Using a single account for both daily work and admin tasks means that if the account is compromised via phishing or malware, the attacker immediately has administrative access to your entire environment. Privileged access management — separate admin accounts — is a foundational control that most SMBs skip.
Most IT administrators in small businesses have a single Microsoft 365 account with global admin privileges. They use this account for everything — reading email, browsing the web, managing Microsoft 365, and accessing business systems. This is understandable: having one account is simpler. It's also a significant security risk that attackers specifically exploit.
Why Admin Access in Daily Use Is Dangerous
The account used for daily browsing and email is the account most exposed to phishing, malicious attachments, and drive-by malware — because those attacks target the account where daily activity happens. If that account has global admin privileges in Microsoft 365 and domain admin rights on the network, a successful phishing attack against the daily-use account immediately grants the attacker administrative control over the entire environment.
In the Uber breach of 2022, the compromised contractor account was used for both daily work and access to privileged systems. The attacker's access to the contractor's credentials gave immediate access to privileged systems. Proper privileged access segregation would have limited the initial compromise to the contractor's standard-access account, requiring additional steps to reach privileged systems — steps that monitoring would have had a higher chance of detecting.
The Two-Account Model
The solution is straightforward: a daily-use account with standard user permissions (used for email, Teams, web browsing) and a separate admin account with elevated privileges (used only for specific administrative tasks, never for daily work). The admin account should not be licenced for email — this prevents it from being phishable via email. It should have MFA enforced and, ideally, be restricted to sign-in from specific locations or compliant devices.
In Microsoft 365 terms: the daily account is a standard licensed user. The admin account is an unlicensed account with Global Administrator or specific admin roles assigned, used only through the Microsoft 365 admin portal, Intune, or Azure portal — never for email, Teams, or SharePoint.
Just-in-Time Privileged Access
Microsoft Entra ID Privileged Identity Management (PIM) — available in the Business Premium licence — provides just-in-time admin access. Rather than permanent admin role assignment, an admin requests elevation to a role for a specified time period (one to eight hours), provides justification, and the role is activated only for that window. Permanent admin role assignment is eliminated. Audit logs capture every privilege elevation, the justification provided, and what was done during the elevated session. For organisations with multiple admins or elevated risk tolerance requirements, PIM is the gold standard for privileged access management.
The most powerful account in your Microsoft 365 environment shouldn't be the one exposed to phishing and web browsing every day. Separating daily work from admin access is a simple, zero-cost configuration change that significantly limits the blast radius of an account compromise.
