A school recently reported losing access to its Microsoft 365 administrator accounts. Staff accounts kept working, but the people responsible for managing the system couldn’t sign in.
Without working admin accounts, a school can quickly lose the ability to reset passwords, manage users, administer Intune devices, change Teams settings, update security policies, or respond to a safeguarding incident.
If it happens to you
- Check whether any other Global Administrator account can still sign in.
- Using a working admin account, review Entra ID sign-in logs, Conditional Access policies and MFA settings.
- Check for billing, subscription or domain verification problems.
- Raise an urgent Microsoft support case if every admin account is inaccessible.
- Tell senior leaders and your safeguarding lead if key functions are unavailable.
Prevent it: break-glass accounts
Every school should keep at least two documented “break-glass” Global Administrator accounts. These are emergency accounts with strong credentials, stored securely offline, excluded from policies that could lock them out, and tested regularly as part of your disaster recovery and incident response planning.
Quick win: check last week’s backups
While you’re thinking about resilience, don’t assume backups are working just because they’re scheduled. Review the last seven days of backup alerts for failed jobs, missed devices or storage warnings. Then pick one critical server or Microsoft 365 user and confirm you could actually restore a file. Five minutes today could save hours during a recovery.
How we can help
This story first appeared in School IT Intelligence Week 4, our free weekly briefing for school IT teams and leaders. Read the full issue or subscribe free to get it every week.
Not sure where your school stands? Give us one day in your school and we’ll review your systems, licensing and security, and show you where money is being wasted and where risk is hiding. Book your IT review day →