We value your privacy

We use cookies to analyze site traffic and improve your experience. You can accept all cookies or reject non-essential ones. See our Privacy Policy for details.

GR IT SERVICES
  • Contact
Get a quote
  2. Microsoft
  3. Tenant management
Microsoft 365 tenant management for US businesses

Nothing your company owns matters more than the tenant, and almost nobody runs it that way.

One tenant holds the entire company: every mailbox, every document, every Teams thread, every identity, and every administrative right anyone has ever been granted. Almost every American business we meet configured it once, years ago, and has had no owner since. We treat the tenant as something that has to be run rather than something that was installed, covering identity, licensing, security posture, the joiner and leaver process, and governance, with one named engineer answerable for its condition month by month.

Talk to a tenant engineerWhat tenant management covers
Microsoft
Microsoft
365
Cloud Solution Partner
  • GDAPLeast-privilege access
  • MonthlyTenant health report
  • 9Standing disciplines
  • 2-4Global admins, right-sized
What tenant management covers

Nine disciplines a managed tenant actually needs.

This is not a product you purchase and finish with. It is a live environment that decays without attention. Administrative rights accumulate quietly, license counts drift away from actual headcount, guests invited for a project in 2023 are still there, and whatever Microsoft measured about your posture last year describes a tenant you no longer have. Below is the work that stops that happening.

Admin roles and RBAC hygiene

Every permanent administrative right gets justified or removed. Admin work moves onto dedicated accounts rather than the mailbox somebody reads email in, multi-factor is mandatory on every privileged role, the emergency accounts are tested rather than assumed to work, and the whole list is revisited quarterly. Tenants arrive with five to ten global administrators as a matter of routine. Two to four is almost always the correct number.

License lifecycle management

Licenses matched to the people you employ now rather than the people you employed last year. Anything belonging to a leaver comes back inside the offboarding window, the mix of subscriptions is checked against features anyone actually uses, renewal dates are tracked, and commitment terms are chosen deliberately instead of arriving by automatic renewal. The first review almost always finds money sitting on the table.

Security posture and Secure Score

Secure Score is tracked every month and every movement is explained in writing rather than left as a number. Conditional access policies are maintained as the business changes, legacy authentication stays blocked, and new Microsoft defaults get assessed before they switch themselves on. A regression is caught the month it occurs rather than during a SOC 2 fieldwork week or an insurance renewal.

Joiner, mover, leaver lifecycle

Every arrival, move, and departure follows the same written process. New starters have the right license, the right groups, and an enrolled device waiting on their first morning. People changing role have access rebuilt around the new job rather than layered on top of the old one. Leavers are disabled, signed out everywhere, their mail and files transferred, and their license returned, every time, leaving a trail an auditor can follow.

Guest and external access governance

Every external account is traceable to who invited them, what they can currently reach, and the date their access ends. Teams carrying a lot of outside people get periodic access reviews, sharing rules are set per site according to how sensitive the content is rather than one blanket setting, and inactive guests are removed on a schedule. An ungoverned tenant almost always still has guests from engagements that closed years ago.

Domain and DNS integrity

Your domains sit verified in a registrar account your company owns rather than in a supplier one. Mail authentication stays at enforcement so nobody can send as you, the routing and discovery records are correct, and DNS or certificate changes go through change control instead of through whoever happens to remember the registrar password.

Backup and retention posture

A straight answer about what is protected and what is not. Microsoft runs a shared responsibility model, and neither a retention policy nor a recycle bin is a backup, whatever anyone told you at signing. We establish what genuinely needs backing up, deploy it where the case holds, set retention and legal hold to match your actual obligations, and then prove a restore works rather than assuming it.

Reporting and tenant evidence

One report a month, written so a non-technical director can read it: how the score moved, where licensing stands, which administrative rights changed hands, how many guests there are, which sign-ins looked risky, and what is still open and with whom. Audit logging is configured and retained properly, so that when an assessor, a carrier, or an enterprise customer questionnaire asks something, answering it is an export rather than a two-week investigation.

