Reply to post:

oof.

First thing we did with our Office 249 account was to assign two people the Global Admin role, and then created a 'break glass" account that was also GA, with the password stored in the company's on-prem password vault.