RAW staff. Your tenant groups decide what you can reach.
Break-glass access
Administrator accounts only. Every attempt is recorded, successful or not. Once Microsoft sign-in is configured, use that instead.