Why Your Brisbane Business Needs a Dedicated Microsoft 365 Admin Account

Summary

This guide helps you troubleshoot and resolve: Why Your Brisbane Business Needs a Dedicated Microsoft 365 Admin Account. Follow the steps below to fix the issue.

Common Causes

Managing your Microsoft 365 environment using a single daily user account creates unnecessary security risks for your Brisbane business. If your primary account is compromised, an attacker gains immediate access to every administrative setting across your tenant. By creating a dedicated Microsoft 365 admin account, you separate privileged management tasks from everyday email and document work, reducing the attack surface and making it easier to audit changes to your organisation's cloud environment.

Why Separate Admin and User Accounts?

Using one account for both daily work and administration means that a successful phishing attack or malware infection on your regular account could expose your entire Microsoft 365 tenant. A dedicated admin account should only be used when you need to manage licences, reset passwords, configure security policies, or add new users. Your daily account should remain a standard user with no elevated privileges.

Key Benefits

• Reduces the impact of compromised credentials
• Makes it easier to track and audit administrative changes
• Prevents accidental changes to tenant-wide settings during daily work
• Aligns with Australian Cyber Security Centre (ACSC) Essential Eight recommendations

Quick Fix Steps

1. Sign in to the Microsoft 365 admin centre with your current admin account.
2. Create a new user account specifically for administration.
3. Assign the Global Administrator role to the new account.
4. Enable multi-factor authentication (MFA) on the admin account.
5. Remove admin roles from your daily user account.
6. Sign out and sign back in with your daily account for regular work.

Detailed Instructions

Step 1: Create a Dedicated Admin Account

1. Go to https://admin.microsoft.com and sign in with an account that already has administrative privileges.
2. In the left navigation menu, select Users, then choose Active users.
3. Click Add a user.
4. Enter the user details. Use a clear naming convention such as [email protected] or [email protected].
5. Set a strong, unique password and clear the Require user to change password on first sign-in checkbox if you prefer to manage the credential yourself.
6. Complete the wizard to create the account.

Step 2: Assign the Global Administrator Role

1. From the Active users page, click on the new admin account you just created.
2. Select the Roles tab.
3. Click Manage roles.
4. Select Global Administrator.
5. Click Save changes.

Warning: Do not use your dedicated admin account for daily email, Teams chats, or SharePoint browsing. Keep it reserved strictly for administrative tasks.

Step 3: Enable Multi-Factor Authentication

1. In the Microsoft 365 admin centre, go to Users > Active users.
2. Click Multi-factor authentication in the top ribbon (you may need to select Show all first).
3. Find your dedicated admin account in the list.
4. Click the account name, then select Enable.
5. Follow the prompts to set up the Microsoft Authenticator app or another MFA method.

Step 4: Remove Admin Privileges from Your Daily Account

1. Go to Users > Active users.
2. Click on your regular daily user account.
3. Select the Roles tab.
4. Click Manage roles.
5. Deselect any administrator roles, such as Global Administrator, Exchange Administrator, or SharePoint Administrator.
6. Click Save changes.

Step 5: Sign In with the Correct Account

1. Sign out of all Microsoft 365 portals and Office applications.
2. For daily work (email, Teams, OneDrive), sign in with your standard user account.
3. When you need to perform admin tasks, sign in to https://admin.microsoft.com with your dedicated admin account.

Troubleshooting

I Accidentally Removed All Admin Accounts

If you remove administrative privileges from every account, you may be locked out of tenant management. You can recover access by using the original account used to sign up for Microsoft 365, or by contacting Microsoft support to verify your organisation's identity and restore admin access.

Admin Account Not Receiving MFA Prompts

Ensure the admin account has a valid licence assigned and that security defaults or conditional access policies are not excluding it. Check under Users > Active users > Multi-factor authentication to confirm the status is Enabled or Enforced.

Cannot Access Admin Centre with Dedicated Account

Verify that the Global Administrator role was successfully assigned and saved. Sign out completely, clear your browser cache, and sign back in at https://admin.microsoft.com. If the issue persists, check that the account is not blocked for sign-in under Active users.

Tip: Document the credentials for your dedicated admin account in a secure business password manager. Ensure at least two trusted people in your organisation know how to access it in an emergency.

Warning: Never share admin account credentials via email, Teams, or chat. Use a secure password manager to share access with other authorised administrators.

If you host with us, you don't need to do this yourself — just Open a Ticket and our Brisbane team will get it sorted.

Still Having Issues?