Why we flag admin accounts used for daily email

This is usually the finding that makes a first-time reader stop, because it names two or three people they see every day and describes, accurately, how one of them could end the business by opening an invoice.

It is also the finding we would fix first if we could only fix one thing, which is why it is written more bluntly than the rest. Here is how it reads for a small firm.

The finding as the product records it

Underneath the paragraph, the check itself carries four fields that never change between customers. They are what the narration is built from, and they are what appears in your evidence bundle.

What the check actually looked at

The logic is short, which is part of why we trust it. The check reads your Global Administrators, then for each one asks whether that same account has a mailbox. Anybody who holds the role and reads mail with it is named as a subject. If nobody does, the check produces nothing at all — there is no finding, no nagging, and no score to improve.

It needs two things to run: your administrator role assignments and your user list. If either is unreadable, the check is reported as skipped with the reason, not as passed. A separate info-level check, ZQ-M365-PRIV-013, fires when no Global Administrator could be identified at all, and says plainly that this is almost certainly a permission limit on our side rather than a tenant with no administrators — because quietly reporting a clean result there would be the worst thing we could do.

The subjects are real objects from your own tenant, so you can go and verify every name. That is a rule across the whole pack: a finding with a blast radius above zero and no named subjects is rejected as a bug before you ever see it.

Which roles count, and why we match on GUIDs

Global Administrator is the obvious one, but it is not the only role whose holder can reach full tenant control. We treat a set of roles as tier zero — meaning the holder can escalate to owning the tenant, directly or in one step.

• Global Administrator
• Privileged Role Administrator
• Privileged Authentication Administrator
• Application Administrator
• Cloud Application Administrator
• Hybrid Identity Administrator
• Domain Name Administrator

Application Administrator surprises people. It does not look like tenant ownership until you notice that the holder can add credentials to an application that already holds high permissions, and then use that application. Privileged Authentication Administrator is the same shape: it can reset the credentials of a Global Administrator, which is functionally the same as being one.

Why this is worse than the sum of its parts

Holding a powerful role is one risk. Reading email all day is another. The reason this finding is rated critical is that combining them multiplies rather than adds.

A mailbox is the one part of your business that accepts unsolicited instructions from strangers, thousands of times a week, by design. Every phishing message that reaches your organisation reaches that account. So the account with the highest consequence of compromise is also the account with the highest exposure to attempts — and the attacker does not need to find a vulnerability, only to write a convincing invoice.

What follows a successful click is not theft, it is erasure. An attacker on a tier-zero account can disable every other account, so nobody can get back in to stop them. They can turn off the audit log, so the record of what happened stops. They can delete mailboxes and add their own administrator. This is the specific reason the phrase in the check is "destroyed rather than merely robbed": a business that has been robbed can reconstruct what it lost, and a business whose identity provider has been taken over frequently cannot.

Why this one asks you rather than offering one tap

The change this finding generates is separate_admin_accounts, and it sits in the decide pile. It is not there because it is dangerous or irreversible. It is there because it is a business judgement, and the classifier routes business judgements to you by construction.

The pile reason you will see alongside it is "this is a business trade-off the platform does not have the facts to decide". That is honest rather than cautious. We can see that Anna holds Global Administrator and has a mailbox. We cannot see that Anna is the only person who processes payroll on the last Thursday of the month, or that the admin@ address is on your accountant's contact list, or that Marek is on leave for a fortnight. Splitting an account at the wrong moment is a real cost to a real person, and you hold the facts that determine when the right moment is.

Reversibility is recorded even so. The undo path shown next to this change reads: "The original account keeps its role until you confirm the switch, so nothing is lost if you change your mind." More on how reversal is recorded and enforced is in Undoing a change Qorionix made, and the full sorting rules are in Done, approve, decide.

The fix, in the order that hurts least

About ten minutes per person, and it can be done one person at a time on separate days. There is no need to do everybody at once, and doing so is usually a worse idea than staging it.

1. 1

   Create an admin-only account for each named person

   A second account, no mailbox, no licence for email, named so it is obvious what it is. We can prepare these for you once you confirm the list. This account exists to be used a few times a month, not daily.

2. 2

   Put a phishing-resistant factor on the new account before it holds any role

   A passkey or a hardware security key, registered while the account still has no privilege attached. Doing it in this order means there is no window in which a powerful account is protected only by a password.

3. 3

   Move the tier-zero role to the new account

   The role moves; the person's existing account keeps working exactly as it did for email, Teams and files. Nothing about their daily work changes.

4. 4

   Verify the new account can actually administer, then remove the role from the everyday account

   Sign in with it once and check it can do the thing it needs to do. Only then take the role off the mailbox-bearing account. If you remove it first and the new account is misconfigured, you have made yourself a problem.

5. 5

   Confirm the emergency account still works

   You should have one unused administrator account with a long printed password in a physical safe, excluded from your sign-in policies, alerted on whenever it is used. If your report shows ZQ-M365-PRIV-004, you do not have one yet, and that gap becomes more consequential the moment you start putting passkeys on admin accounts.

Phishing-resistant

A passkey or a hardware token. Concretely: passkeyDeviceBoundAuthenticator, fido2SecurityKey, windowsHelloForBusiness, or passkeyInMicrosoftAuthenticator. These will not work on the wrong website, by design.

Not phishing-resistant

Text message codes, voice calls, and authenticator push approvals. They are far better than a password alone, and they do not qualify here, because an attacker-in-the-middle page can relay a code or a push in seconds while the victim notices nothing.

The three things owners say when they read this

"We already have multi-factor authentication on those accounts."

Good, and it is why ZQ-M365-PRIV-003 is not also firing at you. It does not resolve this finding. A code from a text message or an authenticator app can be captured in real time on a convincing fake sign-in page — the kits that do this are commodity software. That is what ZQ-M365-PRIV-008 looks for separately: administrators who have a second factor, but not one that resists this attack.

"We are fourteen people. This is enterprise advice."

The opposite is closer to true. A large organisation survives a tenant takeover because it has backups, retainers, insurers and staff. A fourteen-person firm that loses its email, its files and its ability to sign anybody in has lost its ability to trade that week. The fix is also cheaper at your size: two people rather than two hundred.

"The `admin@` account is shared, so it isn't anybody's daily email."

A shared administrator mailbox is usually the worst account in the report rather than an exception to it. Nobody owns it, so nobody notices unusual activity in it; several people know the password; and it receives mail, which means it receives phishing. If it needs to receive mail, it should not hold a tier-zero role.

The findings that travel with this one

Privilege is the largest category in the pack — thirteen of the eighty-two checks — and this finding rarely appears alone. Reading its neighbours together gives you a much clearer picture than reading any one of them.