Admin accounts: what Cyber Essentials allows

Last reviewed 2 November 2026 against the Cyber Essentials requirements v3.3 (Danzell question set).

The strict rule on separating admin accounts

Section E.4 of the NCSC Requirements for IT Infrastructure v3.3 (page 20) states that your organisation must:

“use separate accounts to perform administrative activities only (no emailing, web browsing or other standard user activities that may expose administrative privileges to avoidable risks)”

This applies in two places that assessors check closely:

1. Local administrator accounts on Windows and macOS computers: Staff (and directors) must log in to their laptops every day using a Standard User account. A separate local admin account is used only when a UAC (User Account Control) elevation prompt appears to install software or change a system setting.
2. Cloud administrator accounts (such as Microsoft 365 Global Administrators): The account you use for Outlook and Teams must be a standard user with no admin roles. If you manage Microsoft 365, you sign in to a separate, dedicated admin account (for example, admin-ross@yourfirm.co.uk) that has no mailbox and no Microsoft 365 Office licence.

How do staff install software or printers once local admin is removed?

The biggest pushback from business owners is: “If I take local admin rights off my team, won’t they call me every time they need an update or a printer?” Not if you set it up properly:

• Pre-approve common business apps in Intune Company Portal: Publish apps like Adobe Reader, Chrome, Zoom or sector tools to the Microsoft Intune Company Portal so staff can install them with one click as standard users without needing an admin password.
• Standard users can already add Wi-Fi networks and standard printers: Modern Windows 11 allows standard users to connect to Wi-Fi and install standard network print drivers without admin elevation.
• Use Windows LAPS for emergency local elevation: Windows Local Administrator Password Solution (LAPS), built into Windows 11 and Microsoft Entra ID / Intune, automatically maintains a unique, randomly rotated local administrator password for every laptop, stored securely in Entra ID. If a staff member genuinely needs a one-off install, IT looks up that machine’s current LAPS password, uses it once, and lets LAPS rotate it automatically afterwards.

Third-party MSP accounts and emergency “break-glass” accounts

Don’t forget two special types of admin account that are in scope under v3.3 (page 11):

• Your IT support provider’s (MSP) accounts: Any admin account in your Microsoft 365 tenant or servers used by an external IT company is in scope. It must be unique, protected by MFA, and never used for general email or browsing.
• Emergency “break-glass” accounts: Microsoft recommends keeping two cloud-only emergency access accounts (`breakglass1@...`) in case a Conditional Access configuration mistake locks out normal admins. Under Cyber Essentials v3.3, because all cloud accounts must use MFA, protect your break-glass accounts with physical FIDO2 hardware security keys (kept in a fireproof office safe) and set an Azure Monitor alert that emails/texts you the instant a break-glass account signs in.