Outsourcing Microsoft 365 Management: What It Covers and How to Do It Safely

An SME buying Microsoft 365 usually thinks of it as a purchase, not an ongoing job. You pick a plan, assign licences, and the mailboxes and Teams channels show up. What's easy to miss is that someone still has to run the thing: add and remove users as people join and leave, decide who gets which licence, keep the security settings from drifting, and notice when a setting changes that shouldn't have. None of that is optional, and "the cloud manages itself" is exactly the assumption that leaves an ex-employee's mailbox active for six months or a shared Global Administrator password sitting in an old email thread.

Microsoft 365 management is this ongoing administrative layer, distinct from both the licence you pay for and the help desk that answers "Outlook won't open." It's also a genuine outsourcing decision in its own right, with a mechanism built into Microsoft 365 specifically for it, worth understanding before you hand it to anyone — including your own IT person.

What Microsoft 365 management actually covers

Strip away the marketing and the job breaks into a handful of recurring tasks, each tied to a specific administrator role Microsoft 365 defines for exactly that purpose:

• User lifecycle. Creating accounts for new starters, disabling or removing them when someone leaves, and keeping group memberships current. Microsoft's own admin-role documentation assigns this to the User Administrator role, which can create, disable or enable accounts and manage most user properties.
• Licence allocation. Assigning the right plan to the right person and reclaiming a licence the moment someone leaves, rather than letting it quietly keep renewing. This is the License Administrator role's job: assigning and removing licences and correcting usage location.
• Mailbox and platform settings. Exchange Online mailbox rules, Microsoft 365 Groups, and recovering deleted items sit with the Exchange Administrator role; SharePoint site collections and settings sit with the SharePoint Administrator role.
• The security baseline. Multi-factor authentication, sign-in policies and who holds administrative power in the first place. We cover the mechanics of setting this up in our guide to [configuring MFA in Microsoft 365](/articles/microsoft-365-mfa-setup-guide); this article is about who should hold the keys to change it, not how to turn it on.
• Everyday password and access requests. Resetting a forgotten password or unblocking a sign-in is routine enough that Microsoft gives it its own narrower role, Helpdesk Administrator, rather than requiring a full administrator for it.

None of this needs a full-time person at a typical SME's scale, but it does need to be someone's clearly assigned job. The most common failure isn't incompetence — it's that nobody owns it, so it only gets touched when something already broke.

In-house, outsourced, or split — and why this decision is narrower than it looks

This is a smaller decision than "should we outsource our IT support," which our guide to IT help desk outsourcing covers in full, including the in-house, outsourced and hybrid shapes that decision usually takes. Microsoft 365 administration is one layer of that broader question: a business can run its own help desk while still handing tenant administration to a partner, because the skill involved — knowing the admin center, the roles, and the security settings — is specific and doesn't demand knowing your line-of-business software the way day-to-day support does.

In practice, most SMEs without a dedicated IT department outsource this layer even when they keep informal day-to-day support in-house, simply because nobody internal is checking the admin center's security recommendations every month, and a partner managing dozens of tenants is.

How outsourcing actually works: delegated administration

Microsoft 365 has a specific, named mechanism for this, and it's worth knowing before you agree to anything with a provider. Microsoft calls it delegated administration: a Microsoft partner sends your organisation an email requesting permission to act as an administrator on your behalf, and your organisation authorises it through the admin center rather than by handing over a password.

Crucially, a delegated partner isn't given free rein — Microsoft restricts delegated partners to exactly two roles, and the difference between them matters a great deal:

• Full Administration gives the partner broad privileges: managing user accounts, licences, domains and subscriptions, configuring security settings and password policies, and access to Exchange Online and SharePoint Online data.
• Limited Administration is deliberately narrower: creating and modifying user accounts, resetting passwords, managing group memberships, and viewing service health and support tickets — with no access to domains, subscriptions or security settings.

