Lock down the Azure root or owner account

Why this matters

In Azure, the words root and owner point at two different control planes. The closest thing to a root user is the Microsoft Entra tenant Global Administrator, the identity that can change tenant-wide settings and reset other admins. A subscription Owner is an Azure RBAC role that can grant access to resources, assign roles and delete anything in scope. They are not the same account, and both deserve protection.

Azure does not have an immutable root account. The first Global Administrator can be removed, and a subscription Owner can be inherited from a management group, including the Tenant Root Group. That is why a single admin account is fragile: if it is lost, stolen or locked out, recovery can take hours and sometimes support involvement. A quiet Owner assignment at the root management group can also sit unnoticed above every subscription.

Daily work should not use either identity. Use a normal admin account for routine tasks, elevate through Privileged Identity Management when needed, and keep two break-glass accounts that exist only for recovery. This limits damage from a phished session and makes the audit trail easier to read.

Before you start

Inventory before you change anything. In the Microsoft Entra admin center, open Roles and administrators and list every holder of Global Administrator, Privileged Role Administrator and User Access Administrator. In the Azure portal, open each subscription, then Access control (IAM), and review role assignments at subscription and management group scope. Include the Tenant Root Group and any guest accounts with roles.

Decide your break-glass model now. Two cloud-only accounts, no mailbox, no daily use, long unique passwords kept offline, and FIDO2 security keys stored separately. Make them permanent Global Administrators and exclude them from Conditional Access so a broken policy cannot lock you out. Alert on every sign-in to those accounts.

Check licensing and recovery paths. PIM for Entra roles and PIM for Azure resources need a license that supports it. Conditional Access needs a license that supports it. Record the tenant ID, subscription IDs and the people who can reach the offline credentials. Confirm you can sign in with one break-glass account before you enforce new policies.

How to do it

Treat tenant administration and subscription ownership as separate jobs. The steps below set up recovery accounts, remove standing access, require strong sign-in for admins, and put a monitor on the roles that matter. Run the changes in a test window and keep one known good session open until you confirm the new controls work.

For the tenant, use Conditional Access with authentication strengths. Require phishing-resistant MFA for Global Administrator, Privileged Role Administrator and User Access Administrator. Block legacy authentication. Put all admin accounts in a group and target that group, not individual users.

For subscriptions, stop assigning Owner directly to people. Use PIM for Azure resources or place Owner on a group that is eligible, not active. Scope access to a management group only when the person truly needs many subscriptions. Use Reader or a narrow custom role for most work.

Logging is part of the lock. Send Entra sign-in logs, Entra audit logs and Azure Activity logs to a Log Analytics workspace. Create alerts for new Global Administrator assignments, PIM activations, break-glass sign-ins, and Owner role assignments at any scope.

1. Inventory the privileged accounts. Export the current Global Administrators, Privileged Role Administrators and subscription Owners at every scope. Check the Tenant Root Group and inherited assignments, not just the subscription you use most. Mark which accounts are human, guest, service principal or break-glass.
2. Create two break-glass accounts. Create cloud-only accounts in the tenant with no mailbox and no daily use. Give each a long unique password, register a FIDO2 key and store the credential offline in separate locations. Assign Global Administrator permanently and exclude them from Conditional Access with sign-in alerts.
3. Require phishing-resistant MFA for admins. In Entra Authentication methods, enable FIDO2 and Microsoft Authenticator. In Conditional Access, create a policy for directory roles that requires an authentication strength and blocks legacy authentication. Exclude only the break-glass group and document why.
4. Move standing Entra roles into PIM. Make Global Administrator, Privileged Role Administrator and User Access Administrator eligible rather than active. Require approval, MFA, a justification and a short activation window. Keep permanent Global Administrator only on the two break-glass accounts.
5. Remove standing subscription Owner. In Access control (IAM), find every active Owner assignment and convert it to eligible through PIM for Azure resources or remove it. Check inheritance from management groups. Keep Owner at the narrowest scope that still lets the team do the work.
6. Limit who can assign roles. Restrict Role Based Access Control Administrator and User Access Administrator. Use Azure Policy to audit Owner assignments and to flag role assignments made outside the approved process. Review service principals and managed identities that hold high privilege.
7. Monitor and review the roles. Send Entra audit logs, sign-in logs and Azure Activity logs to a central workspace. Alert on Global Administrator changes, PIM activation, break-glass sign-in and new Owner assignments. Run access reviews for privileged roles on a schedule and remove access that is no longer used.

How to check it worked

Open Entra roles and administrators. Global Administrator should show two permanent break-glass accounts and eligible assignments for everyone else. Privileged Role Administrator and User Access Administrator should have no unexplained permanent holders. Check that no guest account sits in a privileged role.

Open each subscription and the Tenant Root Group in Access control (IAM). Active Owner assignments should be rare and expected. Eligible assignments should appear only where PIM is configured. Confirm that inherited assignments from a parent management group do not grant more than you intended.

Test with a normal admin account. Sign in, confirm the Conditional Access policy applies, activate a role in PIM, and check that approval, MFA and justification are required. Before activation, confirm the account cannot perform privileged actions. Test one break-glass account in a controlled window, confirm the alert fires, then sign out.

Review the logs. Sign-in logs should show the authentication strength and no legacy authentication for admins. Audit logs should show the role changes you made. Activity logs should show role assignment writes. Check that alerts reached the right mailbox or ticketing queue.

Mistakes to avoid

The common failure is turning on Conditional Access before the break-glass accounts exist and are excluded. The second is excluding too many accounts or using a break-glass account for daily work. Test recovery before you need it, and keep the offline keys away from the same person who holds the password.

Do not treat Global Administrator as subscription Owner. They are separate systems. A Global Administrator can turn on Access management for Azure resources, which grants User Access Administrator at root scope, then assign Owner to anyone. Check that toggle and turn it off when the task is done.

Do not leave Owner on groups, service principals or guest accounts because the assignment is old. Inherited Owner at the Tenant Root Group is easy to miss. Also review PIM settings: long activation windows, no approval and no justification turn PIM into a speed bump rather than a control.

If you want an outside read before a customer review or audit, the Cloud security review at $6,500 fixed price is one option among others. It covers identity and access, public exposure, encryption, logging and backup across up to five cloud accounts or subscriptions, with findings ranked by risk.

Frequently asked questions