Microsoft recommends that you create at least two Microsoft cloud accounts (onmicrosoft.com) and make them Global Administrators (GA). One should have Conditional Access and the other MFA enabled.