Configuration change control

Settings change on purpose and get recorded, so the configuration described in your audit is the configuration actually running. Microsoft pushes changes that affect your tenant continuously through the Message Center. We read them, work out which ones touch you, and either apply or defer each one deliberately, rather than finding out when a user calls.

Tenant management services

The specific tenant problem you came here with.

Managing the tenant is the ongoing discipline. What follows are the discrete pieces of work inside it, each with its own page because the effort, the risks, and the questions asked are genuinely different in each case. Where your situation covers several, start with the nearest match and the call will sort out the rest.

Starting, moving, or taking over a tenant

There are three ways this work usually starts: building a tenant properly from nothing, a transaction that forces data to move between tenants, or recovering an existing tenant from whoever currently holds the keys.

  • Microsoft 365 tenant setupA tenant built correctly at the first attempt: naming, domains, identity, the security baseline, and licensing, all registered to you from the opening day.
  • Tenant-to-tenant migrationAcquisitions, disposals, and rebrands, where mail, files, Teams content, and identities all have to move between tenants against a planned cutover.
  • Tenant takeover from a previous partnerTake administrative control back, cut the previous provider access without breaking anything, and settle who actually owns the tenant and the domain.

Multi-tenant and cross-tenant operations

For groups running more than one tenant, deliberately or by accident. Holding companies, PE-backed roll-ups, joint ventures, and companies mid-acquisition all live here.

  • Microsoft 365 Lighthouse multi-tenant managementA single view across every tenant in the group, with the same baselines applied, delegated access, and posture visible for each company separately.
  • Cross-tenant sync and collaborationPeople in different tenants working as one org: cross-tenant synchronization, trust settings, and shared channels done safely.

Governance and security posture

Two things determine whether a tenant stays healthy once the project team leaves: knowing who outside the company can reach your data, and having the secure configuration written down rather than remembered.

  • Guest and external access governanceEveryone from outside the company accounted for, access that lapses without anybody remembering to revoke it, and sharing rules that follow how sensitive the data is.
  • Tenant security baselineYour security configuration written down and actually enforced across identity, mail, sharing, and devices, with the evidence to back each control.
Why GR runs tenants well

Four reasons US businesses hand us the tenant.

Microsoft partner with an operations discipline

Tenant operations is the core of what we do, not an upsell beside license resale. The engineer who reviews your Secure Score is on the same team that handles your escalations to Microsoft, and the monthly report is written by people who actually made the changes it describes.

GDAP least-privilege access, in writing

Our access runs through Granular Delegated Admin Privileges: named roles, granted by you, expiring on a date, and fully auditable. You can see precisely what we are able to touch from inside your own admin center and withdraw it yourself in a few clicks. There is no shared administrator account and no access you cannot inspect.

A monthly report your management can actually read

Not a dashboard link and a shrug. A written report each month covering what changed, which way the score moved and for what reason, how licensing compares against current headcount, how many administrators and guests exist, and every open item with a name and a date beside it. The same document serves as the evidence pack whenever an assessor, a carrier, or a large customer asks.

We work beside your IT team, or we are the IT team

Some companies have an IT manager who wants the tenant properly governed without losing control of it. Others have nobody at all. Both arrangements work here: we sit behind your internal IT as the standing tenant authority with the boundaries written down, or we are the entire function. In either case one named engineer is accountable for the state of the tenant.

Who needs a managed tenant

Four situations where tenant management stops being optional.

No IT manager, and the tenant shows it

Companies between ten and a hundred and fifty people where Microsoft 365 was stood up by a founder, a contractor, or whoever had a free afternoon, and has never been deliberately reviewed since. The symptoms never vary: too many administrators, licenses paid for and unused, no offboarding worth the name, and a Secure Score nobody has opened. We become the owner your organization chart never had.

