You cannot say who holds the administrator passwords. Start with six places.

Place 1: Microsoft 365 administrators

Microsoft recommends fewer than five Global Administrators, and says to give each administrator the least permissive role that does the job. For example, a person who only resets passwords needs the Password Administrator or Helpdesk Administrator role, not Global Administrator. An administrator who cannot sign in can be recovered by another Global Administrator or by a Privileged Authentication Administrator, so at least one of those should exist and be reachable.

1. Sign in to the Microsoft 365 admin center. If you can open it, you are an administrator.
2. Open Roles, then Role assignments, then Global Administrator. Write down each name.
3. Next to each name, mark one of three: an employee who works here now, a person at your provider, or a name you do not recognize.

Place 2: The two emergency accounts

Microsoft recommends two emergency access accounts that are not tied to any one person, kept for the day normal administrators cannot sign in. Microsoft’s guidance asks that the sign-in details sit in locked, fire-rated storage in two separate places, that the accounts be tested at least every 90 days, and that anyone holding a combination be removed from it when they leave.

Ask whether yours exist, where the details are kept, and the date of the last test. A small company may have neither accounts nor a date. Recording that is a real result.

The reason Microsoft gives for keeping these accounts apart from any one person is that a single person’s phone, or a single person’s departure, can lock everyone out at once.

Place 3: The domain name registrar

Your domain name, the part after the @ in your email address, is registered through a registrar, and the account there controls where your email and website point. You can find the registrar at lookup.icann.org. ICANN’s transfer guidance notes that the registrar gives the transfer authorization code to the person listed as the registered name holder. Check whether that is a person who still works for you, or an address you read.

Places 4 to 6: Network equipment, Wi-Fi, and the backup account

• The router or firewall: whose name is on the administrator login, and is it a shared login used by more than one customer of your provider? CISA’s guidance asks that contracts say a provider will not reuse administrator credentials across multiple customers.
• The Wi-Fi equipment: the same question, asked of whoever installed it.
• The backup account: whose email address and name are on it?

Write the list down

For each of the six, write four things: the account name, the person who holds it, the second person who can reach it, and the date you last confirmed. Keep one copy in a locked place at the office and one somewhere separate. CISA’s advisory also tells customers to identify and disable accounts that are no longer in use. A departed employee’s administrator account is the usual example.

When someone on the list leaves, the list is the thing you open first. Each name on it should be reviewed on the day they go, and the 90-day test of the emergency accounts is a natural time to review the whole page.

What this list can and cannot show

The list shows who is named on each account today. It does not show whether a password is strong, whether it was shared, or whether anyone signed in recently. Those need the sign-in history, which is a separate check.

We read the roles and registrar records with you and tell you what we found and what we did not, with dates. A person reads the result.

A password is a key, and the name on the account tells you who is holding it.

Related

• When Your IT Person Is Away: Where Alerts and Access Go
• Leaving an IT Provider Without Losing Access
• A User Account on a Computer That Nobody Created
• MFA Is On: What the Second Step Covers and Misses

Sources

• Microsoft Learn: About administrator roles in the Microsoft 365 admin center
• Microsoft Learn: Best practices for administrator roles
• Microsoft Learn: Manage emergency access admin accounts
• ICANN: FAQs for Registrants: Transferring Your Domain Name
• CISA: Protecting Against Cyber Threats to Managed Service Providers and their Customers (AA22-131A)