Home › Guides

Who really owns your Microsoft 365? How to check (and take it back) when the IT company or the person who set it up is gone

By Greg Mitchell · Squared Away Tech · October 28, 2026

Here’s a question I ask almost every office owner: could you add a new employee’s email account today by yourself? Often the honest answer is “I’d have to call somebody,” and sometimes that somebody is gone.

This week on Microsoft’s own help forums, one business owner explained that their former IT company had been sold twice since they last worked together, yet that company’s old account still held Global Administrator rights over their Microsoft 365. Another said a former admin had left the company and refused to give the admin rights back. A company director wrote that they hadn’t been able to get into their admin console for about two years while Microsoft kept charging them every month.

None of these people were hacked. The keys simply ended up in someone else’s pocket. This guide is about ownership: how to find out who actually controls your Microsoft 365, and how to take it back while it’s still easy. (If your worry is a single admin getting locked out by a lost phone, I covered that in what to do when you’re the only Microsoft 365 admin.)

Why ownership matters more than most owners think

Your Microsoft 365 “tenant” is your company’s whole setup: mailboxes, files, calendars and your web domain. Whoever holds the Global Administrator role can reset anyone’s password, read any mailbox, add or remove users, and change your domain settings. That role should belong to your business, not to a vendor you stopped paying, a bookkeeper who moved away, or a volunteer who quit the board.

Leftover admin access causes two problems. One is security: an old account nobody watches is exactly what attackers look for, and if a former IT company is breached, its access to you goes with it. The other is practical: when something breaks, you can’t fix it, cancel it, or easily prove it’s yours.

Step 1: Find out who your Global Admins are

1. Sign in at admin.microsoft.com with the account you think is an admin. If you get a message saying you don’t have permission, you’re not one, and that’s your first answer.
2. Go to Roles, then Role assignments, and open Global Administrator.
3. Write down every account listed. Next to each one, note who it belongs to today and whether that person still works with you.

Watch for generic names like admin@ or support@, and accounts named after an IT company. Those are often vendor logins nobody remembers.

Step 2: Check for old IT company relationships

An IT provider doesn’t always need a named account in your tenant. If they resell your licenses or manage you through Microsoft’s partner program, they may have delegated admin access that doesn’t show up as a regular user.

1. In the admin center, go to Settings, then Partner relationships.
2. Review every partner listed and the roles next to their name.
3. For any company you no longer work with, select it and choose Remove roles, then confirm.

Two cautions. First, make sure you have a working admin account of your own before you remove anyone. Second, removing roles doesn’t always end the billing side of the relationship. If that partner bills you for licenses, talk to them about moving the subscription before you cut ties.

Step 3: Clean up after someone who left

When an office manager, family member or volunteer who set things up moves on, do this the same week:

• Add a current, trusted person as a second Global Admin on their own account.
• Remove the departed person’s admin role, then block or convert their account.
• Check that their personal cell phone or personal email isn’t a sign-in or recovery method on any admin account.
• Update the billing and technical contact emails so Microsoft’s notices come to you, not to their old inbox.

If a former admin won’t hand access back, don’t argue with them by email. As long as you still have one working admin, you can remove their role yourself. If you don’t, skip ahead to Step 6.

Step 4: Write down your tenant name and who pays

Two facts make every future problem easier to solve, and most owners don’t know either one.

• Your .onmicrosoft.com name. Every tenant has a built-in address like yourcompany.onmicrosoft.com. You’ll find it under Settings, then Domains. Microsoft uses it to identify your tenant.
• Who and what pays. Under Billing, check your subscriptions and payment method. Is it a company card, someone’s personal card, or an invoice from an IT company? If the card belongs to a person who left, that’s a lockout waiting for an expiration date.

Put both on a one-page “keys” sheet with your admin list and domain registrar login, and keep it somewhere safe.

Step 5: Make sure your admins can still sign in after 2027

Microsoft has announced that it will retire its built-in text-message and voice-call sign-in codes. According to Microsoft’s retirement notice, that happens on February 1, 2027 for most users and on July 1, 2027 for Global Administrators. After those dates, someone whose only method is a text code will be required to set up a passkey before they can keep signing in.

For admins, I recommend Microsoft Authenticator plus a passkey or a hardware security key, and making sure your two admins don’t depend on the same phone or the same single method. Each person can check theirs at mysignins.microsoft.com under Security info.

Step 6: If nobody can sign in at all

If every admin is gone or locked out, you can still get your tenant back. It just takes time and paperwork.

1. Figure out who sells you the service. A Microsoft charge on your card usually means you bought directly. An invoice from an IT company means a partner may be able to reset access for you.
2. Contact Microsoft support and ask for tenant recovery. Microsoft’s guidance says it uses a high-assurance identity check to confirm ownership, then restores access to your existing tenant rather than creating a new one.
3. Be ready to prove you own the domain. Support may ask you to add a specific TXT record in your domain’s DNS settings, so make sure you can sign in at your registrar (GoDaddy, Porkbun, Network Solutions and so on).
4. Have your documents ready: your .onmicrosoft.com name, the domain, recent bills or the last digits of the paying card, and business registration papers such as your Florida Sunbiz record.

Keep every case number, and never pay anyone who calls offering a back door. That’s a scam aimed at people in exactly this spot.

What I see in local offices

Around Bradenton, Sarasota and Lakewood Ranch, plenty of offices have changed IT providers once or twice, or had a relative or office manager set up email years ago. Medical and dental practices (see Microsoft 365 security for dental and medical offices), law firms, churches and HOAs from Parrish to Venice are especially likely to have a former volunteer or vendor still holding the keys. For other leftover settings worth checking, see signs your Microsoft 365 tenant isn’t locked down.

FAQ

How do I find out who the Global Administrators are on our Microsoft 365?

In admin.microsoft.com, go to Roles, then Role assignments, and open Global Administrator. Also check Settings, then Partner relationships, because an IT company with delegated admin access may not appear as a named user.

Our old IT company still has admin access. Is that a problem?

Yes, if you no longer work with them. Global Administrator access lets them reset passwords, read mailboxes and change your domain settings. Confirm you have your own working admin account first, then remove their partner roles and any leftover accounts they created.

We are being billed for Microsoft 365 but nobody can sign in. What can we do?

Find out who bills you. A Microsoft charge on your card usually means you bought directly; an invoice from an IT company means a partner, who may be able to help. If nobody can sign in, contact Microsoft support and ask for tenant recovery.

How do I prove to Microsoft that we own our tenant?

Have your .onmicrosoft.com name, domain, billing records and business registration documents ready, plus access to your domain’s DNS settings. Microsoft may ask you to add a specific TXT record to your domain.

Are text-message sign-in codes going away in Microsoft 365?

Microsoft will retire its built-in text and voice codes on February 1, 2027 for most users and on July 1, 2027 for Global Administrators. Admins relying on text codes alone should move to Microsoft Authenticator, a passkey or a security key well before then.

Squared Away Tech serves offices of 5 to 100 people in the Tampa Bay and Sarasota area (Bradenton, Sarasota, Tampa, Ellenton, Lakewood Ranch, St. Petersburg, Palmetto, Venice and Parrish), serving small offices across Florida, and remotely anywhere in the U.S. Mon–Fri 5–9 PM and Sat 9 AM–5 PM (Eastern Time). Daytime and Sunday appointments available on request; daytime calls get a same-evening callback. Back to the home page · More guides

This guide is general information, not legal or insurance advice. Every office’s setup is different.