A Global Administrator is the Microsoft Entra ID directory role with control over every setting and identity in the tenant, which Microsoft says to hold with fewer than five accounts. In Microsoft's own words, Global Administrators "essentially have unrestricted access": they can read and modify almost every administrative setting in Entra ID and, with a few exceptions, every configuration setting in Microsoft 365. They can reset any user's password, including every other administrator's, and can elevate their own access to manage every Azure subscription and management group in the tenant.
Why it matters to a lean team
The role is easy to accumulate and hard to notice. The person who signs up for a Microsoft cloud service creates the tenant and is assigned Global Administrator by default, and the count grows from there: a migration consultant, a former IT lead never downgraded, a helpdesk account promoted for one afternoon. On a one to five person security team, nobody owns the number, and each extra holder is a full-tenant compromise waiting on one phished password or stolen session token. Microsoft's guidance is fewer than five Global Administrators and fewer than ten privileged role assignments in total.
How it shows up in Entra ID and Azure
In the Microsoft Entra admin center, open Roles and administrators: the Privileged column marks the role and the Assignments column shows how many holders it has. Five or more privileged Global Administrator assignments put a Global Administrators alert card on the Entra Overview page. Over Microsoft Graph, the role definition has isPrivileged set to true, and Microsoft's documented examples filter role assignments with roleDefinition/isPrivileged eq true on the beta endpoint.
In Azure the role means nothing until it is used. Entra roles and Azure roles are separate systems, so a Global Administrator has no access to subscriptions by default. The switch is Microsoft Entra ID > Manage > Properties > Access management for Azure resources, visible only to Global Administrators. Setting it to Yes assigns the caller User Access Administrator at the Azure root scope, able to view every resource and assign access in any subscription or management group. Microsoft says to remove that access once the work is done; both the elevation and the removal land in the Entra directory audit logs and the Azure activity logs.
What to do about it
- Count the holders and get below five. Move routine administration onto the narrowest built-in role for each task. See how many Global Admins a Microsoft 365 tenant should have.
- Make the remaining assignments eligible rather than permanently active through Privileged Identity Management. Without P2, see Entra PIM without P2.
- Keep two or more cloud-only emergency access accounts with a permanent Global Administrator assignment, and keep on-premises synced accounts out of every privileged role. See break glass account best practices.
- Treat elevate access as an event: remove the root-scope assignment when the change is finished.
- Rehearse the day a holder is compromised: what to do when an Entra admin account is compromised.
Related terms
- Privileged Role Administrator: can assign any directory role, including Global Administrator, so it counts as one.
- Elevate access: the switch into Azure root scope.
- Emergency access account: the permanent exception to the fewer-than-five rule.
- PIM eligible assignment: the assignment most role counts miss.
- Identity blast radius: what one compromised holder can reach.
- Privileged identity response: governed action when a holder is compromised.
Back to the glossary index.
Where Orbitra fits
Orbitra puts human and non-human identities in one graph with blast radius traversal, so a lean team can see what each Global Administrator can reach before acting. When a holder is compromised, the response comes from an allowlisted catalog of more than two dozen governed response actions, and Orbitra tells you which steps are permanent. In Recommend mode, your team executes the response; in Approve mode, a named person signs off before Orbitra executes. Orbitra independently re-reads Microsoft after supported response actions to verify the final state. It works alongside Microsoft native controls such as PIM.
Sources
- Best practices for Microsoft Entra roles (fewer than five, the Overview alert card, fewer than ten privileged assignments, PIM, cloud-only accounts), checked September 2026.
- Microsoft Entra built-in roles (what Global Administrator can access and reset), checked September 2026.
- Privileged roles and permissions in Microsoft Entra ID (Roles and administrators view, isPrivileged filters), checked September 2026.
- Manage emergency access admin accounts (two or more accounts), checked September 2026.
- Elevate access to manage all Azure subscriptions and management groups (portal path, root-scope role, removal, audit logging), checked September 2026.