IT support
Does your IT provider own your Microsoft 365 tenant?
It should be yours, in your company’s name, with at least one global administrator account that belongs to you rather than to them. You can check in about ten minutes. If the answer turns out to be no, that is fixable, and it is much easier to fix while you are still on good terms.
It should not. Your tenant should be registered to your company, and you should hold at least one global administrator account of your own, with the password somewhere you can get at it.
Your provider having administrative access as well is completely normal and is how they do the job. The difference that matters is whether their access exists because you granted it, or whether yours exists because they allowed it.
How do you check?
Ten minutes, and you do not need to be technical.
- Try to sign in at admin.microsoft.com with an account you control. If nobody in your business can get in, that is your answer.
- Look at the organisation name and address in the admin centre settings. It should be your company, at your address. Not your provider’s.
- Look at the list of global administrators. You want to see at least one that is yours. Being able to see the list at all is a good sign.
- Check the billing. Are the subscriptions on your own card or direct debit, or bought through a partner? Either is fine. Knowing which is not optional.
- Log into your domain registrar separately. Whoever holds this holds your email, so it matters more than the tenant does.
If you cannot do steps one to four, ask your provider to set you up with a global administrator account in your own name. A reasonable provider will do it the same day and think nothing of it. The reaction you get to that request tells you a lot.
What is a CSP relationship, and does it matter?
Most small businesses buy Microsoft licences through a partner rather than directly from Microsoft, under what Microsoft calls the Cloud Solution Provider programme. Your provider resells the licences, usually bundles support around them, and one invoice arrives instead of two.
There is nothing wrong with that. It is normal, it is frequently cheaper, and the partner can support you properly because they have a relationship with Microsoft on your behalf.
What it does mean is that your licences sit under an agreement between your provider and Microsoft. If you leave, those licences have to be moved to a different partner or to a direct arrangement. That is a documented process rather than a fight, and it is one of the things worth asking about before you sign anything, not after.
The thing to separate in your head: the tenant is yours, the licences may be bought through somebody. Those are two different questions and people conflate them constantly.
The version that goes wrong
The awkward one is where the tenant was created years ago by whoever set the business up, in their own name, with their own details, and nobody has looked at it since. The company address in the admin centre is an office you have never visited. Every global administrator is an @theirdomain.com account. Nobody at your end can sign in at all.
That is recoverable. Microsoft has a process for it, and it is slow and involves proving you are who you say you are. It is much less painful to sort out while everybody is still getting on, so if you find this today, deal with it today rather than on the morning you decide to leave.
The domain name version of the same problem is worse, because whoever controls the domain controls where your email goes. If your domain is registered in somebody else’s name, that is the first thing to fix and it is worth being polite but persistent about it.
Why I bang on about this
Because it decides whether you have a choice.
A business that owns its tenant, its domain and its data can change provider because the service is not good enough, and it is an inconvenience. A business that owns none of those things stays, because leaving looks frightening. I have seen firms put up with genuinely poor service for years for exactly that reason, and it is a rotten position to be in.
There is a version of this industry that relies on that, without ever saying so out loud. I would rather you could leave us any time you liked and chose not to.
What to do this week
Sign in at admin.microsoft.com. Check the organisation name. Check you have a global administrator account of your own. Log into your domain registrar. Write down what you find.
If any of it comes back wrong, ask your provider to fix it and give them a reasonable deadline. If you would rather have somebody independent look, get in touch and we will tell you what you actually own, whether or not you ever become a client. What we do day to day and what it costs are both published in full.
Questions
The questions people ask us about this
Is it bad that our provider buys our licences?
Not on its own. Buying licences through a partner is normal and often cheaper, and it is a different thing from owning the tenant. What matters is that the tenant is registered to your company and that you hold your own global admin account.
Should we take away their admin access?
No. Your IT provider needs administrative access to do the job. The point is that you should have your own as well, so that their access is something you granted rather than something you depend on.
What if we cannot get into the domain registrar either?
That is the more serious of the two, because whoever controls the domain controls your email. Registrars have a documented process for disputing or transferring ownership. Start it before you need it.