Fast-growing, and the setup is not keeping up

Headcount doubling, new departments appearing, and the first SOC 2 request or enterprise security questionnaire landing in someone inbox. A tenant that worked perfectly well at fifteen people becomes a liability at eighty. We get lifecycle, licensing, and access governance running properly before growth converts an informal setup into an incident report.

Post-incident, and it must not happen again

After a mailbox was compromised, a payment nearly went to the wrong account, or someone discovered a former employee still had access. The immediate hole is usually plugged by the time we arrive. What is missing is the ongoing discipline that stops it recurring. We harden the tenant and then keep it hardened, producing monthly evidence that the controls still hold. Your cyber carrier will ask for exactly that evidence sooner or later.

Multi-entity groups and roll-ups

A holding company or private equity platform with operating companies spread across several states, each running its own tenant, or worse, all crowded into one tenant nobody governs. We run the estate as a whole: identical baselines applied through Lighthouse, reporting broken out per company, and clean answers when each entity auditor, lender, or prospective buyer asks its own set of questions.

Check this before anything else

Could you name everyone with administrative rights over your tenant today?

Across every tenant we assess, the most serious recurring finding is never a missing security product. It is that nobody in the room can say who holds Global Administrator, and the actual list turns out to include the agency that built the website, a provider replaced two years ago, and somebody who left for a competitor. Checking takes ten minutes, and the answer reorders every other priority you have.

  • In the Microsoft 365 admin center, open Roles and read the Global Administrator list end to end. Every single name should be a current employee you trust, working from a dedicated admin account with multi-factor enforced on it.
  • Then look under Settings for partner relationships. A provider you stopped working with keeps genuine administrative reach into your tenant for as long as that relationship sits there unremoved.
  • Last, find out whose name the domain is registered in. Whoever controls the registrar account decides where your mail is delivered, and no setting inside your tenant overrides that.
  • Almost none of this is anyone acting in bad faith. It is simply what builds up when nobody owns the environment. It remains the largest single exposure most mid-market American companies carry, and it is fast to correct once somebody has actually looked.
Request a free tenant access check
How managed tenancy starts

Roughly four weeks from the first look to a tenant running properly.

The opening step is free and leaves you knowing the real condition of your tenant whether we work together or not.
  1. 1

    Tenant access and posture check

    Day 1, no charge

    We establish who holds administrative roles, whether any old partner relationships are still live, who owns the domain, how far multi-factor actually reaches, where the score sits, and how licensing compares with headcount. The findings come in writing and are yours regardless of what happens next.

  2. 2

    Scope and GDAP grant

    Days 2-5

    We settle how this will work: which parts we own, which stay with your team, how escalation runs, and how often you get reported to. You then approve the delegated access yourself, from your own admin center, with each least-privilege role named in the request.

  3. 3

    Stabilize the tenant

    Weeks 1-3

    Surplus administrative rights come off, dormant accounts and forgotten guests are cleared out, multi-factor and conditional access are enforced properly, mail authentication moves to enforcement, wasted licensing is reclaimed, and the process for arrivals, moves, and departures is written down and running.

  4. 4

    Steady state with monthly evidence

    From week 4

    The ongoing work begins: handling lifecycle changes, applying change control to tenant settings, tracking posture, and issuing the monthly report. Every quarter, administrative roles, the guest population, and the license mix all get reviewed from end to end.

Tenant management FAQ

What US businesses ask before handing over the tenant.

A delegated relationship carrying only the roles the work requires, approved by you from your own admin center and revocable by you at any moment. This is Microsoft current partner access model: every role is named, every grant expires, and every action we take is attributable to a specific engineer in your audit log. We never ask for a shared Global Administrator account, and we would encourage you to refuse any provider who does. Your own Global Administrator access stays entirely yours. We operate beside it, never in place of it.

No, and this is one of our most common arrangements. The split usually runs like this: your person keeps user support, devices, and daily requests, while we take tenant governance, security posture, licensing strategy, and the monthly reporting, and act as their route into Microsoft when something needs escalating. The boundaries get written down at the start so nothing falls into the gap between two owners. Internal IT staff generally welcome it, because it lifts away the parts of the role they never get time to do properly and get blamed for when they go wrong.