A provider that defaults every client to Full Administration without being asked is choosing convenience over your security, not following a Microsoft requirement. Microsoft's own guidance for administrator roles generally — delegated or not — is to assign the fewest permissions needed, and to limit how many people hold Global Administrator access, since a Global Administrator has almost unlimited access to your organisation's settings and data. For a routine task like resetting passwords, Microsoft explicitly recommends a narrower role such as Password Administrator or Helpdesk Administrator instead of full administrative access, and it recommends requiring multi-factor authentication for every administrator account, including the provider's own.

What to ask a provider before you hand over access

Microsoft's own best-practice advice for delegated administration, written for the partners granted it, is a useful checklist to turn around and ask your own provider about: do they plan administrator roles deliberately, matched to what each person on their side actually needs to do for you, rather than issuing Full Administration by default? Do they document and audit who holds which role and revisit it over time rather than letting it go stale? And did you, as the customer, actually see and approve that role design, rather than just clicking "yes" on an authorisation email?

A provider with good answers to those questions is managing your tenant deliberately. One that can't tell you which role their technicians hold in your environment is asking you to trust them on faith with data and settings you can't see into yourself.

What happens if you switch providers

This is where Microsoft 365 management connects directly to a bigger risk: vendor lock-in. Delegated administration is revocable — you can remove a partner's access through the admin center at any time — but only if you know it's there to remove. The person who originally purchased your Microsoft 365 subscription becomes a Global Administrator automatically, and it's worth checking, before any switch, exactly who that is, which accounts your current provider holds Global Administrator or Full Administration rights on, and whether any of those accounts belong to someone who'll be unreachable the day you want to leave. Settle this on the way in, in your contract, not on the way out while a handover is already underway.

Licence cost and management cost are two separate bills

Microsoft's own published prices for its main Business plans (per user per month, billed annually, excluding VAT, checked this October) are Business Basic at €6.07, Business Standard with Copilot at €20.36, and Business Premium with Copilot — which, unlike the two lower tiers, bundles in Microsoft Entra ID and Intune — at €27.73. These change over time, so treat them as a snapshot and check Microsoft's own pricing page for the current rate before budgeting.

What that licence price doesn't include is anyone's time spent managing the tenant. Outsourced Microsoft 365 management is rarely billed as a separate line item — it's usually folded into a broader per-workplace managed IT fee, which our guide to what IT management costs per workplace breaks down in detail. If a quote separates "Microsoft 365 licences" from "IT management" without saying which one covers tenant administration, ask directly — it's a common place for scope to quietly fall through the gap between the two.

FAQ

What does a Microsoft 365 administrator actually do? User accounts and licences, mailbox and SharePoint settings, and the security baseline — MFA, sign-in policies, who holds administrative access. Microsoft 365 splits this into specific named roles rather than one all-or-nothing job, which is exactly what makes it possible to delegate safely.

Can we outsource Microsoft 365 management without giving a provider full access? Yes. Microsoft's delegated-administration model offers a Limited Administration role specifically for this, and a provider can also be assigned narrower individual roles like Helpdesk Administrator or User Administrator instead of Global Administrator. If a provider insists full access is the only option, that's their default, not a technical requirement.

Is managing Microsoft 365 the same as our IT help desk? No. A help desk answers "why won't this open," which our guide to IT help desk outsourcing covers separately. Tenant management is the administrative layer underneath — who can change security settings, who holds which licence, who still has an account after leaving.

Do we need a dedicated Microsoft 365 administrator at a small company? Not a full-time one at typical SME scale, but the work still needs a named owner, whether that's someone internal with a clearly understood responsibility or a provider under delegated administration. The usual failure is nobody owning it, not the wrong person owning it.

What should we check before signing a management contract? Which admin role the provider will actually hold (ask for the name, not just "we'll have access"), whether that access is documented and reviewed over time, and how you'll revoke it cleanly if you ever switch providers.

Treat tenant administration as infrastructure, not an afterthought

Microsoft 365 management is invisible right up until it isn't — until an account that should have been disabled months ago gets used for something it shouldn't, or a provider relationship ends and nobody can say who still has access to what. Our managed IT support team sets up delegated administration with the least access that does the job, documents it so you can see it yourself, and reviews it on a schedule rather than leaving it to drift; our cloud infrastructure and cybersecurity & identity teams cover the platform and security-baseline work that sits next to it.