

What is Global Administrator?

Global Administrator is the most powerful role in Azure AD—it can manage all aspects of the directory and all Microsoft 365 services. This role can assign any other role, access any mailbox, and modify any setting. Because of this power, it should be limited to 2-4 trusted individuals and protected with the strongest authentication requirements.

In Microsoft 365

Global Administrators can manage Conditional Access, PIM, applications, users, groups, and all M365 services. Microsoft recommends using least-privilege roles instead (User Administrator, Exchange Administrator, etc.) and implementing PIM for just-in-time Global Admin access.

Examples

  • 1Creating Conditional Access policies
  • 2Managing Azure AD roles
  • 3Accessing any user mailbox

Related TrueConfig Controls

These controls help implement and verify global administrator in your Microsoft 365 environment.

PA-01Limit Global Administrators to 2-4PA-01-L2Eliminate Permanent Global AdministratorsPA-04Require PIM for All Privileged Roles

Frequently Asked Questions

What is Global Administrator?▼
Azure AD role with unrestricted access to all administrative features in Microsoft 365 and Azure AD.
How does Global Administrator work in Microsoft 365?▼
Global Administrators can manage Conditional Access, PIM, applications, users, groups, and all M365 services. Microsoft recommends using least-privilege roles instead (User Administrator, Exchange Administrator, etc.) and implementing PIM for just-in-time Global Admin access.
What are examples of Global Administrator?▼
Examples of Global Administrator include: Creating Conditional Access policies, Managing Azure AD roles, Accessing any user mailbox.
Which TrueConfig controls relate to Global Administrator?▼
TrueConfig controls related to Global Administrator include: PA-01, PA-01-L2, PA-04. These controls help implement and verify global administrator in your environment.

Related Terms

Least Privilege

Security principle that grants users only the minimum access rights necessary to perform their job functions.

Privileged Identity Management

(PIM)

Just-in-time privileged access service that enables time-limited, approval-based activation of administrative roles.

← Back to GlossaryBrowse Controls →