Who has the keys? A 15-minute admin check.

The short answer

Anyone with an admin role in Microsoft 365 can read every mailbox, reset every password and switch off your security settings. So can any IT provider or app you've given admin rights to. Most businesses have more admin access than they think, and some of it belongs to people who left years ago.

You can see all of it in about fifteen minutes, from three places. You'll need to sign in with an admin account to look.

1. People with admin roles

In the Microsoft 365 admin center, go to Roles, then Role assignments. Open Global Administrator first. That's the role that can do everything.

What good looks like:

• A short list. Microsoft recommends fewer than five Global Administrators. For most businesses, two is plenty: one for day-to-day admin and a spare in case that one is locked out.
• Names you recognise. Every account should belong to someone who still works with you and still needs it.
• Separate admin accounts. Ideally admin roles sit on accounts like admin.jane@, not on the mailbox Jane uses every day. If that everyday account gets phished, the attacker doesn't get admin rights with it. Cyber Essentials expects admin accounts to be kept apart from email and web browsing for exactly this reason.
• MFA on every one. No exceptions. If you're not sure, here's how to turn on MFA.

Then look through the other admin roles (Exchange, SharePoint, User and so on). They're narrower, but still powerful.

2. Your IT provider's access

Still in the admin center, go to Settings, then Partner relationships. This shows every Microsoft partner with delegated access to your business, which admin roles they hold and when each relationship ends. (Thanks to a reader on LinkedIn for this tip.)

• Check the roles. Most day-to-day support works with narrower roles. If a provider holds Global Administrator, it's fair to ask what it's for and how long they need it.
• Check the end dates. Partner access should have an end date and be reviewed before it renews.
• Look for old relationships. Previous IT providers, or older-style delegated access, can still be listed long after you stopped working with them. If you don't use them any more, remove them.

One gap to know about: this page only shows access through Microsoft's partner programme. If your provider uses an ordinary admin account inside your Microsoft 365, it shows up in step 1 instead. And remote support tools on your laptops don't appear in Microsoft 365 at all, so ask your provider for that list too.

3. Apps with access to your data

Apps can be given permission to read mail, files and calendars across the whole business, often with one click on a "Do you accept?" screen. Attackers know this, and some phishing tricks people into approving a fake app.

In the Microsoft Entra admin center, go to Enterprise apps (under Applications) and look through the list. For anything you don't recognise, open it and check Permissions. Remove apps nobody uses, and question any that can read everyone's mail or files.

While you're in there, it's worth checking that ordinary users can't approve new apps for themselves. That setting is covered in my Microsoft 365 security guide.

What to do with what you find

1. Remove what nobody can explain. If it's an account and you're unsure, block sign-in first rather than deleting it, so you can undo it.
2. Shrink the Global Administrator list to the few people who really need it.
3. Write the list down. Who has admin access, why, and when you last checked. Then put a reminder in for three months' time.

If something looks wrong rather than just untidy, like an admin account created recently that nobody set up, or a partner relationship you never agreed to, treat it as a possible cyber incident and don't just delete it. The evidence matters.

FAQ

Should my IT provider have Global Administrator?

Sometimes, for specific jobs, but rarely all the time. Ask what they need it for. A good provider will be happy to explain, and to use narrower roles where they can.

Does this help with Cyber Essentials?

Yes. User access control is one of the five Cyber Essentials controls, and the assessment asks how you manage admin accounts. Doing this check is a big part of the answer.

How often should we check?

Every three months, and whenever someone with admin access leaves or you change IT provider.