Global Administrator access in multi-tenant architecture

Question

In a multi-tenant architecture in Azure, do global administrator have access to resources/administrative features of all the tenants or one tenant only ?
In case it has access to multiple tenants, does it possess some security concern ?
In case it has access to single tenant only, are there multiple global administrator ?

Thanks in Advance.

Answer 1

A global admin is per tenant, so you would need to manage multiple global admin users per tenant for full global admin privileges to each tenant.

However, there are ways that you can manage multiple tenants with varying levels of permissions through delegated admin privileges and M365 Lighthouse and Azure Lighthouse. These use a single identity to provide administrative access to other tenants so it would be very important to secure these accounts.

Here's some links for further reading:

https://learn.microsoft.com/en-us/microsoft-365/admin/add-users/about-admin-roles?view=o365-worldwide

https://learn.microsoft.com/en-us/microsoft-365/lighthouse/m365-lighthouse-overview?view=o365-worldwide

https://azure.microsoft.com/en-us/services/azure-lighthouse/#overview