Protect admin accounts: compliant device plus MFA

A compromised administrator account means the entire Microsoft 365 tenant falls. Attackers know this perfectly well and target these privileged identities first, because a single sign-in unlocks every mailbox, every SharePoint file, every managed device and every security policy. Applying the exact same rules as standard users is like protecting the vault door no better than the front door.

A Global Administrator can reset passwords, disable other people's MFA, create new accounts or exfiltrate data at scale. It is precisely that level of power which justifies far stricter requirements than for an ordinary user. In practice, most major incidents in small businesses do not start with a sophisticated exploit, but with a phished or reused admin credential.

The good news: Microsoft Entra ID gives you every lever to raise this protection dramatically without buying a third-party tool. Conditional Access, phishing-resistant MFA, a compliant-device requirement and Privileged Identity Management together form a defense-in-depth that is remarkably effective. This article explains how to combine them, in what order, and which pitfalls to avoid.

The roles to protect first

Conditional Access can target Entra ID directory roles directly rather than named accounts. That choice matters: anyone appointed to an administrator role in the future automatically inherits the protection, with no manual step and nothing forgotten. Focus first on the roles whose compromise has the broadest impact.

• Global Administrator: the most critical role, reserved for a small handful of people.
• Security Administrator, Conditional Access Administrator and User Administrator.
• Exchange Administrator, SharePoint Administrator and Billing Administrator.
• Authentication Administrator and Privileged Authentication Administrator, which can change other accounts' MFA methods.
• Target these roles via directory-role assignment in the policy, rather than by individual account.

Two non-negotiable requirements

For a privileged account, always combine strong authentication with a trusted device. It is the minimum barrier against credential theft and modern phishing. Each of these two requirements blocks an entire class of attacks; together, they make an attacker's job vastly harder.

Phishing-resistant MFA

Classic MFA via SMS code or approved notification remains vulnerable to real-time phishing and MFA fatigue (the user who eventually approves an insistent prompt). For admin accounts, aim for phishing-resistant MFA, cryptographically bound to the domain you authenticate against.

• FIDO2 security keys (for example YubiKey), the reference standard.
• Windows Hello for Business, backed by the device TPM.
• Passkeys, including through the Microsoft Authenticator app.
• Use an Authentication Strength in the policy to explicitly require these methods.

A compliant or hybrid Entra-joined device

Requiring a compliant device (managed by Intune and meeting your rules) or a hybrid Entra-joined device guarantees that administration happens only from a known, healthy machine. Even if an attacker steals a credential and bypasses MFA, they do not have the enrolled device and are denied access. Complete this with two essential settings.

• Block legacy authentication (basic POP, IMAP, SMTP), which fully bypasses MFA.
• Reduce session lifetime via sign-in frequency to force regular reauthentication of admin sessions.

Rolling out without locking yourself out

A misconfigured policy on admin accounts can shut you out of your own tenant. The method below prevents that scenario and always leaves you a way back in.

1. 1Create and document at least one dedicated break-glass emergency account, with a long password stored offline in a safe place.
2. 2Explicitly exclude this break-glass account from the policy; monitor its sign-ins with a dedicated alert.
3. 3Create the policy targeting the sensitive directory roles, requiring strong MFA and a compliant device.
4. 4Turn it on in report-only mode and let it observe real sign-ins for a few days.
5. 5Analyze the sign-in logs: spot admins without a compliant device or without a phishing-resistant method.
6. 6Fix those cases (Intune enrollment, FIDO2 key distribution), then switch the policy to enforcement.

Going further: separate and limit

Beyond Conditional Access, a few best practices further reduce the exposure of privileged accounts and limit the damage if one is compromised. They all stem from least privilege: grant only what is needed, and only when it is needed.

• Use dedicated admin accounts, separate from daily work accounts and with no exposed mailbox.
• Enable just-in-time access with Privileged Identity Management (PIM): roles are made eligible rather than permanent, activated on demand for a limited time with justification.
• Grant only the strictly necessary roles rather than Global Administrator by default.
• Review assignments regularly with access reviews to remove stale access.

The most common mistakes

• Forgetting the break-glass account and jumping straight to enforcement: risk of a full lockout.
• Targeting named accounts instead of directory roles: the next admin appointed escapes the protection.
• Leaving privileged roles active permanently when PIM enables just-in-time access.
• Settling for a push notification as admin MFA, still vulnerable to phishing and MFA fatigue.

A strong compliance requirement

Hardened protection of privileged accounts appears explicitly in ISO 27001, NIS2 and national security guidance. A poorly protected admin account is often the starting point of major incidents, and auditors check it first. Demonstrating that your sensitive accounts require phishing-resistant MFA and a compliant device is a decisive signal of maturity during an audit or a cyber-insurance renewal.

• Separate admin tasks from everyday office usage.
• Keep the number of Global Administrators to the strict minimum needed.
• Record every privileged role assignment and its justification.
• Periodically review access to genuinely apply least privilege.

FAQ

Do I really need a compliant device to sign in as admin?

It is strongly recommended for the most sensitive roles. The compliant-device requirement ensures administration happens only from a managed, healthy machine. Plan the Intune enrollment of the relevant workstations beforehand, and keep your break-glass account excluded from this constraint so you never end up locked out.

Is PIM essential if I already have Conditional Access?

The two are complementary. Conditional Access controls how you sign in (strong MFA, compliant device); PIM controls when a role is active by making it eligible rather than permanent. PIM requires an Entra ID P2 license, but sharply reduces the attack surface by removing standing, dormant privileges.

How many break-glass accounts should I keep?

Microsoft recommends at least two emergency access accounts, Global Administrators, dedicated and excluded from Conditional Access policies. Their credentials are stored offline in a safe place, and every sign-in triggers an alert, since it should only ever happen during a real incident.

AuPoint offers ready-made protection for privileged accounts: targeting the right directory roles, requiring phishing-resistant MFA and a compliant device, impact preview before enforcement and automatic break-glass exclusion. Every policy is deployed in report-only first and stays reversible in one click. You secure your Microsoft 365 admins in a few clicks, with no PowerShell and no consultant.