How to Investigate an Unfamiliar Global Administrator in Microsoft 365
Question details
The user needs to identify and handle an unknown account that possesses global administrator privileges in the Microsoft 365 admin center.
- Product
- Microsoft 365
- Device & OS
- not provided
- Scenario
- An unknown global administrator account is discovered in the Microsoft 365 environment, raising security concerns about unauthorized access.
- Observed behavior
- An unexplained account with global administrator privileges appears in the Microsoft 365 admin center, requiring immediate investigation and potential remediation.
Ensure you have active global administrator or security administrator credentials yourself to access the Microsoft Entra admin center and Microsoft 365 audit logs.
Investigate the Account and Secure Your Microsoft 365 Tenant
Follow these critical steps to determine the origin of the unknown administrator account and secure your environment if it is unauthorized.
Microsoft 365 does not automatically generate unexplained default global administrator accounts. If an unfamiliar account appears, it must be investigated immediately to rule out unauthorized access or tenant compromise.
Check with other IT staff or administrators in your organization to confirm if the account was created for a specific project, integration, or by a third-party managed service provider.
Go to the Microsoft Purview compliance portal, navigate to Audit, and search for 'Added member to role' activities to see who created the account and granted it administrator rights.
Open the Microsoft Entra admin center (formerly Azure AD), navigate to Users, select the unknown admin account, and review its Sign-in logs to identify the IP addresses and locations it has been accessed from.
If the account is suspected to be unauthorized, immediately select the user profile in the Entra admin center, click 'Revoke sessions', and reset their password to block further access.
Delete the unauthorized account from the Active users list in the Microsoft 365 admin center to permanently remove its global administrator privileges.
Manage Your Documents Securely with WPS Office
While managing administrative security in Microsoft 365, you can trust WPS Office as a secure, lightweight, and completely free alternative for your daily document processing needs. It offers robust privacy controls and seamless compatibility with all major Office formats.
- 1. Download the installer: Visit the official WPS Office website and click the Free Download button for your operating system.
- 2. Install the application: Run the downloaded installation file and follow the on-screen prompts to set up the software.
- 3. Open your files: Launch WPS Office and seamlessly open your existing Microsoft Office documents without formatting loss.
Frequently Asked Questions
Does Microsoft 365 create default global admin accounts automatically?
No, Microsoft 365 does not automatically generate unexplained default global administrator accounts. Every global admin account is either created during the initial tenant setup, added manually by another administrator, or provisioned through directory synchronization.
How can I see who assigned global admin rights to a user?
You can view role assignments by checking the Audit logs in the Microsoft Purview compliance portal. Search for the 'Added member to role' activity under the Azure AD directory role events to identify the specific user who granted the permissions.
Can third-party apps create global admin accounts?
While third-party applications or managed service providers (MSPs) might require admin access through delegated administration, they generally do not create standalone global admin user accounts within your tenant without an existing administrator's explicit authorization.
