IT Blog

It’s Friday afternoon. Your firm discovers that a mail rule is forwarding client correspondence to an outside address. Someone needs to investigate, remove the rule, and secure the tenant.

“Hey Margaret, do you have the admin login?”

Margaret is the office manager. She has been a Microsoft 365 global administrator since the migration in 2019. She’s on vacation. The only other account that might get into the tenant settings is named after an IT consultant who left two years ago. Nobody knows its password.

This isn’t just a problem with an old password. It’s a problem of ownership: your firm may have administrator accounts and permissions that no one can confidently identify, explain, or control.

This post is about administrator rights, not ordinary user access or offboarding hygiene. The question is who holds the keys to your systems, and whether those keys are standing, permanent, and far more widespread than you realize.

What “admin” means in a small firm

Admin isn’t one account. It’s a layer of authority across your business.

• A Microsoft 365 global administrator can change tenant-wide security settings and user accounts, and can obtain access to data across the environment. The role can be used to grant itself or another account further access.
• A local administrator on a laptop can install software, change device settings, weaken protections, and access data stored on that machine.
• A domain or server administrator can control systems still running on-premises, potentially affecting many users and services at once.
• Separate administrator accounts may exist in the practice management platform, billing and accounting system, document management system, patient portal, backup console, firewall, phone system, and even the copier’s scan-to-email account.

Each one is a key. Most firms can name who has keys to the office. Far fewer can name who has the keys to the tenant, server, endpoints, and business systems.

Why standing administrator access is the quiet risk

One compromised mailbox is a bad day. A compromised administrator account can become a compromised firm.

An attacker with privileged access may be able to reset passwords, add mail forwarding, create new accounts, disable or alter audit settings, turn off security controls, and reach files across the environment. The blast radius can include client matter files, financial records, or patient information, not just the inbox that was first compromised.

Attackers target administrator credentials because they offer the biggest return. And the security controls you’ve already paid for (conditional access, MFA policies, spam filtering, and endpoint protection) may be modified or bypassed by an administrator who can change the configuration.

Admin is a permission to remove your own protections.

There’s also a device problem. If an admin signs in from a personal laptop or unmanaged home computer, a stolen session token can let someone act as that admin without simply needing to steal a password. Strong access policies should protect the device and the session, not just the credentials.

The usual suspects

In a typical 20–80 person firm, an IT audit or IT assessment may uncover familiar accounts and permissions like these:

1. The managing partner made global admin during setup and never removed.
2. The departed IT generalist’s account, still enabled.
3. The shared “IT Admin” account, with a password in a spreadsheet the office manager keeps.
4. The vendor or consultant granted permanent global admin “temporarily” during a migration.
5. An emergency access account nobody documented.
6. The office manager with local admin because a scanning app updates weekly.
7. The bookkeeper’s billing-system login, which can also export all company records.
8. A stale guest account with elevated access to a shared folder of client files.
9. The copier’s service account, whose permissions and owner are unclear.

These aren’t automatically signs of malicious intent. They are usually accumulated convenience. One small exception after another, until nobody knows how many keys exist or who can use them.

“We have MFA” isn’t the whole answer

MFA matters. It can still leave gaps if administrators are treated as exceptions. Common misconfigurations, not universal failures, include admin accounts excluded from conditional access “so they don’t get locked out,” or a break-glass account excluded from everything and never reviewed.

Some firms still have admin accounts that can use legacy authentication, credentials reused from another site, or prompts that employees approve out of habit. An administrator’s mailbox can be an especially valuable phishing target: compromising it may help an attacker request or approve further access.

MFA is one layer. It doesn’t make broad, permanent, poorly monitored admin rights safe. And it doesn’t substitute for a separate, protected admin account or an appropriate device policy.

Why regulators and insurers ask who has privileged access

For firms covered by the FTC Safeguards Rule, the rule addresses access controls, limiting access to customer information based on job needs, and periodic review. See the FTC’s Safeguards Rule guidance. This is relevant to certain financial institutions and other covered businesses; coverage depends on the organization.

