I'm considering hiring TeamVenti to copy data from one cloud environment to another. They've requested Global Administrator permissions in both the source and destination environments. Is that a normal requirement for cloud-to-cloud migrations, or should the migration be possible with more limited, workload-specific roles? I'm also wondering whether vendors have caused security or configuration problems after being given this level of access, and what safeguards I should require if Global Administrator access is genuinely necessary.
3 Answers
If you decide to proceed, don’t hand over a normal administrator account with unlimited, permanent access. Use a dedicated identity or vendor-controlled application, restrict sign-in locations with Conditional Access where practical, enable detailed auditing, set an expiration date, and agree in writing on when access will be revoked. Confirm whether the vendor uses subcontractors, how credentials are protected, and what happens if the migration fails. Global Administrator may be the quickest operational choice, but it should be treated as a significant supply-chain risk rather than a routine permission.
Global Administrator access is very common because it avoids permission problems across services such as Exchange, SharePoint, Teams, and Entra ID. That doesn’t necessarily mean it’s technically required, though. The vendor should be able to document the exact roles and application permissions their tool needs. If you use Global Administrator, treat it as temporary access and remove or downgrade it as soon as setup and migration work are complete.
You’re not being paranoid. Global Administrator is much broader than most migration tasks require, and a reputable provider should have a least-privilege option or at least a clear explanation for why it cannot be used. Ask whether they need it only to register an application and grant consent, or whether they expect ongoing access throughout the project. Also ask for a written list of required roles, permissions, and activities on both environments.
Some migration products genuinely request Global Administrator during initial configuration because Microsoft permissions can be inconsistent across workloads. Even then, the access should be time-limited and removed after the required applications and permissions are configured.
The tradeoff is that restricting permissions can create repeated access errors and extra troubleshooting. You may end up spending more time fixing permissions, but that doesn’t mean the vendor shouldn’t explain what access is needed.