I'm moving the Global Administrator role off my everyday user account and creating a separate account for administrative work. I'd like to secure it as tightly as possible and was considering a Conditional Access policy requiring the account to sign in only from a compliant device. My workstation is hybrid joined, but signing in through Edge prompted me to use a separate browser profile because I was already signed in with my regular account. That worked.
How are you securing dedicated Global Administrator accounts? Is phishing-resistant MFA or a passkey enough, or do you also require a compliant device, a privileged access workstation, just-in-time activation, or other controls? I already maintain two separate break-glass accounts; this question is about my normal administrative account.
4 Answers
Use Privileged Identity Management so Global Administrator is eligible rather than permanently active. Require an activation reason, MFA, and a short time limit, and make sure the activation is logged for review. This doesn’t replace device and authentication controls, but it limits exposure and improves traceability.
Use a dedicated privileged access workstation and require phishing-resistant MFA, such as FIDO2 security keys or passkeys. Requiring a compliant device can help, but it should be part of a broader admin-access policy rather than the only protection.
Treat the dedicated account as an emergency-capable admin identity, not as a normal daily account. Keep the password protected offline, use multiple hardware security keys, and maintain two independently secured break-glass accounts. The break-glass identities should be monitored and tested periodically, while routine admin work uses just-in-time elevation from a protected workstation.
I’d require both phishing-resistant MFA and a compliant device for administrative access. For higher assurance, add a policy that limits administrators to approved device types or a dedicated admin workstation. Keep the break-glass accounts separate and ensure they can bypass these controls when necessary.
A device-filter policy can be more dependable than relying exclusively on the Intune compliance state, since compliance detection occasionally has false failures or delayed updates.