Administrative accounts should use a license with a reduced application footprint

Most phishing arrives in email and chat, and most malware runs through the apps people use every day. An administrator account with a mailbox and the full app suite is exposed to all of that while holding powerful rights. Take the productivity services off the administrator account and a large part of that exposure goes away.

Microsoft's guidance is to keep administrative accounts separate from everyday ones and not to give them productivity licences. See Securing privileged access accounts and Best practices for Microsoft Entra roles. This is a manual check in the dataset, so it needs a human decision about which services each admin really needs.

In the Microsoft 365 admin center open Users > Active users, select an administrator and open the Licenses and apps tab. Note which licences and which apps are turned on. Repeat for each administrator found under Roles.

Connect-MgGraph -Scopes "User.Read.All"
Get-MgUserLicenseDetail -UserId "admin.example@<tenant>.onmicrosoft.com" |
  Select-Object SkuPartNumber, @{n='Plans';e={ ($_.ServicePlans | Where-Object ProvisioningStatus -eq 'Success').ServicePlanName -join ', ' }}

Look for plans such as an Exchange Online mailbox, Teams, SharePoint or the desktop Office apps on an account that only administers.

1. Give each administrator a separate admin account if they only have one account today, and keep their daily work on the regular account.
2. On the admin account, remove the productivity licence, or turn off the individual apps and services in Licenses and apps.
3. If your tenant needs a licence for features such as Privileged Identity Management or Conditional Access, assign one that carries those features without the mailbox and app suite.

Connect-MgGraph -Scopes "User.ReadWrite.All","Organization.Read.All"
# Replace <sku-id> with the id from Get-MgSubscribedSku, then run on one test account first
Set-MgUserLicense -UserId "admin.example@<tenant>.onmicrosoft.com" -AddLicenses @() -RemoveLicenses @("<sku-id>")

ConfigCobra itself never changes the tenant. It shows what to look at, and you apply the licence change.

The administrator loses the mailbox and the apps tied to the removed licence on the admin account, so they cannot read mail or open Teams with it. Mailbox content is kept only for a limited time after the licence is removed, so move anything you need before you remove it. They keep using their regular account for email and collaboration. Alerts, password-reset mail and other notices addressed to the admin account stop arriving there, so update the contact address. Regular users are not affected.