The account you read email with should not be the one that can change everything

Ask a small business who has administrator rights and the honest answer is usually a shrug. Somebody set the machines up in 2021, everyone got made an admin so they could install the label printer driver, and it never came back off.

That is not carelessness. It is the default. The first account created on a new Windows PC is an administrator, and Microsoft's own documentation says that when someone signs up for a Microsoft cloud service, a tenant is created and that person is assigned the Global Administrator role. Nobody sat down and decided any of it. It just happened, and then eleven other people joined.

Whatever the account can do, so can whatever gets onto it

This is the entire argument, and it is worth stating before any of the detail.

Software runs with the rights of whoever is signed in. A macro in a spreadsheet, a browser extension, a fake invoice that turns out to be a script: none of it gets special powers of its own. It gets yours. Open it as a standard user and it can rummage through that user's own files. Open it as an administrator and it can install a service, turn off protection, reach the other machines, and stay.

NCSC's guidance on lateral movement says it flatly. Local and domain administrative accounts, with access to most systems and data, are powerful tools in a network. That sentence is written from the attacker's point of view on purpose. They are your tools right up until somebody else is holding them.

The same guidance names the reason admin accounts should not be reading email. A successful spear-phishing or watering-hole attack against an administrator gives the attacker access in the same context that the administrator does their privileged work. Which is why the fix is not better spam filtering. It is that the mailbox and the powers are not attached to the same account.

Two accounts, one person

NCSC's ten steps put it in one sentence: admins should have separate user accounts for day-to-day business, such as email and internet browsing, and another for activities requiring their administrative privileges.

People hear that and picture buying a second laptop. In a twenty-person business you do not need to. You need two sets of credentials for the same human being. You log in as yourself, you work as yourself, and when something asks for an administrator you type the other password. The admin account has no mailbox, is not signed into a browser, and is not the account sitting open while somebody clicks a link in a delivery notification.

NCSC does go further for organisations that can. Separate the accounts properly, it says, using separate devices or a browse-down approach, and consider blocking unnecessary web and email access on those devices. That is a sensible target for a business with a server room and a domain. For a fifteen-person office running Microsoft 365, the second account is the ninety percent of the benefit that costs nothing.

There is a second rule alongside it that gets skipped more often: use full-privilege accounts only when absolutely necessary. Domain admin, Global Admin, cloud admin. NCSC's tiered model exists so that the person resetting a password is not signing in with an account that could also delete the tenant.

Somebody has to hold that second password, and a sticky note under the keyboard is not the answer. A shared vault is, which is what our guide to password managers for small teams is about.

Count the Global Administrators in your Microsoft 365

Do it now, before reading the rest of this. Microsoft 365 admin centre, Roles, Global Administrator. Most people are surprised.

Microsoft's recommendation is specific: assign the Global Administrator role to fewer than five people. Not a vague principle. A number, with a warning card that appears on the Entra overview page once you have five or more privileged Global Administrator assignments. There is a second number too, which is that total privileged role assignments should stay under ten.

The reason it drifts is boring. Someone needed to configure a mail rule in 2023, Global Admin was the role that definitely worked, and it was never taken back. Microsoft's phrase for the underlying problem is that people move teams and, without auditing, amass unnecessary access over time. Access reviews are the answer at scale. In a small business, a calendar reminder and ten minutes twice a year gets you most of the way.

Three other things from the same guidance are worth doing on a small tenant, because they cost nothing:

• Give people the least-privileged role that does the job. There are over 65 built-in roles in Entra. Exchange Administrator, Helpdesk Administrator and User Administrator cover an enormous amount of what Global Admin gets used for.
• Use cloud-native accounts for admin roles rather than accounts synced from an on-premises directory. If the on-premises account is compromised, a synced admin role takes your cloud with it.
• Turn on MFA for every one of them. This is the same control covered in our article on multi-factor authentication, and admin accounts are where it matters most.

One honest note on the tooling. Microsoft's answer to standing privilege is Privileged Identity Management, where somebody is eligible for a role and activates it for a limited time. It is genuinely good and it is a Microsoft Entra ID P2 feature. Microsoft 365 Business Premium carries P1, so if that is your licence, PIM is not sitting there waiting to be switched on. Do the version you can afford: fewer admins, smaller roles, and a review date.

Two accounts you hope never to use

Lock every administrator out of a tenant and you have a problem that no amount of good intentions solves. It happens more than you would think. The one person with Global Admin leaves. An MFA provider has an outage. A Conditional Access policy gets tightened on a Friday afternoon.

Microsoft's guidance is to create two or more emergency access accounts, sometimes called break-glass accounts. The specification is worth following exactly, because the whole point is that they work when nothing else does. Cloud-only, on the onmicrosoft.com domain, not federated and not synced from anywhere. A phishing-resistant sign-in method, and deliberately not the same method your normal admin accounts use, so that one broken thing does not take out both. Excluded from any Conditional Access policy that blocks or restricts sign-in. Not tied to any individual, and not registered to anybody's personal phone.

