How many Global Admins should a Microsoft 365 tenant have?

A target by tenant size

Microsoft's ceiling does not change with headcount. What changes is how much of the work can move to eligible, just-in-time access and to narrower roles. The table is our suggested split inside Microsoft's guidance, not a Microsoft number.

Two things hold at every size. The emergency access accounts should be permanent active assignments, not eligible, so an outage in PIM or MFA cannot lock you out. And any Global Administrator that exists because "we needed it once for a migration" belongs on the removal list below.

Count every Global Administrator, three ways

Use at least two of these, because each one has a blind spot.

1. Entra admin center

In the Microsoft Entra admin center, open Roles and administrators. The list has a Privileged column and a filter for privileged roles, and the Assignments column shows how many assignments each role has. Open Global Administrator and read the assignment list. This is the fastest check and the one you should screenshot for your records.

2. The Overview alert card

If the Entra Overview page is showing a Global Administrators alert card, you have five or more privileged Global Administrator assignments. Treat it as a tripwire and nothing more: the card is silent at four, and four is still too many if two of them are not your emergency access accounts.

3. Microsoft Graph or PowerShell

Role definitions carry an isPrivileged property, and role assignments can be filtered with roleDefinition/isPrivileged eq true. Microsoft's documented examples use the beta endpoint, for example Get-MgBetaRoleManagementDirectoryRoleDefinition -Filter "isPrivileged eq true". Narrow the assignment list to Global Administrator and export it. The advantage of this route is that it returns every principal type, not just users, which matters for the next section.

Blind spot one: PIM eligible assignments

An eligible assignment grants nothing until the user activates it, so a list of active role members will not show it. If your tenant has Entra ID P2 or Microsoft Entra ID Governance, open Privileged Identity Management and list eligible assignments for Global Administrator separately. Microsoft makes the same point for Azure roles: Resource Graph queries return only active assignments, and eligible ones have to be listed on their own. For your headcount, an eligible Global Administrator is still a person who can become Global Administrator on demand. Count them. Whether eligible assignments count toward the Overview alert card is not something Microsoft states, so do not let the card do this arithmetic for you.

If you are on Microsoft 365 Business Premium or E3 without an add-on, you have Entra ID P1, not P2, so PIM is not in play and this blind spot is empty. See what you can do about privileged access without P2 and the glossary entry for PIM eligible assignment.

Blind spot two: service principals and app registrations

Directory roles are not limited to people. Applications and service principals can hold Entra built-in roles, and Microsoft classes any service principal or application that holds a highly privileged role as a control plane (Tier 0) asset that must be isolated and administered only from equally trusted systems. A migration tool, a backup product, or an old automation script that was granted Global Administrator years ago is exactly the assignment a people-only count misses. The Graph route above returns them; the admin center list shows them too if you read past the user accounts. Our guide on service principals holding Global Administrator covers what to do with each one.

While you are there, look at two adjacent roles. Privileged Role Administrator can manage assignments for every Entra role including Global Administrator, and holders can grant themselves more privilege by assigning more roles. Privileged Authentication Administrator can set or reset the password and authentication methods of any user, including Global Administrators. Neither appears in a Global Administrator count, and both can produce a new Global Administrator in one step. See Privileged Role Administrator for the escalation path.

Reduce the count safely

Removing Global Administrator from the wrong account at the wrong time is how tenants end up locked out. Work through these steps in order.

