# Who should own your Microsoft 365 tenant

> How a small business should set up admin accounts, emergency access, partner access and billing in Microsoft 365, and what to check before a migration.

Source: https://ali.id.au/blog/who-should-own-your-microsoft-365-tenant/ (last edited 2026-10-17)

Whoever signs up for Microsoft 365 becomes its first Global Administrator: every password, purchasing and the domains ([roles](https://learn.microsoft.com/microsoft-365/admin/add-users/about-admin-roles)). If that's one person's account and they leave, the business can lose its own email and files.

## Separate admin accounts

Everyone who administers the tenant gets two accounts: an everyday one, and an admin one. Admin happens in the same browser you read email and browse in, so there's plenty of room for mischief. Microsoft [agrees](https://learn.microsoft.com/microsoft-365/admin/security-and-compliance/m365b-account-security-admins).

- **No partial admin on everyday accounts.** Menus come and go and it gets confusing. Helpers get the narrowest role that does the job, such as Password Administrator ([guidelines](https://learn.microsoft.com/microsoft-365/admin/add-users/about-admin-roles#security-guidelines-for-assigning-roles)).
- **Fewer than five Global Administrators** ([Microsoft](https://learn.microsoft.com/entra/identity/role-based-access-control/best-practices#5-limit-the-number-of-global-administrators-to-less-than-5)).
- **Not admin@.** It's the first name a password spray tries. Pick a name that doesn't say "admin" at all.
- **No shared logins.** Multifactor authentication (MFA) makes them impractical, and named accounts make the audit log mean something.
- **Licences are optional.** Admin-only accounts don't need one. A cheap licence with a mailbox is handy, though: the admin account gets alerts and can forward them to you. Without one, set an alternate email on each admin account so alerts reach an inbox you read.
- A [separate browser profile](/blog/chrome-switcher/) keeps the admin sign-in handy without staying signed in.

## Two break-glass accounts

Keep [two emergency access accounts](https://learn.microsoft.com/entra/identity/role-based-access-control/security-emergency-access) with Global Administrator for the day nobody can sign in, such as when the last admin leaves.

- Cloud-only, on `.onmicrosoft.com`.
- Not tied to one person or phone.
- A FIDO2 security key, different from your everyday admin method.
- Excluded from Conditional Access policies that block sign-in.
- Credentials in separate safe places more than one trusted person can reach.
- Tested every 90 days, and whenever someone with access leaves.

Microsoft's small business page still says no MFA and a long password. The Entra page now says a FIDO2 key or certificate-based authentication, which will meet the [mandatory MFA](https://learn.microsoft.com/entra/identity/authentication/concept-mandatory-multifactor-authentication) Microsoft starts enforcing on its admin portals later this year. Follow Entra.

## Partners, billing and the domain

A good partner is often the right call for the work. Hand them the hard jobs, such as moving to a new tenant: they do it every day, and what you'd learn goes stale almost at once.

Still hold your own keys:

- **Check partner access** under Settings > [Partner relationships](https://learn.microsoft.com/microsoft-365/commerce/review-partner-admin-privileges). Old relationships may still carry Global Administrator; granular delegated admin privileges (GDAP) replace them with specific, expiring roles.
- **Removing roles doesn't stop purchasing.** The partner can still buy for you until they turn it off in Partner Center.
- **Keep your own Global Administrator.** Only a Global Administrator can see subscriptions a partner bought.
- **The domain.** The business should be the registrant, on a registrar account it controls. A lot of scams target domains, such as fake renewal invoices and transfer notices. If the business can't be relied on to renew on time and spot those, turn on auto-renew and add a partner you trust as a manager on the account.
- **Billing.** Pay Microsoft directly where you can, so subscriptions and invoices stay in your name if you change partners. Give whoever pays the bills, such as a bookkeeper, the [Billing Administrator](https://learn.microsoft.com/microsoft-365/admin/add-users/about-admin-roles) role, not Global Administrator. Use partners for the work.

## Before you migrate

1. **Do the free [Microsoft Learn](https://learn.microsoft.com/training/) admin courses.** They don't take long.
2. **Buy an hour or two of a consultant** to check your plan.
3. **Pilot** with a few users.
4. **Check [security defaults](https://learn.microsoft.com/entra/fundamentals/security-defaults) are on.** New tenants get them; older ones may not.
5. **Check the audit log is on.** It's meant to be on by default, but Microsoft says to [check it](https://learn.microsoft.com/purview/audit-log-enable-disable) on a new tenant, and you'll want it to see password sprays.
6. **Decide who's local admin on each PC.** Whoever joins a PC to Entra ID becomes its local admin and everyone else who signs in is a standard user, so have IT join them and shared laptops just work. The setting is under [Device settings](https://learn.microsoft.com/entra/identity/devices/manage-device-identities#configure-device-settings); adding support staff as local admin everywhere needs Entra ID P1.
7. **Coming from an on-premises server?** Clean up Active Directory before syncing, and hold off on staff creating Teams until your SharePoint structure is planned.