In this guide · 8 sections
- 01What outsourced Microsoft 365 or Google Workspace admin covers
- 02How to give a provider access safely
- 03Who keeps the Global Admin or super admin role
- 04Monthly tasks to expect from your provider
- 05Change logs and audit records
- 06Plan the exit before you start
- 07Do it yourself or get help?
- 08Frequently asked questions
Short answer
Keep the top admin role (Microsoft Global Administrator or Google super admin) on an account your business owns, and give your provider its own named admin accounts or Microsoft's GDAP delegated access with only the roles it needs. Ask for a monthly change log and a written exit plan.
What outsourced Microsoft 365 or Google Workspace admin covers
Admin support means someone outside the business manages the settings and accounts behind your email and files. For a small business it is usually a few hours a month, with spikes when someone joins, leaves or gets phished.
| Task | How often | Typical owner |
|---|---|---|
| New staff accounts and licences | When someone joins | Provider, on your request |
| Leavers: block, convert mailbox, recover files | When someone leaves | Provider, same day |
| Security settings: MFA, anti-phishing, sharing | Monthly check | Provider |
| Licence count and renewal dates | Monthly | Provider reports, you approve |
| Alerts and suspicious sign-ins | As they happen | Provider triages, you decide on actions |
| Billing and payment method | Ongoing | You |
| Top admin account and break-glass access | Always | You |
Agree this split in writing. Our IT support contract and SLA checklist covers response times, scope and fees.
How to give a provider access safely
There are three ways a provider gets into your admin console. Only two are acceptable.
Microsoft GDAP
Best for Microsoft partners- You approve a request from the partner's own Microsoft tenant
- Only the admin roles you agree to, for a set period
- Maximum two years; can auto-extend six months at a time
- Global Administrator access cannot auto-extend
Best for: Microsoft 365 through a Microsoft partner or reseller.
Named admin accounts
Works everywhere- Create accounts such as provider-admin@yourdomain for each person
- Give only the roles they need, with MFA
- You see them in your user list and can delete them
Best for: Google Workspace, freelancers, non-partner providers.
Sharing your own login
Avoid- No record of who did what
- MFA codes go to the wrong person or are switched off
- Hard to take back without changing everything
Best for: Nobody.
Microsoft describes GDAP (granular delegated admin privileges) as least-privileged, time-bound access that customers must explicitly grant. Its GDAP FAQ says relationships cannot be permanent, last at most two years, and that requests expire after 90 days if you do nothing.
Who keeps the Global Admin or super admin role
The top role, Microsoft's Global Administrator or Google's super administrator, can do everything, including removing other admins. Your business should always hold one of these accounts.
- One owner-held top admin account, used only for admin work, with strong MFA such as an authenticator app or passkey.
- One break-glass account, stored offline in a safe or password manager, for when the main admin is locked out.
- Provider accounts with narrower roles where possible: user admin, Exchange or Gmail admin, security reader. Grant Global Administrator only for a specific task and take it back afterwards.
- Recovery details on your side. The recovery phone and email for the top admin should be the owner's, not the provider's.
Our guide to admin account best practice explains how to set up separate admin and daily accounts.
Monthly tasks to expect from your provider
Ask the provider to report on these every month in plain English. Most can be checked in under an hour for a small tenant.
Monthly admin report
For Microsoft 365, Microsoft's security defaults are the baseline for tenants without Conditional Access: MFA for all users, blocking legacy sign-in and extra protection for admin actions. Our Microsoft 365 security checklist lists the next settings.
Change logs and audit records
Both platforms keep their own audit records. Microsoft 365 has an audit log in the Microsoft Purview portal, and Google Workspace has admin log events under Reporting in the Admin console. These record who changed what, which is exactly why named accounts or GDAP matter: shared logins make the logs useless.
On top of the platform logs, ask for a short change log in a shared document. One line per change: date, who, what, why and who approved it. It takes seconds to write and settles most disputes before they start.
Agree which changes need your approval first. A sensible list: new admin roles, changes to MFA or sign-in policies, licence purchases, deleting users or data, and changes to email routing or DNS records.
Plan the exit before you start
Every arrangement ends eventually. Agree the exit steps in the contract, while relations are good.
Confirm the owner-held top admin works
Sign in with the business's own Global Admin or super admin account and confirm MFA works for you, not the provider.
Remove delegated access
In the Microsoft 365 admin center, check partner relationships and remove the provider's roles. In Google, check whether a reseller has admin access and remove it if you are moving away.
Delete provider admin accounts
Remove named provider accounts, app passwords, API keys and any service accounts they created.
Collect records
Ask for the change log, documentation of custom settings, DNS records and any scripts or automations they built in your tenant.
Check billing ownership
If you buy licences through the provider, arrange the transfer to a new reseller or direct billing before notice ends, so licences do not lapse.
Do it yourself or get help?
A small business with a confident owner can run admin itself using the monthly checklist above. Outsourcing makes sense when nobody has time, staff turnover is high, or you need someone accountable when something goes wrong.
IT Sorted can do both parts. Microsoft 365 / Google Security Lockdown (S$590) sets the security baseline, cleans up admin roles and adds a break-glass account; we use temporary admin access and remove it afterwards. Protect Standard (S$19 per user a month, minimum 3 users) then handles joiners and leavers, keeps settings switched on and sends a monthly report. Your business keeps the top admin role throughout.
Frequently asked questions
No. Give the provider its own named admin account with MFA, or approve a GDAP request if it is a Microsoft partner. Sharing your login means changes cannot be traced to a person, MFA has to be shared or weakened, and taking access back means changing everything. Keep your own account private.
GDAP stands for granular delegated admin privileges. It lets a Microsoft partner manage your tenant from its own accounts with only the roles you approve, for a limited time. Microsoft says a relationship lasts at most two years, can auto-extend by six months, and cannot auto-extend if it includes Global Administrator.
Someone in your business, usually the owner or a director, plus a second break-glass super admin account kept for emergencies. A provider can have its own admin account with the roles it needs. Keep the recovery phone and email for super admins under your control, not the provider's.
The tasks covered, such as joiners, leavers, security checks and alerts; response times; which changes need your approval; a monthly report; how access is given and removed; who owns billing; and an exit plan with records handed back. It should also state that your business keeps the top admin role.
Sign in with your own top admin account, remove the provider's delegated partner roles, delete any admin accounts it created, revoke app passwords and API keys, and review admin roles and app consents. Then change shared secrets and check that billing for licences has moved to you or the new provider.