# Managing top-level admin accounts in Google Workspace and Microsoft 365

Keep few top-level admins, give everyone else a narrower role, require two-step verification for admins, and keep emergency accounts apart from daily ones.

Updated: October 16, 2026

In Google Workspace and Microsoft 365, admin rights attach to each person's own account, so admin work doesn't require a shared login. What Google and Microsoft recommend comes down to four habits. Keep the top-level admins few, give everyone else a narrower role, require two-step verification for admins, and keep emergency accounts apart from daily ones.

## Keep the top-level admins few

In Google Workspace, the top role is Super Admin. It can manage every part of the organization's account, and some tasks, such as creating and assigning admin roles, only a super admin can do. Google recommends more than one super admin account, each managed by a different person. If one account is lost or taken over, another super admin can keep things running while it's recovered.

Google also asks each super admin to keep two accounts: one for super admin tasks and a regular one for everyday work. You sign in to the super admin account only for those tasks, then sign out. And each admin gets their own admin account. Google's reason is the audit log: when several people use one admin account, "you can't tell which administrator is responsible for specific activities."

In Microsoft 365, the top role is Global Administrator, which can reach nearly every setting and most of the organization's data. Microsoft asks you to keep the number as low as possible. Its Entra ID best practices put it at fewer than five, and the Entra overview page shows an alert card once you reach five. A Global Administrator who gets locked out needs someone else to reset the password. So Microsoft suggests having at least one Privileged Authentication Administrator, a role that can do that reset.

## Give narrower roles for everyday admin work

Both services come with ready-made admin roles, so each person gets only the rights their work needs. Role names are as the vendors write them. A dash means Google's prebuilt list has no matching role.

| Task | Google Workspace role | Microsoft 365 role |
| --- | --- | --- |
| Create and manage users | User Management Admin (non-admin users only) | User Administrator |
| Reset passwords only | Help Desk Admin (non-admin users only) | Password Administrator, or Helpdesk Administrator (non-admin users only) |
| Manage groups | Groups Admin | Groups Administrator |
| Change service settings | Services Admin | Exchange Administrator, SharePoint Administrator, Teams Administrator |
| Billing and subscriptions | — | Billing Administrator |
| View settings without changing them | — | Global Reader |

Microsoft uses the password case as its own example. If someone only needs to reset passwords, don't make them a Global Administrator. Give them Password Administrator or Helpdesk Administrator instead.

Entra ID also has Privileged Identity Management (PIM). With PIM, a person is eligible for a role and turns it on for a limited time when they need it, with approval if you require it. The role drops off when the time runs out. Access reviews let you check on a schedule that each admin still needs their role. PIM needs Microsoft Entra ID P2 or Microsoft Entra ID Governance licenses. Access reviews need ID Governance, though some review features work with P2.

## Require two-step verification for every admin

Google asks you to require two-step verification (a second check after the password) for admin accounts, and says it matters most for super admins. You can make it optional or required for your users, and Google is also enforcing it for admin accounts on its side. Methods include security keys, a sign-in prompt on the phone, authenticator-app codes, backup codes, and codes by text or phone call. Google calls security keys, small hardware devices that confirm the sign-in, the most secure method. The basics are in [What is two-step verification?](/guides/shared-accounts/what-is-two-step-verification)

Microsoft asks you to require multifactor authentication (MFA) for all users, especially admins. Microsoft also now requires MFA for its own admin portals. Enforcement started in October 2024 for the Azure portal, the Microsoft Entra admin center and the Intune admin center. The Microsoft 365 admin center followed in February 2025. There's no way to opt out, and emergency accounts need MFA too. For those, Microsoft recommends a passkey or certificate-based sign-in.

## Keep emergency accounts apart from daily ones

Plan for the day every admin is locked out. Microsoft asks for two or more emergency access accounts. They should be cloud-only accounts on the onmicrosoft.com domain, not tied to any one person or to an employee's phone. Leave them out of any sign-in rule that blocks or limits access (Conditional Access), so a rule can't lock them out in the very emergency they're for. Test that they still work at least every 90 days, and set an alert for every sign-in. [What is a break-glass account?](/guides/privileged-access/what-is-break-glass-account) covers the idea in general.

The Google pages cited here don't describe a separate emergency account. Google relies instead on several super admins run by different people. Each admin also enrolls a spare security key, and backup codes are printed ahead of time and kept somewhere safe.

