Why a former partner often still has access
An IT partner that manages your Microsoft 365 needs rights in your tenant to do so. Often that goes through a partner relationship: the partner signs in with their own account and manages all their customers from there. On top of that, many partners create their own admin account in your tenant, connect their management and backup tools, and set their own phone as the second step for MFA.
When you switch, usually only the new partner is added. The old rights stay. That seems harmless, because the previous partner no longer does anything with them. But the risk lies elsewhere. A partner manages dozens or hundreds of customers. If that partner is hacked, the attacker can use those rights to get into your tenant as well. And someone who has left the previous partner may still know the password of an admin account in your tenant.
Step 1: see which partners are in your tenant
Sign in to the Microsoft 365 admin center with an account that has admin rights and go to Settings > Partner relationships. For each partner you see what kind of relationship it is:
- Reseller: the partner supplies and invoices your licences. That alone gives no admin rights.
- Delegated admin rights (GDAP): the partner may manage your tenant with their own accounts, using the roles you approved. A GDAP relationship has an end date, at most two years, but can be set to extend automatically.
Older relationships often gave a partner full admin rights with no end date. That is why Microsoft moved to GDAP, with separate roles and a fixed term. If you see a partner you do not know (any more), or a partner with more rights than needed, write it down.
Step 2: remove rights that are no longer needed
Select the partner you no longer use, choose Remove roles and confirm. From then on, that partner’s people can no longer manage your tenant. You and the partner both get a confirmation by email.
Keep two things in mind. Removing roles ends admin access, but not the reseller relationship. If your licences still run through the old partner, they keep working. You cannot end the reseller relationship yourself; the partner does that after the licences have been transferred or cancelled. So arrange that separately when you switch. And never remove the rights of the partner that currently manages your IT without agreeing it with them first.
Step 3: look beyond the partner page
The partner page only shows partner relationships. A former partner can get in in other ways too. So also check these points:
- Admin accounts: under Roles, see which accounts are administrators. Accounts such as admin@ or one named after the previous partner no longer belong there. Disable them, or change the password if you keep using the account yourself. See also why you want separate admin accounts.
- MFA on the admin account: if the second step is on the phone of someone who worked at the previous partner, you do not really control that account. Register MFA on a device that belongs to you.
- Apps from management tools: backup, monitoring and management tools get access to your tenant through an app. Under Enterprise applications, see which apps have rights and remove those for tools that are no longer used. See also app consent in Microsoft 365.
- Guest accounts: staff of the previous partner are sometimes added as guests in Teams or SharePoint. Clean them up as described under guest accounts.
- Outside Microsoft 365: also think of remote access programs on your PCs and the login for your domain name and DNS.
Do not lock yourself out
In small companies, sometimes only the previous partner knows the password of the main administrator. In that case, do not clean everything up at once. First make sure you have a working admin account of your own and a break-glass account that you store safely. Then change the passwords, and only then remove the old access. If you are unsure whether anything was done with the old access, check the audit log to see who signed in when and what changed.
Make it a regular check
This is not a one-off job. Look at the partner relationships and administrators at least once a year, and always when you change IT partner or change the person who handles IT in-house. Include it in your joiner and leaver process. Also ask your current partner which roles they have, why they need them and when the relationship ends.
What Floor ICT does
Floor ICT makes an overview of everyone with admin access to your Microsoft 365: partners, admin accounts, apps and guests. You get a proposal of what can stay and what can go. After your approval we clean up, in the right order, so you are never left without admin access. When you switch to us, we also arrange the licence handover with the previous partner. As your MSP, we only ask for the roles we need for the management we agreed. Who is an administrator of your tenant remains your decision.