What the standard says
Both major platforms say the same thing: limit who has full admin access. In Microsoft 365, the top role is Global Administrator, which has essentially unrestricted access [1]. Microsoft recommends giving that role to fewer than five people [1]. CISA’s secure configuration baseline for Microsoft 365 sets a range: at least two and no more than eight Global Administrators, with the extra room meant for emergency access and some operational needs [2]. Microsoft also notes that the account used to sign up for Microsoft 365 is automatically a Global Administrator [3]. That first account is easy to forget about.
In Google Workspace, the top role is super administrator. Google says an organization should have more than one super admin account, each managed by a separate person [4].
The rest of the guidance comes down to four habits.
Least privilege. This means giving people only the access their job needs. If someone only resets passwords, Microsoft says to give them a limited role like Password Administrator or Helpdesk Administrator, not Global Administrator [5]. CISA’s baseline says the same [2], and Google recommends limited admin roles for routine tasks [4].
Separate accounts. Admins should check email and do daily work from a regular account, and sign in to the admin account only when needed [3]. Google says to give each super admin two accounts: one for admin work and one for everyday activities [4].
MFA on every admin. MFA, short for multi-factor authentication, asks for a second proof after your password. Microsoft says to require it for all users, especially administrators [5]. CISA’s baseline calls for phishing-resistant MFA on highly privileged roles [2]. Phishing-resistant means a fake login page can’t trick it into working, like a security key or a passkey (a sign-in tied to your device’s fingerprint, face or PIN check).
Emergency access accounts. Microsoft recommends two or more “break glass” accounts: admin accounts not tied to any one person, kept for the moment when everyone else is locked out [6]. They should be monitored, with alerts on every use, and tested regularly, for example every quarter [6].
What you’ll hear
“Only one person should have admin access. Fewer is safer, so one is safest.”
The instinct is right. Every admin account is another login that can unlock everything, and Microsoft says too many admin accounts give attackers more chances [3]. But one is too few. If that person leaves, gets locked out or loses their phone, the business can lose control of its own email. Microsoft points out that another Global Administrator or a Privileged Authentication Administrator can reset a locked-out Global Administrator’s password [5]. That’s why Google says more than one super admin [4], and why CISA’s minimum is two [2].
The fair version: a small number, not a single point of failure.
What the numbers say
We couldn’t find a reliable public statistic on how many admin accounts small businesses have, or how often extra admin accounts lead to a break-in. Instead, here are the numbers the platforms and CISA actually publish:
Fewer than 5: Microsoft’s recommended number of Global Administrators [1].
2 to 8: CISA’s required range of Global Administrators for agencies using its Microsoft 365 baseline [2]. It’s written for federal agencies, but the settings apply to any Microsoft 365 tenant.
2 or more: Microsoft’s recommended number of emergency access accounts [6].
More than 1: Google’s recommended number of super admin accounts, each managed by a different person [4].
90 days: the longest Microsoft suggests going between tests of emergency access accounts [6].
What we’ve seen
We haven’t run into this yet.
Putting it together
Admin accounts are the keys to the whole building, so the goal is a short, known list. Keep two or a few people with full access, give everyone else a narrower role, and have admins use a regular account for daily work. Add strong MFA and an emergency account, and one stolen password can’t take over the business.
What good looks like
Between two and four people with full admin access, each named and known.
Everyone else who helps with IT tasks on a limited role that matches the job.
Admins using a separate, regular account for email and daily work.
Phishing-resistant MFA, like a security key or passkey, on every admin account.
Two emergency access accounts, stored safely, monitored and tested every few months.
Admin access removed the same day someone leaves or changes roles.
A quick review of the admin list a few times a year.
Questions for your IT resource
How many people have Global Administrator or super admin access today, and who are they?
Is the account we used to sign up still an admin, and does anyone use it?
Could any of those people do their work with a more limited role?
Do our admins have separate accounts for daily email?
What MFA method do our admin accounts use?
Do we have an emergency access account, and when was it last tested?
Related learning
What is MFA, and why a password isn’t enough
MFA, short for multi-factor authentication, asks for a second proof after your password, like a prompt on your phone or a security key. A stolen password alone is no longer enough to sign in.
Forwarding rules and connected apps: who else can read your email
Mail rules and connected apps can quietly send copies of your email somewhere else or read it in the background. Reviewing them, and limiting who can create them, closes access that a password change alone won’t.
Who holds the keys to your domain and website?
Your domain registrar, DNS provider and web host each have a login, and whoever holds those logins controls your website and where your email is delivered. Give each one its own strong password, turn on MFA, and know who has access.
Related services
Sources
Microsoft, Best practices for Microsoft Entra roles, Microsoft Learn, updated June 2026. (checked 2026-10-07)
CISA, M365 Security Configuration Baseline for Microsoft Entra ID, policies last modified August 2024. (checked 2026-10-07)
Microsoft, Admin account security in Microsoft 365 for business, Microsoft Learn, updated January 2026. (checked 2026-10-07)
Google, Security best practices for administrator accounts, Google Workspace Help, updated October 2026. (checked 2026-10-07)
Microsoft, About administrator roles in the Microsoft 365 admin center, Microsoft Learn, updated June 2026. (checked 2026-10-07)
Microsoft, Manage emergency access accounts in Microsoft Entra ID, Microsoft Learn, updated June 2026. (checked 2026-10-07)
How we rate these. Our judgment from real setups, applied the same way on every page. Cost: $ = no new spend or under $25/month · $$ = a modest monthly tool or a short project · $$$ = new hardware, licensing, or a larger project. Effort: Light = one sitting · Moderate = setup plus follow-up over days or weeks · Heavy = planning, testing and staff changes. Outlined marks show how far it can go for some businesses. N/A = doesn’t apply to this topic. Time to fix: how long the first useful step takes, then how long until it’s fully done. Ratings are typical averages, not quotes. Time to fix: the filled dot is when the first useful step lands, the hollow dot is when it’s fully done. Who can do it: highlighted chips are who can reasonably handle it.