They had 47 global admins

Lack of discipline & organizational drift

When one credential was compromised, the attacker did not need to escalate privileges.

They already had them.

There was no lateral movement strategy.
No complex privilege chain.
No need to identify a higher-value account.

The authority was built into the role.

In Microsoft 365, a global administrator can control identity, reset passwords, assign roles, access data, modify security settings, and effectively redefine the control framework of the tenant.

Forty-seven individuals held that authority.

Not because forty-seven were required.
Because access had accumulated.

Over time, elevated rights were granted to accelerate projects, simplify support, and remove bottlenecks. Few were ever reassessed. Fewer were removed.

Privilege growth is rarely intentional. It is incremental. Each decision appears reasonable in isolation.

Collectively, it becomes exposure.

For executive leadership, this is not an operational convenience issue. It is risk concentration at scale. Every additional global administrator increases the probability of credential compromise, insider misuse, configuration error, and audit scrutiny.

Least privilege is not a theoretical principle.
It is a discipline.

It requires:

Clearly defined role boundaries
Segregation of duties
Time-bound elevation where possible
Continuous review of administrative roles
Accountability tied to business justification

Without discipline, organizations drift.
Access expands.
Oversight weakens.
Exposure compounds.

Most breaches do not occur because attackers are exceptionally sophisticated.

They occur because too many people have too much power.

Concerned about the scale of privileged access in your M365 environment? Contact us for a confidential review of administrative exposure and governance discipline.