Reselling is a billing relationship: somebody sells you licenses and sends an invoice. Managing the tenant is an operational one: somebody keeps the environment healthy. Plenty of American companies buy through a reseller who does nothing beyond invoicing, and their tenant drifts exactly as though no partner existed. You are welcome to take the management from us and leave your licensing where it is. Most clients eventually consolidate both, simply because one accountable partner is easier than two.

A written health report each month: which way the score moved and why, how licensing compares against current headcount, what changed among administrative roles, the state of guest accounts, a summary of risky sign-ins, where backup and retention stand, which Message Center changes we applied or deliberately deferred, and every open item with an owner beside it. Behind that sits the standing work: handling arrivals, moves and departures, applying change control to configuration, and a deep quarterly review of roles, guests, and licensing. The report is written for management rather than engineers, and it doubles as your evidence pack when an assessor or a carrier asks what controls you run.

Directly, because those three processes ask the same tenant-level questions: is MFA enforced everywhere, who has admin access and why, how are leavers offboarded, how long are audit logs retained, and who outside the company can reach your data. A managed tenant answers each from a document that already exists. For HIPAA-covered organizations, Microsoft offers a Business Associate Agreement covering Microsoft 365 services; our job is configuring the tenant controls, access governance, audit logging, and retention that make your side of that agreement real. We are an IT services firm, not a law firm or an auditor, so your compliance advisors own the interpretation; we own the controls and the evidence.

Handle consumer data in California, Colorado, Virginia, or any of the other states that now have comprehensive privacy statutes, and a large share of that data is sitting in this tenant. The obligations are practical rather than abstract: knowing where personal data actually lives, controlling who can reach it including external guests and providers you no longer use, retention that matches the policy you published instead of keeping everything indefinitely, and the ability to locate, produce, or delete one person data when a rights request lands with a clock on it. We set up retention, access governance, and audit logging so those duties are operational rather than aspirational text in a policy nobody could execute under time pressure.

Carefully, and in a specific order. First establish and verify your own administrative access. Then inventory everything the outgoing partner controls: delegated relationships, administrator accounts, the registrar, DNS, and any licensing billed through them. Only then remove access, without severing your own license supply or breaking mail flow in the process. Done in the wrong order you can lose the domain or find your subscriptions canceled. It happens often enough that we keep a dedicated page on it. The work is straightforward while the relationship is cordial and markedly harder once a dispute has begun, so if things are heading that way, secure access first and argue afterwards.

For most mid-market tenants the answer is two to four, each on a dedicated account separate from the mailbox that person reads email in, each protected by phishing-resistant multi-factor, plus one tested emergency account held somewhere secure. Everybody else belongs on a narrower role scoped to what they actually do, whether that is Exchange, user management, or help desk. Tenants routinely arrive with five to ten, a list that includes former staff and outside vendors, which means a single compromised mailbox becomes a compromised company. Shortening that list is usually the highest-value change of the first month.

Yes. Groups with multiple operating companies are one of the four client shapes we build around. Where each entity has its own tenant, we run them centrally through Microsoft 365 Lighthouse with identical baselines and reporting split per company, so an auditor or an acquirer looking at one entity gets answers about that entity alone. Where the group shares a single tenant, we put in the governance that makes cohabitation safe: separated administrative scopes, data boundaries per entity as far as the platform supports them, and a frank recommendation about when a shared tenant genuinely ought to be split. Collaboration across the boundary runs through cross-tenant sync and shared channels.

The ongoing service suits companies from around ten seats up to a few hundred, which is exactly where the gap is widest: large enough that the tenant genuinely matters, too small to justify hiring a full-time Microsoft 365 administrator. Smaller than that and we would usually steer you toward a one-off build or security baseline with an annual review rather than monthly management, and we will say so on the call rather than sell you something you do not need. Larger, and we work as a specialist function beside your internal department. The honest test has nothing to do with size: does anybody at your company read the Message Center and the Secure Score each month. If the answer is no, the tenant is unmanaged.

