Don’t read email with your admin account
If the account you browse and read email with is also a domain or cloud admin, one bad click hands over everything.
The IT manager has one account. It reads email, browses the web, joins meetings, and is a global admin in Microsoft 365 and a domain admin on the servers. One phishing click, one malicious attachment, and the attacker has all of it.
Separating them is one of the cheapest big improvements I know:
- A normal account for daily work, with no admin rights.
- A separate admin account, used only for admin tasks, with no mailbox and no web browsing.
- Phishing-resistant MFA on the admin account, and sign-in allowed only from managed devices if you can.
- For servers, a different admin account again, so a cloud compromise doesn’t give you the domain, or the other way round.
Yes, it’s slightly less convenient. That’s the point. The admin account should feel like getting the keys out of a drawer.