Admin rights given to someone

What happened

Someone received an admin role. With it they can change everything in your Microsoft 365 or Google Workspace, including other people's passwords.

Serious: deal with it today.

Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.
Check who holds admin rights: Microsoft 365 admin center → Roles → Role assignments → Global Administrator (and the other roles). Remove anyone who shouldn't be there.
Open the page: admin.microsoft.com/#/rbac/directory
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Reset their password: Microsoft 365 admin center → Users → Active users → the person → Reset password. Give the new one by phone or in person.
Open the page: admin.microsoft.com/#/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Sign them out everywhere: Microsoft Entra admin center → Users → the person → Revoke sessions. This also logs out an attacker who copied their session.
Open the page: entra.microsoft.com
Type the address yourself or use your bookmark: never follow a link in an unexpected email.

Call the person (don't email: their mailbox may be in someone else's hands) and ask whether it was them.
Check who holds admin rights: Google Admin console → Account → Admin roles → each role → Admins. Remove anyone who shouldn't be there.
Open the page: admin.google.com/ac/roles
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Reset their password: Google Admin console → Directory → Users → the person → Reset password. Give the new one by phone or in person.
Open the page: admin.google.com/ac/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.
Sign them out everywhere: user page → Security → Sign-in cookies → Reset. This also ends a session an attacker copied.
Open the page: admin.google.com/ac/users
Type the address yourself or use your bookmark: never follow a link in an unexpected email.

Fixed when only the people who should be admins hold admin roles, and the person who gave the role confirms it was planned.

Call your IT provider now if the person didn't do this, or if you are unsure.