HIPAA’s Security Rule includes administrative safeguards for workforce security and information access management, as well as technical safeguards addressing access control and audit controls. See 45 CFR § 164.308 and 45 CFR § 164.312. For a medical practice, the practical question is whether access to electronic protected health information is appropriate, controlled, and reviewable.

For law firms, ABA Formal Opinion 477R discusses lawyers’ reasonable efforts to protect client information in electronic communications. Using standard accounts for routine work and reserving administrator privileges for tasks that need them is a prudent way to reduce unnecessary exposure.

Insurers may also ask about privileged accounts, how administrator access is protected, and whether MFA is required for it. Clear answers require a current inventory, not a best guess.

This is general information, not legal advice. Requirements vary by regulator, state, business, and engagement. Consult qualified legal and compliance professionals about your obligations, including HIPAA compliance, FTC Safeguards, or GLBA compliance.

What good looks like

You don’t need zero administrators. You need the right few: named, protected, limited to the work they must do, and reviewed.

• Separate daily-work accounts from admin accounts. Nobody should read email or browse the web as a global administrator.
• Use just-in-time elevation. Grant admin rights for a specific task and a limited time, with approval where appropriate. Microsoft’s Privileged Identity Management supports time-limited role activation.
• Require strong MFA for every admin account. Use phishing-resistant, hardware-bound methods where possible.
• Document emergency access accounts. Escrow their credentials securely, monitor their use, and test them on a schedule.
• Scope vendor access. Use time-limited, delegated permissions instead of handing out permanent global admin. Microsoft’s GDAP is designed for granular, time-bound partner access.
• Control local admin centrally. Grant it per task instead of giving it to every employee who asks.
• Use least-privilege roles. Give administrators only the permissions, scope, and duration they need. Microsoft’s Entra role best practices outline this approach.
• Log and alert on role changes. New admin grants and changes to privileged access should be visible.
• Review access quarterly. Record who reviewed it and when.

A practical checklist for whoever runs IT

Hand this list to your IT lead or provider. Ask them to return the completed inventory, not just confirm that it’s “handled.”

1. List every account with admin rights across every system, with a human name beside each.
2. Disable or delete accounts belonging to people who have left.
3. Convert shared admin logins to named accounts.
4. Remove global admin from anyone who does not need it for their work.
5. Require a separate admin account for each person who retains privileged access.
6. Require MFA on every admin account, phishing-resistant where possible.
7. Document and securely escrow the emergency access account.
8. Replace vendor global admin with scoped delegated access and an expiry date.
9. Remove local admin from standard laptops.
10. Review the complete list every quarter; record who reviewed it and when.

A sound IT asset management process helps keep the list connected to your actual systems, while endpoint security and identity controls help enforce it.

Internal IT or a managed services provider?

Internal IT has real advantages. Someone on site may know your people, workflows, and business priorities well. But when admin access concentrates in one person, you inherit key-person risk. “Just make me an admin so I can install it” can become permanent access creep. Documentation may live in that person’s head. If they leave, the firm may struggle to explain who still has the keys.

A managed services provider can bring role separation, documented and revocable delegated access, just-in-time practices, and routine review evidence. That can support more consistent business IT support and predictable costs. But you still need to review the provider relationship, retain ownership of your tenant, maintain your own emergency access, and plan the exit before signing.

Outsourcing admin does not outsource accountability. Whether you have internal IT support, an IT helpdesk, or outsourced IT, your firm should know who can access its systems and how that access is controlled.

Final Word

The measure isn’t whether your firm has administrators. It’s whether you can name them, explain why each has the rights they have, and show when you last reviewed them.

If the answer takes more than five minutes to produce, that’s the finding.

A structured IT audit can turn uncertainty into a clear plan: identify privileged accounts, reduce unnecessary standing access, and build review into your ongoing cybersecurity. Explore A PC of Mind’s IT services and cybersecurity services, or contact our team to discuss your environment.