A former employee still has access to a mailbox. A shared account has no clear owner. An administrator makes a change that affects every user. These are not isolated IT tasks – they are business continuity risks. Effective office 365 tenant management gives an organisation control over the Microsoft cloud environment that holds its email, files, identities, applications and security settings.
For many small and mid-sized businesses, the tenant grows gradually. New users are added quickly, licences are assigned as needs arise, and occasional changes are made by different people over time. The result can be a service that works day to day but has unclear ownership, excessive permissions and avoidable exposure when something goes wrong.
What an Office 365 tenant actually controls
Office 365 is now generally referred to as Microsoft 365, but many organisations still use the earlier name. In either case, the tenant is the organisation’s dedicated Microsoft cloud environment. It is tied to the company domain and provides the central administrative boundary for users, licences, mailboxes, Teams, SharePoint, OneDrive, security policies and connected applications.
A subscription determines which services and features can be used. The tenant determines how those services are configured and governed. That distinction matters. Changing a licence may enable a feature for a user; changing a tenant-wide setting can affect the security or availability of the whole organisation.
A well-managed tenant provides a reliable foundation for daily work. It helps ensure that the right people can access the right systems, former staff cannot continue to access company information, and security controls are applied consistently rather than left to individual judgement.
The areas that need active management
Tenant management is not simply a matter of resetting passwords and purchasing licences. It is an ongoing administrative discipline spanning identity, security, data and operational change.
User lifecycle and access control
Every joiner, mover and leaver should follow a defined process. New starters need an account, the appropriate licence, a secure device setup and access only to the resources required for their role. When a member of staff changes department, old permissions should be reviewed rather than accumulated. When someone leaves, their account, sessions, devices, mailbox handling and file ownership all need attention.
Leaver management is particularly time-sensitive. Disabling sign-in promptly is only one step. The business also needs to decide who receives the mailbox, how long it is retained, whether OneDrive files must be transferred and whether the individual had access to shared mailboxes, Teams, finance systems or third-party applications.
Privileged administrator accounts
Global Administrator access is powerful enough to change security policies, create accounts, reset passwords and alter subscriptions. It should not be treated as a standard working account. Too many organisations have several global administrators because access was granted for convenience, then never removed.
Use the least privilege principle: assign a role that matches the task, and no more. A helpdesk administrator does not necessarily need the ability to alter tenant-wide security settings. Administrator accounts should be individually assigned, protected with multi-factor authentication and reviewed regularly. Shared administrator credentials make accountability difficult and should be avoided.
Licensing and cost control
Licensing is both a technical and commercial issue. Under-licensing can restrict necessary security or compliance features. Over-licensing leaves the business paying for inactive accounts, duplicate licences or functionality that is never used.
A periodic licence review should compare paid licences against active users, role requirements and business plans. It should also identify accounts that are disabled but still licensed, staff with higher-tier licences they no longer require, and shared mailboxes that have been set up incorrectly as paid user accounts. The right licence mix depends on the organisation’s security needs, mobile working arrangements and reliance on Microsoft applications.
Email, collaboration and external sharing
Email remains a primary route for phishing, fraud and accidental disclosure. Tenant settings should support appropriate anti-phishing and anti-spam controls, while allowing genuine business communication to continue. This is not a case of applying the strictest possible setting without consideration. A business that exchanges large files with suppliers or works closely with external partners may need controlled sharing rather than blanket restrictions.
Teams, SharePoint and OneDrive need the same careful approach. External sharing should have a clear purpose, suitable expiry settings where available, and defined ownership. Unmanaged sharing creates copies of confidential information outside the organisation’s direct control. Overly restrictive sharing, however, can encourage staff to use personal file-transfer services instead.
Device management and conditional access
A user account is only as secure as the device and connection used to access it. Where the appropriate Microsoft licensing is in place, device management can enforce screen locks, encryption, supported operating systems and security updates. It can also separate business data from personal data on mobile devices.
Conditional access policies can add further protection by considering factors such as sign-in location, device compliance, application sensitivity and risk indicators. These policies require careful testing. A poorly planned rule can prevent legitimate staff from accessing email when travelling or block a critical line-of-business application. Changes should be documented, tested with a limited group and supported by an emergency access procedure.
A practical operating model for tenant management
The strongest approach is to treat the Microsoft tenant as a managed business system, not a collection of isolated settings. Someone must be accountable for its condition, even where daily administration is outsourced.
A sensible operating model usually includes four controls: a documented onboarding and offboarding process; regular reviews of privileged access and licences; monitored security alerts; and a change record for significant configuration work. These controls are straightforward, but they stop common problems becoming expensive incidents.
The following activities merit a scheduled review:
- Administrator roles, inactive accounts and multi-factor authentication coverage.
- Licence allocation, disabled users and shared mailbox ownership.
- External sharing permissions, guest accounts and unused Teams or Microsoft 365 groups.
- Device compliance, operating system support and lost or retired equipment.
- Security alerts, mailbox forwarding rules and unusual sign-in activity.
The frequency depends on the organisation. A business with frequent staff turnover, sensitive client data or a distributed workforce may need monthly reviews. A stable, small office may work effectively with a quarterly governance review, provided urgent joiner, mover and leaver tasks are handled immediately.
Backup, retention and recovery are separate decisions
Microsoft provides service availability and a range of retention and recovery features, but that does not automatically mean every business has a complete backup strategy. Retention rules are designed to preserve data for defined operational or compliance reasons. Backup is designed to restore data following deletion, corruption, ransomware or an administrative error.
The appropriate arrangement depends on what data the organisation holds, how quickly it must be recovered, and what legal or contractual obligations apply. A company using SharePoint as its central document store will likely require different recovery planning from one using it only for informal collaboration.
Tenant management should therefore include a documented decision on retention, mailbox recovery, SharePoint and OneDrive recovery, and testing. A recovery plan that has never been tested is an assumption, not a control.
When specialist support adds value
Internal administrators often know the business well, but Microsoft 365 changes regularly and security configuration can be complex. External IT support is particularly useful where the person managing the tenant also has operational duties, where there is no formal access process, or where an organisation has experienced growth, a merger or a security concern.
A managed IT partner can provide consistent administration, independent review and a clear escalation route when a risky change or suspected compromise occurs. For organisations across London, Kent and the South East, Cyan IT can support the day-to-day stewardship of Microsoft 365 alongside wider infrastructure, device and cybersecurity management.
The goal is not to make the tenant more complicated. It is to make ownership clear, access controlled and recovery possible when the business needs it most. Start by identifying who has administrative access and who is responsible for each account when a member of staff leaves. Those two answers often reveal the most useful next action.