1. Capture the before-state. Export the full assignment list from the Graph or PowerShell query, including principal type, and keep the admin center screenshot. Record, for each assignment, who owns it, why it exists, and when it was last used. Entra audit log entries cannot be changed or deleted, but on P1 they are retained for 30 days, so keep your own copy of anything you will need to explain later.
2. Confirm the emergency access accounts first. Before removing anyone, check that you have two or more cloud-only emergency access accounts on the .onmicrosoft.com domain, permanently assigned Global Administrator, excluded from Conditional Access policies that block or restrict sign-in, and tested within the last 90 days. If not, fix that first. Our break glass account guide walks through it.
3. Map each remaining person to a narrower role. Microsoft publishes a "Least privileged role by task" reference across more than 65 built-in roles. Match the work the person actually does to that list. Exchange Administrator, SharePoint Administrator, Teams Administrator, Groups Administrator, Billing Administrator, and Compliance Administrator are not flagged privileged by Microsoft; Helpdesk Administrator and Application Administrator are. Least privilege has three dimensions in Microsoft's framing: a specific set of permissions, over a specific scope, for a specific period of time.
4. Check Azure elevation before you remove the role. Entra roles and Azure roles are separate systems, but a Global Administrator can switch on the "Access management for Azure resources" toggle and gain User Access Administrator at Azure root scope. Deactivating the Global Administrator assignment does not turn that toggle off, the setting is per user, and the root-scope assignment persists until someone removes it. Check each account and clear it before the role goes. See elevate access.
5. Remove one assignment at a time, with a second administrator signed in. A Global Administrator cannot remove their own Global Administrator assignment, and PIM protects the last active Global Administrator and Privileged Role Administrator assignments. Do not make either guard your plan. Prefer cloud-native accounts for whatever remains; Microsoft advises against on-premises synced accounts in Entra roles because a compromised on-premises account can compromise Entra resources.
6. Verify and set a recovery path. Re-run the count. Confirm the Overview alert card is gone if it was showing. Write down how a removed administrator gets the role back if a task genuinely needs it: who approves, who assigns, and for how long. If you have P2 or ID Governance, turn on recurring access reviews for the role. If you do not, put a quarterly manual review on the calendar and keep the export from step one as the baseline.

Know when the count changes without P2

Microsoft's built-in answer is PIM, which can notify you when users are added to highly privileged roles. PIM requires Entra ID P2 or Microsoft Entra ID Governance, and Microsoft 365 Business Premium and E3 include Entra ID P1, so most lean teams do not have it without an add-on.

You still have the Entra audit log. Audit logs are available on every Entra license tier, entries are system generated and cannot be changed or deleted, and on P1 they are retained for 30 days in the portal and API. Streaming audit logs to Azure Monitor and Log Analytics requires P1 or P2, which Business Premium and E3 already include, and a Security Administrator can create the diagnostic setting that sends them there. Once the audit log lands in Log Analytics, build an alert rule on the entry written when a member is added to the Global Administrator role, and a second one for Privileged Role Administrator. This is the same pattern Microsoft recommends for emergency access accounts: monitor all sign-in and audit activity and configure alerts for every use through Azure Monitor, Microsoft Sentinel, or another tool.

Three passive indicators back that up. The Overview alert card at five or more Global Administrator assignments. The warning on Roles and administrators at more than ten privileged assignments. And the Assignments column, which you can compare against last month's screenshot in a minute. None of them is quick, and none of them tells you a service principal quietly picked up the role, which is why an inventory across people and applications is the control that matters.

Why the count creeps

By default, the person who signs up for a Microsoft cloud service creates the tenant and becomes its first Global Administrator. From there the growth is ordinary: a consultant needs it for a migration, a helpdesk lead gets it to unblock a ticket, a backup vendor asks for it at install time, and nobody sets a date to take it away. Microsoft's own reasons for running recurring access reviews name both account compromise and people changing teams and accumulating access. The fix is not a one-time cleanup. It is a count you can see every week and a removal process nobody is afraid to run.

Related reading

• Global Administrator and emergency access account in the glossary
• What to do when an Entra admin account is compromised
• Identity blast radius: what a Global Administrator can reach
• All guides

Sources

• Best practices for Microsoft Entra roles (fewer than five Global Administrators, Overview alert card, fewer than ten privileged assignments, least privileged role by task, access reviews, cloud-native accounts)
• Privileged roles and permissions in Microsoft Entra ID (Privileged column, isPrivileged filter, control plane assets)
• Manage emergency access admin accounts
• Microsoft Entra built-in roles (which roles are privileged, Privileged Role Administrator and Privileged Authentication Administrator scope, self-removal block)
• What is Microsoft Entra Privileged Identity Management (eligible versus active, last-admin protection)
• Microsoft Entra ID Governance licensing fundamentals (PIM licensing; Business Premium and E3 include Entra ID P1)
• Elevate access to manage all Azure subscriptions and management groups
• Troubleshoot Azure RBAC limits (eligible assignments not returned by Resource Graph)
• Access activity logs in Microsoft Entra ID (audit logs on every tier, diagnostic settings role)
• Audit logs in Microsoft Entra ID (entries cannot be changed or deleted)
• Analyze activity logs with Log Analytics (streaming requires P1 or P2)
• Microsoft Entra data retention (30 days on P1)
• Agent service principals (service principals can be assigned Entra built-in roles)

All Microsoft facts on this page were checked September 2026 against the pages above.