Microsoft 365 management: put identity, email and collaboration in scope

Start with tenant and domain ownership

Identify the organization that controls your Microsoft tenant, domain registration and billing arrangements. Confirm that authorized business representatives can recover administrative access without relying solely on an outside provider. Ask how privileged accounts are separated from everyday user accounts and how provider access is reviewed.

Document existing licenses and the features actually available under them. Recommendations for identity or device policies may depend on licensing and supported configurations. A provider should disclose required changes and costs rather than implying every proposed feature is already included in your subscription.

Define account lifecycle and sign-in responsibilities

Create a process for joining employees, role changes, departures and external guests. Determine who approves access, how multi-factor authentication is enrolled and how lost authentication methods are handled. Ask the MSP how it verifies a reset request before changing an account.

Microsoft describes cloud security as shared responsibility, and its MFA guidance explains an additional layer of sign-in protection. Those measures are not a complete security program by themselves. Clarify responsibility for user behavior, data permissions and ongoing policy review rather than treating platform adoption as automatic protection.

Scope email work beyond mailbox creation

List shared mailboxes, distribution groups, forwarding rules and applications that send email on the organization’s behalf. Ask who manages domain mail configuration, investigates delivery issues and reviews suspicious account activity. Include support for legitimate business applications without assuming the MSP maintains each application.

For departures, decide who may access retained mail and for how long based on your business and legal requirements. Ask about archive, retention and recovery features separately. Do not assume an ordinary mailbox or platform retention setting provides an independent backup or satisfies every obligation.

Make collaboration permissions intentional

Teams, SharePoint and OneDrive can serve different collaboration needs. Map who owns a team or site, who can invite guests and how external sharing is reviewed. Identify important files stored under an individual account that should instead have an appropriate organizational owner.

Ask how the provider diagnoses sync issues, permission problems and deleted content. Clarify what recovery is possible under the configured service features and whether separate backup is included. A migration should be tested for links, permissions and user workflows, not declared complete solely because files were copied.

Compare management, projects and reporting

An engagement may start with an administrative-access review, license inventory and prioritized configuration assessment. Agree on business approvals before policy changes affect sign-ins or sharing. Ask for a record of changes and a support route for users who encounter problems after rollout.

Compare ongoing administration with migrations, security projects and help desk work. Clarify licensing charges, minimum counts and the handoff process. Your organization should receive documentation and retain control of accounts even when the provider manages day-to-day operations.

Questions for prospective MSPs

1. Which proposed controls depend on additional licenses?
2. How do you verify requests to reset MFA or administrator access?
3. What recovery is included for mail, SharePoint and OneDrive?
4. Will we retain tenant control and a complete change record?