Is the Global Administrator role the only role you use to administrate your M365 tenant?
I'll show you how you can avoid these (and 2 other) "tricky" roles in daily administration and take a targeted but practicable "low trust" approach.
The practicable use of Privileged Identity Management - in particular the new integration of groups - is shown using practical examples.