During a busy Microsoft 365 migration, giving the support partner several admin roles may be a sensible way to get work done. Six months later, the migration is closed, a different engineer handles support, and the same permissions may still be available. A short access review lets a Malaysian SME keep support moving while making it clear who can change what.
Start with the work the provider actually does
Put the service agreement and the access list side by side. Ask the provider to name the tasks it performs each month, the systems involved and the roles those tasks need. Separate routine jobs, such as resetting passwords for eligible users, from changes that affect the whole company, such as rewriting sign-in policies. For each high-impact task, agree who can request it, who approves it and how the provider records the change.
Hypothetical example: a 35-person distributor in Penang finished moving its mail to Microsoft 365. The partner still handles mailbox support and basic account issues. Before removing migration-era roles, the owner asks the provider to demonstrate that it can still investigate a mail delivery problem and handle an ordinary password reset using the proposed access. The owner also agrees who will approve temporary permissions if a future project needs more.
Check each route into the environment
For Microsoft 365, start with Settings → Partner relationships in the admin center. Microsoft’s customer guidance explains how to inspect and remove partner admin roles. Granular delegated admin privileges (GDAP) let participating partners request particular roles for a defined period. Record the role set and expiry, and confirm whether automatic extension applies before assuming that a date on the screen will end access. Ask the partner which staff groups can use the granted roles.
Then check the paths outside that screen. A vendor may have a named account or guest account in your directory, access through a remote management agent, an account on a firewall, or an application identity used for backups. These routes can remain available independently of a partner relationship. Record each route, its owner, what it can reach, its last verified use and the decision to keep, narrow or remove it. Keep passwords and recovery codes out of the inventory.
Ask for evidence you can review
The joint advisory AA22-131A, issued on 11 May 2022, recommends measures including multifactor authentication, least privilege and logging for provider access. Turn that guidance into concrete evidence: ask the provider to show how an approved ticket connects to the identity that acted, the system it changed and the time of the change. Confirm which records the customer can see, how long they remain available and who investigates an unexpected sign-in.
Where people administer systems, prefer individually attributable access with appropriate MFA. For applications and automation, ask who owns the identity, what it can do and how its credentials or certificates are managed. A remote tool used across the estate deserves particular attention: clarify which devices it can reach, who authorises changes and how you would suspend access if the tool or provider account were suspected of compromise.
Make changes with a support test
Agree a change window for permission reductions that could affect daily work. Before the change, make sure the business still controls its own administrative access and has a workable emergency route. After the change, ask the provider to complete one representative support task and confirm that an action requiring the removed privilege is denied. For a backup or integration identity, confirm that the actual job succeeds on its next run. Record the result and the person who accepted it.
Microsoft distinguishes removing a partner’s admin roles from ending its commercial relationship. A supplier may continue to act as a reseller after its admin roles are removed. When a contract ends, check billing, delegated roles, direct accounts, agents and application access separately. Obtain the records and configuration exports you need before closing the final route, and agree who will own support afterwards.
Keep the review small enough to repeat
Start with your most important service and its highest privilege route. Give each exception an owner, a business reason and a review date. Repeat the check after a migration, a provider change or a change in support scope. At the next service meeting, ask for one new example of a support action that can be traced from the ticket to the change record.
If you are reviewing who can administer your systems and what support depends on that access, contact AXO Technologies to discuss where to start.
Sources and dates
Published 7 November 2026. Sources accessed 7 November 2026.
- CISA and partner agencies: Protecting Against Cyber Threats to Managed Service Providers and their Customers — joint advisory dated 11 May 2022.
- Microsoft Learn: Introduction to granular delegated admin privileges — role scope and duration.
- Microsoft Learn: Manage Microsoft-certified solution provider partner relationships — customer admin center and role removal.