Secure admin accounts in a small business

An admin account can do anything: create users, read mailboxes, turn off backups or delete data. That is why attackers go after it first. Securing admin accounts is one of the most cost-effective measures a small business can take.

Yet in many small companies, the owner, the in-house IT person and the service provider all share a single "admin" account, which is also used to read e-mail. Here is how to put things in order, without expensive tools.

Why a separate admin account?

The everyday account receives e-mail, opens attachments and browses the web: it is exposed to phishing. If it also holds admin rights, one unlucky click gives the attacker the keys to the whole company.

The rule is therefore simple: everyone who administers systems has two accounts. A standard account for daily work, and a named account dedicated to administration, with no mailbox and no everyday use. Shared "admin" accounts go away wherever possible: every action must be traceable to a person, and an account that cannot be named is kept in a vault with logged access.

The principle of least privilege

Not everyone needs full control. Microsoft 365 has limited roles for managing users, e-mail or devices. The Global Administrator role should stay reserved for a very small number of accounts.

With Entra ID P2, Privileged Identity Management (PIM) goes further: rights are granted only for the duration of a task, on request and with a justification. The same principles apply to local admin accounts on computers, the firewall and servers.

Steps to secure admin accounts

Which MFA for administrators?

An SMS code or a simple push notification is not enough for an account that can do anything. Admin accounts deserve a phishing-resistant method: a FIDO2 security key or a passkey, which only works on Microsoft's real site and cannot be relayed through a fake sign-in page. Ideally, administration is also done from a managed, up-to-date device.

Emergency access (break glass) accounts

If multi-factor authentication or a Conditional Access policy goes wrong, nobody can sign in anymore. Microsoft recommends setting up emergency access accounts, known as "break glass" accounts, reserved for that situation.

• At least two accounts, not tied to a person, with the Global Administrator role.
• Protected by a strong method, for example a FIDO2 key kept in a safe place.
• Carefully excluded from the policies that could lock them out.
• Never used day to day: any sign-in triggers an alert.
• Tested regularly, with a written procedure.

Reviews and logging

Once a quarter or every six months, check the list of privileged accounts: departures, role changes, access left over from a former provider. Keep sign-in and admin logs long enough to trace an incident, and have suspicious sign-ins monitored. Identity threat detection and response (ITDR), for example, flags an unusual sign-in or an unexpected privilege escalation.