Your everyday email account should not also be your Microsoft 365 Global Administrator account. The identity you use to read invoices, open attachments, and handle customer messages should be separate from the identity you use to administer your business's Microsoft environment. Microsoft explicitly recommends using non-admin accounts for regular work and administrator accounts only when needed.
The March 11, 2026 cyberattack against Stryker makes privileged access a practical business concern, not just an IT policy discussion. Stryker reported disruption to order processing, manufacturing, and shipping within its internal Microsoft environment.
That incident is a reason to review your own access controls—not evidence that Stryker's attack began with someone checking email as a Global Administrator.
What Stryker confirmed—and what we should not assume
In its customer updates, Stryker said the attack affected its internal Microsoft environment, while its products, including connected products, remained safe to use. In the update marked 04/01/2026 10:45 a.m. ET, the company reported that its global manufacturing network was fully operational, supported by restored commercial, ordering, and distribution systems.
The investigation also evolved. In the update marked 03/23/2026 8:30 a.m. ET, Stryker said investigators had identified a malicious file used to run commands and conceal the attacker's activity. The company said that file could not spread inside or outside its environment. Describing the entire incident simply as an attack involving no malicious file would overlook that later disclosure.
Separately, BleepingComputer reported that a source familiar with the incident described attackers compromising an administrator account, creating a new Global Administrator account, and abusing Microsoft Intune's device-wiping capabilities. That is attributed reporting, not a root-cause finding established by Stryker's customer updates.
Stryker's customer updates do not establish that a daily email account held Global Administrator privileges or that an email phishing message caused the initial compromise. We should not claim that separating email and admin accounts would, by itself, have prevented this particular attack.
The defensible lesson is that powerful administrative access deserves protection beyond ordinary employee sign-ins.
Why your everyday email account should not be Global Admin
A Global Administrator can read and modify almost every administrative setting in Microsoft Entra ID, Microsoft's identity platform, and—with a few exceptions—all configuration settings in Microsoft 365. That is far broader authority than an employee needs to read email or collaborate on documents.
Microsoft also notes that the account used to enroll a business in Microsoft 365 automatically becomes a Global Administrator. That makes the original setup account an important place to check for administrative access that was never separated from daily work.
Consider a hypothetical business owner who uses the same identity for customer email and administration. If that identity is compromised, the attacker may inherit administrative permissions along with access to routine work. With separate identities, compromising the daily account does not automatically provide the separate administrator account's role assignments. This is the practical purpose of least privilege: limit the resources at risk when an account is compromised.
Separation is not a guarantee against further compromise. It is a way to avoid attaching your highest privileges to your everyday working identity.
Separate identities, not just separate inboxes
A useful operating model has distinct purposes:
- Everyday account: Email, Microsoft 365 Apps, and ordinary work, without administrative roles.
- Named administrator account: Administrative tasks only, with the narrowest role needed for the job.
- Emergency access accounts: Microsoft recommends two cloud-only emergency access accounts permanently assigned Global Administrator, reserved for situations where normal administrative access is unavailable.
The objective is separate sign-in identities with separate permissions—not merely a different-looking email address. Keep the administrator identity out of ordinary email and general browsing, and sign out when the administrative task is finished. Microsoft recommends closing unrelated browser sessions and apps before administrative work; private browsing is an available session-separation option, not a replacement for account separation or a secure device.
Microsoft says admin-only accounts do not need a Microsoft 365 business license simply to perform administration. That does not make every advanced security feature free: Conditional Access requires Microsoft Entra ID P1, and Privileged Identity Management requires Microsoft Entra ID P2 or Microsoft Entra ID Governance.
Account separation needs supporting controls
Following the Stryker attack, the Cybersecurity and Infrastructure Security Agency (CISA) issued an alert on March 18, 2026. Its recommendations cover Microsoft Intune and principles applicable to other endpoint management systems:
- Use least privilege. Limit both the administrative actions a role can perform and the users or devices those actions can affect.
- Enforce phishing-resistant multifactor authentication and privileged-access hygiene. Use identity controls, including Conditional Access and risk signals, to restrict access to privileged actions.
- Require Multi Admin Approval. Configure access policies so sensitive operations, including device wiping, require approval from a second administrative account.
These controls complement separate accounts. They address how an administrator signs in, what that administrator can do, and which changes need another person's review.
Do not make every administrator a Global Administrator
Use the role that matches the actual task. Microsoft gives the example of assigning User Administrator—not Global Administrator—to someone who needs to create user accounts. Microsoft recommends assigning Global Administrator to fewer than five people; that is not a target to fill with unnecessary assignments.
Where licensed, Privileged Identity Management (PIM) lets an eligible administrator activate a role for a limited period instead of retaining it continuously. Approval and activation notifications can add oversight. Use this alongside dedicated administrative identities, rather than treating it as permission to browse email while elevated.
Put a second approval in front of destructive actions
Intune Multi Admin Approval can protect wipe, retire, and delete device actions. A different administrative account must approve protected changes, including changes requested by a Global Administrator or Intune Administrator.
Implementation needs care. Microsoft requires at least two administrator accounts. Participating administrators need an Intune license by default; allowing unlicensed administrators requires the Allow access to unlicensed admins setting, which Microsoft warns is irreversible. Have your IT provider review the documented permissions, approver groups, and automation exclusions before rollout.
What to ask your IT provider now
Start with a review, not an unplanned removal of access:
- Does anyone's everyday email identity also have administrative roles?
- Has the original Microsoft 365 enrollment account retained Global Administrator unnecessarily?
- Does each administrator use a separate identity with only the permissions required?
- Are privileged sign-ins protected with phishing-resistant multifactor authentication?
- Can high-impact device actions require independent approval?
- Are emergency access accounts available before ordinary administrative access is changed?
Verify that the replacement administrative access works before removing unnecessary roles from daily accounts. The goal is safer administration without locking your business out.
Keep your inbox separate from your administrative authority
Stryker's incident shows that disruption to a corporate Microsoft environment can affect manufacturing, orders, and shipping even when product safety is unaffected. For a smaller business, the useful response is to examine who holds administrative access and how that access is protected.
Start with a clear boundary: use your everyday account for everyday work and a separate administrator identity for administration. Then reinforce that boundary with least privilege, phishing-resistant authentication, time-limited access where licensed, and independent approval for high-impact changes.
Ready to discuss your business's security priorities? Explore Grand Rapids Tech's cybersecurity services.
Sources and further reading
- Stryker: Customer Updates—Stryker Network Disruption
- CISA: Endpoint management system hardening after the Stryker attack
- Microsoft: Admin account security in Microsoft 365 for business
- Microsoft: Best practices for Microsoft Entra roles
- Microsoft: Use access policies to require Multi Admin Approval
- BleepingComputer: Reporting on administrative account compromise and Intune abuse