Then the two parts everybody skips. Store the credentials somewhere physically secure, which Microsoft's own wording puts as secure, fireproof safes in secure, separate locations. And test them: validate that the accounts can actually sign in and do administrative work at least every 90 days. An emergency account nobody has tried since 2024 is a comfort blanket, not a control.

The local admin password that is the same on all twelve machines

Different problem, same family, and much less visible than the Microsoft 365 side.

Every Windows machine has a built-in local administrator account. When an office gets set up in one afternoon, that account usually ends up with the same password on every device, because it is quicker and because nobody expects it to matter. It matters. Take one laptop and you have taken all of them, and you never touched the domain to do it. NCSC describes the mechanic in its lateral movement guidance, where a stolen hash is used to authenticate the attacker rather than a password ever being typed.

Microsoft solved this properly and gave it away. Windows LAPS automatically manages and backs up the password of a local administrator account on Entra-joined or Active Directory-joined devices, setting a different one per machine and rotating it. The first benefit Microsoft lists for it is protection against pass-the-hash and lateral traversal attacks. It shipped in the Windows updates of 11 April 2023 for Windows 10, Windows 11 and Server 2019 and 2022, and is native from Windows 11 23H2 and Server 2025 onwards.

The cost is nothing. Microsoft's wording is that the feature is available for free in all supported Windows platforms, that backing passwords up to Active Directory carries no other licensing requirement, and that backing them up to Entra ID needs Entra ID Free or higher. Two things to know before you start: a device can back up to Entra ID or to Active Directory, never both, and the old standalone Microsoft LAPS download is deprecated from Windows 11 23H2, so do not go looking for the MSI.

What Cyber Essentials asks for

User access control is one of the five technical controls, and the admin-account parts of it are not subtle.

IASME's own wording is that no one, not even home users, should use administrator accounts for everyday computer use such as web surfing, emailing or office work. Shared accounts are out, and the reason given is accountability rather than security theory: if one of the users did something that was not allowed, it would not be possible to determine who it was. MFA goes on all administrator accounts and all accounts reachable from the internet. Unused accounts get deleted, guest accounts get disabled, default passwords get changed.

The requirements moved on this year. Version 3.3 applies to assessment accounts created after 27 April 2026, and user access control was repositioned and expanded, with more emphasis on multi-factor authentication and passwordless sign-in and passkeys named as the default authentication recommendation. MFA on cloud services, where the option exists, is an automatic fail if it is missing.

Said plainly, because this section quotes the scheme throughout: Alpha IT does not hold Cyber Essentials or Cyber Essentials Plus, and we are not an assessor. We use the requirements because they are published, specific and free for anybody to read, which makes them a better yardstick than our opinion. If certification is the actual goal, our plain-English guide to the five controls covers the rest of it.

The objection, and what it is really about

Somebody in the room will say people need to install things. They are not wrong.

The designer needs a font. The bookkeeper needs the bank's card reader driver. The engineer needs a tool that has been in use since before you arrived. None of that is an argument for permanent administrator rights on twenty machines, but it is a real argument for having an answer ready, because the alternative is that people find their own way round it and you end up back where you started with worse records.

What works in a business this size is agreeing in advance what gets installed on request without a debate, and making sure somebody can be reached the same day. The friction people resent is waiting, not asking.

And the limitation, because it should not be oversold. A standard user can still run something malicious inside their own profile, encrypt their own documents, and hand over their own credentials to a convincing login page. Taking admin rights away narrows what an attack reaches and how far it spreads. It does not stop the attack starting. That is what endpoint detection is for, and it is why the first hour of a ransomware incident still needs a plan.

An afternoon's work, in order

None of this needs a project. It needs somebody to sit down and do it.

Start with the count: Global Administrators in Microsoft 365, then who is in the local Administrators group on each Windows machine. Write both lists down, because the point is to compare them with reality rather than to feel reassured.

Then give everybody who genuinely administers something a second account, and take the rights off their everyday one. NCSC's own advice is to have more than one admin account, each managed by a separate person, so this is not about appointing a single keyholder. Put MFA on all of them. Move the people who only needed one specific thing onto a smaller role.

Turn on Windows LAPS if your machines are Entra-joined or domain-joined. Create the two break-glass accounts, put their credentials in a safe, and diary the 90-day check.

Last, decide who reviews this and when. NCSC asks for accounts and systems to be checked for unnecessary privileges on a regular basis, with privileged access revoked when it is no longer required, and to revoke access ideally before somebody changes role rather than after. That last point is the same discipline as switching off access when staff leave, applied to the people who are staying.

Where we come into it

Account tidy-ups are not a line on our rate card, and we are not going to pretend otherwise. Our managed plans start at £50 per user per month excluding VAT and cover the day-to-day: monitoring, automated patch management, endpoint protection, an asset register and a monthly health report. Getting the admin accounts into a sensible shape is part of what happens when we take an estate on, not an add-on we sell.

If you would rather just find out where you stand first, the free IT health check covers who holds what, which machines share a local administrator password, and the accounts nobody remembers creating.

Or do the ten-second version yourself. Open the Microsoft 365 admin centre and count your Global Administrators. If that number is larger than the number of people who actually administer anything, you have found this week's job.