How to prevent Admin role from accessing another user mailbox?

[Admin_001]

Hello,

Our management want to be assured that no other user have access to view another user mailbox items. The "other user" means of course someone with administrative rights from IT dept.

I thought that this req could be accomplished by creating an admin role quite powerful as Global administrator but without certain rights (ex.delegation rights to others mailboxes). Global admin credentials would then be stored in a safe place and used in case of extra need.

Please advice me if o365 rights management allows me to do that.

Also is it a proper way to handle this requirement, maybe there is some simpler way?

Thanks in advance

[#2]

You cannot prevent Global admins or Exchange admins from accessing other user's mailboxes. Even if you remove the corresponding cmdlets from the RBAC roles or configure exclusive scopes, they can always revert those settings, assuming they know what they're doing. You can prevent users with other roles from doing this.

[#3]

@Vasil Michev  Thanks for your answer, i think that there should be an option to set more granual permissions to enable a scenario where you may create many very powerful admins (copies of global admin) without certain rights like access to other user mailboxes.

[#4]

There's isn't. Everyone and anyone that has been granted a Global admin has all the keys to the kingdom. Period. This is why you keep the number of GAs to a minimum and only grant the role to people you fully trust.

And there isn't such thing as "copy of global admin", we cannot create custom Azure AD roles. We can put some controls in place (custom RBAC roles, exclusive scopes, PAM, etc), but again all of these can be overwritten by a GA. 

[#5]

@Admin_001 hi there!  Depending on what O365 license you have you can also set up an alert to monitor mailbox access- in order for this to work you will have to enable audit logging first.

The alert can be create in the Security & Compliance Admin center- screen shot attached. Let me know if that works!