Global administrator
A global administrator is the most powerful account in a Microsoft 365 or Microsoft Entra ID setup: it can change every setting, reset any account and add other admins. For Cyber Essentials it is a cloud administrator account. It must be separate from everyday accounts (A7.6), tracked and reviewed (A7.8, A7.9), and use MFA (A7.16, an automatic fail if No).
- Term
- Global administrator
- Also known as
- Global Admin, Microsoft 365 global admin, Super admin, Tenant administrator
- Category
- Accounts and access
- Requirement area
- 4. User Access Control
- Questions
- A7.6A7.7A7.8A7.9A7.16AUTO-FAIL
- Reviewed against
- Requirements v3.3
What does the term global administrator mean in Cyber Essentials?
A global administrator is the most powerful account in a Microsoft 365 or Microsoft Entra ID setup: it can change every setting, reset any account and add other admins.
How does global administrator apply to Cyber Essentials?
In plain terms
A global administrator holds the master key to your company's email, files and staff list in Microsoft 365. Whoever controls it can read mailboxes, create new accounts, turn off security settings and lock everyone else out. Google Workspace has the same idea under the name super admin.
What Cyber Essentials asks
The scheme treats this as an administrator account on a cloud service, and several questions apply:
- A7.6 asks how separate accounts are used for admin work. The guidance says: "Cloud service administration must be carried out using separate accounts."
- A7.7 asks how you stop admin accounts being used for everyday tasks such as email and web browsing.
- A7.8 and A7.9 ask whether you track who has admin accounts and review that list regularly.
- A7.16 asks whether MFA is applied to all administrators of your cloud services. A No is an automatic fail.
At Cyber Essentials Plus, cloud services are tested with "at least one normal user and one administrative user for every cloud service used", and test case 4 checks that the administrator is prompted for MFA.
Common mistakes
- The owner's or office manager's everyday mailbox is also the global administrator.
- An IT supplier's admin accounts left in the tenant after the contract ends. Accounts your organisation owns are in scope even when a third party uses them.
- An emergency or spare admin account kept without MFA. It is still an administrator of the cloud service.
See why admin accounts must be separate and the Microsoft 365 and Entra ID setup guide. Related: administrator account, cloud tenant, privileged access.
Related terms
- Administrator accountAn administrator account is a login with extra powers, such as installing software, changing security settings and creating other accounts.
- Cloud tenantA cloud tenant is your organisation's own private space inside a shared cloud service, such as your Microsoft 365 or Google Workspace setup, with its own users, settings and data.
- Privileged accessPrivileged access is any level of access above that of a normal user, such as admin rights that let someone change settings, install software or see everyone's data.
- Group policyGroup policy is a Windows feature that lets an administrator set rules once, such as password length or screen lock, and push them to every computer and user on an Active Directory network.
- Identity provider (IdP)An identity provider is the service that checks who you are when you sign in and then vouches for you to other apps, for example Microsoft Entra ID, Google Workspace or Okta.
- Joiners, movers and leavers (JML)Joiners, movers and leavers is the everyday process of giving new staff the access they need, changing it when they change role, and removing it when they leave.
Frequently asked questions
A global administrator is the most powerful account in a Microsoft 365 or Microsoft Entra ID setup: it can change every setting, reset any account and add other admins.
In the 2026 Danzell question set, global administrator comes up at A7.6, A7.7, A7.8, A7.9, A7.16. Read those questions against the definition above so your answers use the term the way the assessor will.
Global administrator relates to 4. User Access Control in the NCSC's Cyber Essentials: Requirements for IT Infrastructure v3.3. Read that section for the control your answers must show.
Would you pass the 2026 question set?
Answer 24 yes or no questions, built by the assessors who mark Cyber Essentials, and get a readiness score in about five minutes, with any auto-fail questions you miss flagged first in your results.