The number of Global Administrators should be between two and four

Global Administrator can change almost anything in the tenant, including who else is an administrator. Every extra holder is another account an attacker can phish. A single holder is the opposite problem: if that person leaves or loses access, nobody can recover the tenant.

Microsoft recommends giving people the least privileged role that does the job and keeping Global Administrator for the few tasks that need it. See Best practices for Microsoft Entra roles and the list of narrower roles in the Entra built-in roles reference.

Open the Microsoft Entra admin center, go to Identity > Roles & admins > Global Administrator and read the Assignments tab. Count both active and eligible assignments, and expand any group that holds the role.

Connect-MgGraph -Scopes "RoleManagement.Read.Directory"
$role = Get-MgDirectoryRole -Filter "displayName eq 'Global Administrator'"
$members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id -All
"Global Administrators (active): $($members.Count)"
$members | ForEach-Object { $_.AdditionalProperties.userPrincipalName }

If you use Privileged Identity Management, also read the eligible assignments under Identity governance > Privileged Identity Management.

If you have more than four, review each holder and move them to a narrower role (for example Exchange Administrator, User Administrator or Security Administrator). If you have fewer than two, add a second trusted administrator or your emergency accounts.

1. List what each person actually does in the admin centers.
2. Assign the narrower role first and confirm the person can still do their work.
3. Remove the Global Administrator assignment.
4. Where you license it, make the remaining assignments eligible in Privileged Identity Management so they must be activated.

Connect-MgGraph -Scopes "RoleManagement.ReadWrite.Directory"
# Review first, then remove one assignment by its id
Get-MgRoleManagementDirectoryRoleAssignment -Filter "roleDefinitionId eq '62e90394-69f5-4237-9190-012177145e10'"

The id above is the built-in Global Administrator role definition. ConfigCobra stays read-only; it reports the count and you make the change.

People who lose Global Administrator keep their account but can no longer do tasks that need that role, such as changing tenant-wide settings or assigning roles. Check their recent admin work before removing the role, so you give them a role that covers it. If you add administrators, you add more accounts to protect with strong sign-in. Count your emergency accounts as holders, because they are part of the total. Regular users are not affected.