License administrator accounts without mailbox or collaboration apps

Description

Accounts holding a privileged role have no license, or only licenses that do not provide productivity workloads: for example Microsoft Entra ID P1/P2, Microsoft Intune or Microsoft Defender plans. They have no Exchange Online mailbox, no Teams and no OneDrive. The emergency access accounts have no license at all.

Entra ID P1 or P2 is still required on admin accounts for Conditional Access and PIM, and is part of the reduced footprint.

Rationale

A mailbox and Teams expose the account to phishing, malicious attachments and external chat, and invite people to use the admin account for daily work. An admin account without these workloads can only be reached by an attacker through its sign-in, which phishing-resistant MFA protects. Notifications that admins need are sent to their everyday mailbox instead.

Impact

Administrators read alerts and PIM notifications in their everyday mailbox: set an alternate email address or forward from the service. Some admin tasks (for example testing a mailbox feature) need a separate test account.

Audit

1. List the privileged role holders as in CB-M365-ADMIN-001.
2. Sign in to the Microsoft 365 admin center (https://admin.cloud.microsoft) as at least a Global Reader. Browse to Users > Active users, open each admin account and check Licenses and apps: no license that includes Exchange Online, Teams or SharePoint (Microsoft 365 E3/E5, Office 365 E1/E3/E5, Exchange Online plans...).
3. Read-only PowerShell alternative (Microsoft Graph, scope User.Read.All):

   Get-MgUserLicenseDetail -UserId <upn> | Select-Object -ExpandProperty ServicePlans |
     Where-Object { $_.ServicePlanName -match '^(EXCHANGE_S_|TEAMS|SHAREPOINT)' -and $_.ProvisioningStatus -ne 'Disabled' }
   

4. Fail if an admin account has an enabled Exchange Online, Teams or SharePoint service plan.

Remediation

1. In the Microsoft 365 admin center, open each admin account > Licenses and apps, remove the productivity license and keep only Entra ID P1/P2 (or a security-only plan). Required role: License Administrator or User Administrator.
2. If the license is assigned by a group, remove the account from that group.
3. Set an alternate email for notifications on the account (Properties > Contact information).
4. Equivalent with Microsoft Graph PowerShell: Set-MgUserLicense -UserId <upn> -AddLicenses @() -RemoveLicenses @('<skuId>').

Rollback

Reassign the license. The mailbox stays recoverable for 30 days after license removal.

References

• Protect your Microsoft 365 global administrator accounts Microsoft, vendor-doc, accessed 2026-10-24
• Securing privileged access for hybrid and cloud deployments in Microsoft Entra ID Microsoft, vendor-doc, accessed 2026-10-24

Mappings

How this control relates to the other framework's: equivalent, stricter, looser, partial or related.

Threats mitigated

Related controls

• related CB-M365-ADMIN-001 Use dedicated, named, cloud-only accounts for administrative roles
• related CB-M365-MAIL-012 Block sign-in for shared mailbox accounts

People and lifecycle