Reviewing the Global Admin role: the highest-risk category

If there is one category where review discipline is absolutely critical, it's Global Admin and equivalent roles. Here is the dedicated procedure that sits on top of your standard access review.

Global Admin, AWS root, Salesforce system admin, GitHub org owner — these roles receive separate treatment in every review. No bulk processing, no sampling: full visibility, every time.

What do you review for each Global Admin?

• Still employed / in role?
• Actually used in the past quarter? (log check)
• Compliant with PAM policy — dedicated admin account, hardware MFA, not used for day-to-day work?
• Is there a backup person who can take over the same access? (minimum 2, never just 1)
• Password rotated since the role was assigned?

What if someone hasn't used it in 90 days?

Red flag. Either they don't need it — revoke it. Or they're quietly doing admin work through their regular user account (policy violation). Either way: a conversation is required.

Just-in-time as the mature solution

In Entra ID you can use PIM: Global Admin rights are not permanently active — a user activates them for a maximum of 8 hours with peer approval. Every activation is logged as evidence. See M365 governance for the setup.

Reporting

Include a dedicated section in the review report — "Privileged Access Review" — signed off by management. Even when no changes were made.

See also: PAM article, review pillar.