Introduction
The Microsoft 365 Global Administrator role is the most powerful role in your tenant. It grants full control over users, groups, and settings. However, many small businesses assume that one global admin is enough—and that this role automatically includes every privilege. In reality, some critical capabilities, such as billing and advanced authentication management, require additional roles. This article explains what a global administrator does, why you need a second Microsoft 365 global administrator, and how to organize roles for maximum security and continuity.
Click open the headers below to learn more about how to protect your IT assets by establishing a second Microsoft 365 Global Administrator to protect your Microsoft 365 tenancy in the event of force majeure. Support options are available for professional assistance.
What Is a Microsoft 365 Global Administrator?
A global administrator in Microsoft 365 (also known as an Entra ID global admin) can manage all aspects of your tenant, including user accounts, licenses, and security settings. This role is essential for tasks such as:
- Adding or deleting users
- Resetting passwords
- Assigning licenses
- Configuring security policies
However, global admin privileges do not automatically include billing or advanced security functions. For example, managing invoices for your tenancy, buying/cancelling licenses, or overriding multifactor authentication (MFA) blocks requires additional separate roles.
Why Is a Seond Micrsoft 365 Global Administrator Is Essential
Microsoft recommends having at least two global administrators. This ensures:
- Business continuity during emergencies
- Shared responsibility for critical changes
- Reduced risk of lockouts caused by lost credentials or MFA issues
Establishing a second Microsoft 365 Global Administrator in your 365 tenancy protects against you against a situation arising that locks you out of server-level administration.
Roles That Complement a Microsoft 365 Global Administrator
To fully mirror the capabilities of your principal Microsoft 365 global administrator, assign these additional roles to the second admin:
- Billing Administrator – Manages invoices, payment methods, and subscriptions
- Privileged Authentication Administrator – Overrides MFA and security blocks
- Authentication Policy Administrator – Configures authentication methods and policies
- Service Support Administrator – Opens support tickets with Microsoft
These roles can be assigned in the Microsoft 365 Admin Center or Azure AD (Entra) under Roles and administrators.
Does Licensing Affect MFA for Microsoft 365 Global Administrators?
No. If a second Microsoft 365 global administrator account does not have a Microsoft 365 license assigned to it, it can still perform MFA authentication. MFA enforcement is identity-based, not license-based. The only limitation is that an unlicensed admin cannot use services like Outlook or Teams. For email alerts and notifications, consider assigning at least an Exchange Online license.
How to Organize Your Admin Accounts
- Create a second global admin account
- Assign MFA to both global admins
- Add complementary roles (Billing, Privileged Authentication, etc.)
- Document your admin strategy for continuity
About ComStat.uk: Internet Service Provider Comstat provides IT support, web hosting, and media services including website design, Microsoft 365 setup, and audio/video production, serving businesses across Denbighshire, North Wales and Wirral from Ruthin, and Lancashire and the Northwest from Bolton.
