I recently moved from an operations role into system administration at a small company. I'm implementing a policy that separates everyday Microsoft 365 accounts from privileged administrator accounts. The owner has approved the change, and I've already created a separate, unlicensed admin account for him. HR needs limited administrative permissions to reset passwords, assign licenses, and manage SharePoint, so I created a separate account for that purpose as well.
I sent HR the policy, setup instructions, and temporary login details, with instructions to change the password during the first sign-in. She said she would complete it that evening, but that was last week. I followed up and haven't received a response.
Since the separate account already exists, can I remove administrative privileges from her everyday account now, or should I get explicit confirmation from the owner or another decision-maker first? I want to reduce the security risk, but I also don't want to disrupt HR or create conflict because she works closely with the owner.
4 Answers
The general security direction is reasonable, but check whether your organization expects separate accounts, just-in-time role activation, or another privileged-access workflow. Your responsibility is to implement the approved process, not independently decide when to force a business user onto it. If leadership refuses to enforce the policy, document that decision and the remaining risk instead of taking ownership of it yourself.
Have the owner or manager send the final notice, or at least be visibly included in it. Give HR a specific transition date and offer a short call to help complete the first login. If the deadline passes, escalate with a factual status update rather than framing it as a complaint about HR.
I’ll keep the message neutral and focus on the project status, the deadline, and the fact that the organization isn’t fully covered until the transition is complete.
Keep records of every step: the approved policy, the account creation, the instructions, your reminders, and any authorization to revoke the old privileges. Also confirm the new account actually works and has only the permissions HR needs before disabling anything. Being technically right won’t help if the change unexpectedly prevents payroll, onboarding, or another business process.
Don’t remove the access unilaterally. Get explicit approval from the owner or whoever is responsible for enforcing the policy, preferably in writing. Explain the security benefit, the exact impact on HR, and what tasks may stop working until she uses the new account. That protects the company and gives you a clear record if there’s a dispute later.
That makes sense. The policy itself has already been approved, but I’ll get confirmation specifically for this account change and document the expected impact before proceeding.
The owner and HR are the only people who regularly need those administrative tasks, so I’ll verify the least-privilege roles and make sure the setup matches the company’s approved process before changing access.