✅ Stop privileged accounts from using email, Teams and other online services, so they are used only for administration, meeting Essential Eight – Restrict Administrative Privileges.

➡️ Admin accounts can reach admin portals and management tools only. Everyday work must be done from a separate, unprivileged account.

✅ Users: Holders of 91 Entra ID admin roles, including Global Administrator, Privileged Role Administrator, Security Administrator, Global Reader and the Intune, Exchange and SharePoint admin roles (the same roles as the admin MFA policy, minus Directory Readers)
🚫 Exclusions: E8+IBP - SG - Excluded from all CA policies (break‑glass accounts)

✅ Grant: Block access
✅ Admin roles can still sign in to Microsoft admin portals, Azure management and Microsoft Graph PowerShell
✅ Email, Teams, SharePoint and other web services are blocked for admin accounts

⚠️ Before enabling: Make sure every administrator has a separate, unprivileged account for daily work. Any account that holds an admin role and also uses email or Teams will lose that access when this policy is switched on.

🚫 MFA or authentication strength for admins (handled by the admin MFA policies)
🚫 Just‑in‑time role activation (PIM)
🚫 Blocking internet browsing on the device itself

🟡 Report‑only on deployment
➡️ Review the sign‑in logs for affected admin accounts, then switch the policy to On once dedicated admin accounts are in place.

✅ Privileged users are not permitted to access the internet, email and web services (ISM‑1175)
ℹ️ Applies across Maturity Levels 1–3

This policy ensures that:

✅ Admin accounts can only be used to administer the tenant
✅ A phishing email or malicious link can't compromise an admin account, because admin accounts can't read email or browse web services

This separates administration from everyday work, one of the most effective ways to protect privileged access.