The settingWhat we hold this to
CreativeTechs minimum
Zero accounts hold a tenant-wide privileged role AND a mailbox. Admin accounts are cloud-only, licensed only for what the role needs. Global Administrator count 2 to 4. Prefer least-privileged roles over Global Administrator.
Benchmark position
CISA MS.AAD.7.2 (Entra ID Free) — use finer-grained roles instead of Global Administrator. Huntress: 'Administrative accounts are cloud-only' and 'use licences with a reduced application footprint', both High.
Where we differ, and why
Live finding: the CreativeTechs tenant fails this today — two accounts named Tim Pearson, both tenant-wide roles, both mailbox-enabled.
Where the switch is
Entra admin centre → Identity → Roles & admins → each role → Assignments. Create replacement cloud-only admin accounts under Identity → Users.
How to verify
Graph: /directoryRoles/{id}/members joined to /users?$select=mail,assignedLicenses → expect no member with a mailbox- Why it matters
- Role separation means a phished daily-driver session doesn't carry Global Admin along with it.
- How we check
- Maester MT.1027, MT.1028, CISA.MS.AAD.7.2. Secure Score RoleOverlap.
- Fix — M365
- Cloud-only admin accounts, tenant-wide roles removed from mailbox-enabled day-job accounts, PIM for just-in-time elevation where P2 exists. Prefer finer-grained roles over Global Admin.
- Fix — Google
- Separate super-admin accounts, delegated admin roles for routine work.
- User notices
- Admins sign in twice and keep two browser profiles.
- Expected pushback
- Strong at small shops — “I'm the only IT person here.” The honest answer is that one-person shops are exactly where the daily driver IS the whole tenant. Also fails on our own tenant today.