🚦🟢👨💼CA - MFA for Admin Roles with High Priv 1h
One account to rule them all gets the shortest leash of all. Global Administrator re-authenticates every hour, because the keys to everything should never sit warm and unattended.
What this policy is about 💍
Global Administrator is the One Ring: one account that rules them all, and precisely the account you least want left signed in on an unlocked laptop. Where the broader admin roles get a four-hour clock, the role that can do literally anything in the tenant gets one hour. MFA required, session capped at sixty minutes, no exceptions but break-glass.
Same idea as the four-hour policy, dialled to its most paranoid setting for the one role that deserves the paranoia.
Global Admin is the account an attacker most wants and can do the most with. Every extra hour a hijacked session stays valid is another hour of unfettered tenant control. One hour is the point where the leash is short enough to matter without making legitimate admin work impossible.
Why this matters 🕵️
There is no bigger prize in the tenant. A compromised Global Admin is not "a breach", it is "the breach": create accounts, disable policies, exfiltrate everything, and lock you out on the way. MFA keeps the password-only attacker out. The one-hour clock is aimed at the token thief who got past that: a stolen Global Admin session that dies after sixty minutes is a very different problem from one that runs all weekend.
This is also why the whole baseline works hard to keep the Global Admin count tiny. The fewer accounts wearing the Ring, the fewer this policy has to protect, and the smaller the target painted on your tenant.
🛠️ Configuration
Where: Entra admin center → Protection → Conditional Access → Policies.
| Setting | Value |
|---|---|
| Users, include | Directory role: Global Administrator |
| Users, exclude | 🛡️🧑💼⛓️🔓🚦Group - Break the Glass solution |
| Conditions, client apps | Browser + mobile app and desktop clients |
| Target resources | All cloud apps |
| Grant | Require multifactor authentication |
| Session | Sign-in frequency, 1 hour |
Because Global Admin also falls under the four-hour policy, Conditional Access applies the tighter of the two, so this one wins. That overlap is intentional.
Roll it out in Report-only first, then On. If a one-hour reauth genuinely disrupts real admin work, the honest fix is usually fewer Global Admins doing day-to-day tasks, not a longer leash.
Caveats ⚠️
One hour caps the window, it does not seal it. A token can still be stolen inside the hour. Phishing-resistant methods and token protection are what close that gap; this shortens how long the gap stays open. On the most powerful account in the tenant, shortening it matters most.
This is an argument for using Global Admin less. If hourly reauth is painful, that is the policy telling you Global Admin is doing work a lesser role should be doing. Use scoped roles for daily tasks and keep the Ring in the drawer.
Break-glass is out. The emergency accounts sit outside this by design, protected by their own phishing-resistant requirement. A one-hour loop must never be the thing that keeps you out during an outage.
License and reversibility. Conditional Access is Entra ID P1, included in Business Premium. Clean-revert, so a disabled or loosened high-priv policy is exactly the drift you want alerting on: the crown jewels quietly going back to an open-ended session.
🔗 Related
- 🚦🟢👨💼CA - MFA for Admin Roles 4h: the four-hour policy this tightens for the top role.
- 🚦🟢👨💼CA - MFA for Admin Portals 4h: MFA scoped to the admin portals, whoever walks in.
- 🚦🟢👨💼CA - MFA for All Users: the tenant-wide floor everything above builds on.
The account that can do anything should be the account that proves itself most often. One ring, one hour, one very short window for anyone who steals it. 💍