## Check the admin logs

Google's admin log events show which admin did each task in the Admin console, when, and from which IP address. Google also suggests email alerts for events such as suspicious sign-in attempts or changes made by another admin. In Microsoft 365, Global Administrators can view directory activity logs, and Entra ID keeps sign-in logs. Because each admin uses their own account, both services log a person's name.

## What still ends up shared

With admin rights on personal accounts, the main login that several people may hold in these two services is the emergency account. Microsoft says to keep its sign-in details in a secure place that several admins can reach. After any use, review whether it was authorized and whether the actions fit the emergency. Microsoft also allows a separate emergency account for each admin, which it says promotes accountability. Shared admin logins in other consoles, such as one an outside engineer without a company account has to use, are covered in [Managing privileged accounts](/guides/privileged-access).


## Frequently asked questions

**How many super admins or Global Administrators should we have?**

Google recommends at least two super admins, each run by a different person. Microsoft recommends fewer than five Global Administrators. Both want more than one, so a lockout isn't fatal, and not many, because the role is so broad.

**Should admins use a separate account for everyday work?**

Google says yes. Use the super admin account only for super admin tasks and sign out afterward. Email and everyday work go on a regular user account.

**Can we require two-step verification just for admins?**

In Google Workspace you can make it optional or required for users, and Google recommends requiring it for admins. Microsoft requires MFA for everyone who signs in to its admin centers, with no opt-out, and recommends it for all users.

**How many emergency accounts do we need?**

Microsoft recommends two or more. Google instead recommends several super admins run by different people, a spare security key for each admin, and backup codes printed ahead of time.

## Sources

- [Google Workspace Admin Help: Prebuilt administrator roles](https://knowledge.workspace.google.com/admin/users/prebuilt-administrator-roles)
- [Google Workspace Admin Help: Security best practices for administrator accounts](https://knowledge.workspace.google.com/admin/users/security-best-practices-for-administrator-accounts)
- [Google Workspace Admin Help: Protect your business with 2-Step Verification](https://knowledge.workspace.google.com/admin/security/protect-your-business-with-2-step-verification)
- [Microsoft Learn: About administrator roles in the Microsoft 365 admin center](https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles)
- [Microsoft Learn: Best practices for Microsoft Entra roles](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/best-practices)
- [Microsoft Learn: Plan for mandatory Microsoft Entra multifactor authentication (MFA)](https://learn.microsoft.com/en-us/entra/identity/authentication/concept-mandatory-multifactor-authentication)
- [Microsoft Learn: Manage emergency access admin accounts - Microsoft Entra ID](https://learn.microsoft.com/en-us/entra/identity/role-based-access-control/security-emergency-access)
- [Microsoft Learn: Microsoft Entra ID Governance licensing fundamentals](https://learn.microsoft.com/en-us/entra/id-governance/licensing-fundamentals)

## How Junify handles this

**Doing this by hand** You decide who gets admin rights through requests and approvals, log every use of the admin logins that stay shared, and have someone other than the admins review that log on a schedule.

**With Junify** Inside Google Workspace and Microsoft 365, personal admin accounts and your identity provider cover admin work. Junify covers the admin logins in other consoles that stay shared anyway, such as one an outside engineer without a company account has to use, or one a team takes turns on. Each person verifies on their own phone, Junify fills in the login without showing the password, and each sign-in is recorded by person.

Junify is an access management service for handing work in your web accounts to employees, contractors and outside teams without giving them the password. Each person verifies on their own phone and clicks a card to sign in. The password is never shown, and Junify records who used which account and when.

- [Try the demo](https://www.junify.com/bpo/try?lang=en&scenario=privileged-access&from=guide&cluster=privileged-access&slug=google-workspace-microsoft-365-admins)
- [Book a 30-minute demo](https://www.junify.com/bpo/demo)

## More on this topic

- [Managing the AWS root user and admin access for a team](/guides/privileged-access/aws-root-and-admin-accounts): AWS says to keep the root user for the few tasks only it can do. Give admins personal sign-ins through IAM Identity Center, and protect and log the root user.
- [Ways to manage shared SaaS admin accounts, compared](/guides/privileged-access/comparison-of-privileged-account-methods): A sign-out log, your identity provider's fill-in, a privileged access management (PAM) product, and an access tool such as Junify, compared on seven points.
- [Shared admin logins that remain when you use Okta or Microsoft Entra ID](/guides/privileged-access/idp-and-remaining-shared-admins): Okta and Entra ID can fill in a shared admin login without showing the password. Gaps remain for people outside them, activity after sign-in, and console codes.