RAW staff. Your tenant groups decide what you can reach.
Break-glass access
For when Microsoft sign-in is unavailable. Administrator accounts only, and every attempt is recorded — successful or not.