Occasionally it is, and reading your scope document beats paying twice. In practice most managed services contracts cover devices, the network, and user support, and treat Microsoft 365 as resetting passwords and creating accounts. The disciplines described on this page, tracking posture, governing licensing, evidencing lifecycle, controlling guests, and applying change control, are usually nowhere in the document. That is why tenants under an existing provider still fail their first serious audit or insurance assessment. Ask yours for last month tenant health report. If one arrives, you are covered. If the room goes quiet, you have your answer. We are entirely comfortable running this alongside an incumbent provider with the boundaries written down.

The dangerous items close quickly. Surplus administrative rights, dormant accounts, missing multi-factor, and lingering access from a previous provider are usually gone within two or three weeks. Licensing savings land at the next billing cycle. The slower arc, meaning a score that holds at a good level, a clean guest population, a lifecycle process with evidence behind it, and retention that matches your stated policy, takes roughly a quarter of steady running. We sequence entirely by risk: anything that could cost you the tenant or your money is fixed first, and cosmetic score points come last. The full plan with dates appears in your first monthly report.
Related Microsoft services

Where to go next.

Microsoft 365 Administration

The day-to-day admin layer: users, mailboxes, Teams, and SharePoint operations under one accountable team.

Learn more

Tenant Security Baseline

The written hardening standard we apply and re-check: identity, mail, sharing, devices, monitoring, and data.

Learn more

Microsoft 365 Services

The wider Microsoft 365 practice, covering build, migration, the applications themselves, and everyday support.

Learn more
Ready for a tenant with an owner?

Start with the free tenant access and posture check.

Give us the domain and we will run the check: who holds administrative rights over your tenant right now, where the score and the licensing sit, and the three changes worth making first. The findings arrive in writing whether or not anything follows. If the tenant turns out to be in good order, you will hear that too.

Request the free tenant checkSee Microsoft 365 services

Related Services

Explore more solutions that work great with this service

M365 Administration

Expert Microsoft 365 tenant management

Learn more

Microsoft Entra

Identity and access management solutions

Learn more

Microsoft Intune

Device management and endpoint security

Learn more

Microsoft Defender

Advanced endpoint and email threat protection

Learn more

M365 Tenant Setup

New tenants configured securely from day one

Learn more

Tenant Security Baseline

Documented controls mapped to CIS

Learn more
GR IT SERVICES

IT services for US businesses,
delivering enterprise-grade solutions
remotely, coast to coast.

Microsoft CSP PartnerApple Jamf PartnerCISGuard

Microsoft 365

  • Microsoft 365 Administration
  • M365 Reporting & Auditing
  • Microsoft 365 Licensing
  • Microsoft Copilot
  • Microsoft 365 Apps
  • Windows 365 Cloud PC
  • Microsoft SharePoint
  • Outlook & Exchange

Security

  • Microsoft Defender
  • Microsoft Purview
  • Microsoft Intune
  • Microsoft Entra
  • Compliance Manager
  • Cybersecurity Audits
  • Copilot for Security
  • Microsoft Sentinel
  • Microsoft Priva

Infrastructure

  • Google Workspace
  • Cloud Migration Services
  • Data Analytics & BI
  • Active Directory
  • Server Management
  • Apple Business
  • Apple Jamf Pro
  • IP Telephone
  • Data Backup
  • Website Development

IT Services

  • Managed IT Services
  • IT Support USA
  • IT AMC USA
  • New Office IT Setup
  • IT Relocation
  • Remote IT Support
  • On-Call IT Support
  • Startup IT Business Kit
  • Disaster Recovery & BC

Company

  • About Us
  • Careers
  • Contact
  • Blog

Contact

  • hello@gritservices.io
  • gritservices.io

© 2026 GR IT Services. All rights reserved.

Privacy PolicyTerms of UseCookie PolicyCCPA/CPRA