- When the only global administrators on a Microsoft 365 tenant belong to your IT provider, ending the relationship can leave you unable to create users or recover access.
- Microsoft's domain-ownership verification, proven via a specific DNS change, is a real route to re-establishing administrative control of a tenant.
- Whether you're billed directly by Microsoft or through a reseller (CSP) determines which levers you have to recover ownership in a dispute.
- Keeping two or three internal global admins on dedicated accounts with their own MFA prevents any single party from holding you hostage.
In late April, a healthcare organization came to us with a problem that should never happen: their former IT provider held the only global-admin keys to their Microsoft 365 tenant and wouldn't hand them back. A newly hired executive couldn't even get an account created. "They hold the global admin keys, and they refused," was how it was described to us. The company was effectively locked out of its own systems.
How a business loses control of its own tenant
It happens quietly. A small business hands IT to a provider, and over time the only global administrators, the accounts that can do anything in Microsoft 365, belong to that provider's staff. As long as the relationship is good, nobody notices. When it sours, the company discovers it can't create users, reset access, or recover anything, because it never held the master keys to begin with.
Getting back in
There is a path back. Microsoft has a process to verify domain ownership: you prove you control the company's domain by making a specific DNS change, which can re-establish your administrative control. It's not instant, and end-user support tickets can stall, but it's a real route, and it often moves faster through proper partner channels.
One detail that changes your options: whether you're billed directly by Microsoft or through a reseller. Direct billing and reseller (CSP) arrangements give you different levers for recovering ownership, which is worth knowing before a dispute, not during one.
Worth stating plainly: a billing or contract dispute does not give anyone the right to lock you out of your own environment. Withholding administrative access is not a valid remedy, and in a regulated field like healthcare it adds real legal and compliance pressure on top of the operational mess.
Set it up so it can't happen again
Once you're back in control, structure administration so you're never hostage to one party:
- Keep at least two or three internal global administrators, on dedicated admin accounts.
- Use separate service accounts for administration, each with its own MFA, instead of granting admin rights on an executive's everyday personal account.
- Make verifying admin custody a standard step whenever you change IT providers.
The simplest insurance is a question to ask any current or prospective IT provider: "If we parted ways tomorrow, who holds the global-admin accounts, and how do we get them?" If the answer is fuzzy, that's the work to do now, while everyone's still friendly.
If you're not sure who actually holds the keys to your Microsoft 365 tenant, or you're heading for a provider change and want a clean handoff, we can help you verify and reclaim control. Let's talk it through.