Operate retainer
Ten hours a month on a tenant I know.
After a fixed engagement closes, I keep the tenant current: changes, reviews and questions on what I built or reviewed, across Entra, Exchange, Teams, SharePoint, OneDrive and Intune. Every change has an owner, an approval path and a record.
- Change reference
- Requestor
- Business owner
- Client approver
- Operator
- Workload
- Classification
- Requested window
- Role required
- Licence dependency
- For
- A client in the month after a fixed engagement closes.
- What you buy
- Ten hours a month. Unused hours do not roll over.
- Who does it
- Michal Jatczak, with no subcontractors.
- Terms
- No minimum term, 30 days' notice on either side, no response time promised.
You leave with
Every artefact answers a practical question: who owns the service, who may approve the change, which role was used, what changed, how it was verified, and what remains open.
Tenant operating baseline
In-scope workloads, owners, authoritative sources, current state, known exceptions, dependencies, and the ranked operating backlog.
Admin and delegated-access register
Named identities, roles, assignment type, GDAP relationship, PIM requirement, approver, purpose, expiry, and review result.
Change and exception ledger
Request, owner, authority, role used, before and after state, reversal path, verification, evidence, residual risk, and review date.
Ten operating runbooks
Human-readable procedures for identity lifecycle, licences, guests, sharing, Microsoft changes, emergency access, and transfer-out.
Exit Kit
Current owners, access removal, baselines, registers, runbooks, open work, evidence locations, and successor-provider handover.
The other records in the pack
Service ownership matrix
Workload, business owner, technical owner, approver, escalation route, support dependency, and communication audience.
TENANT-SERVICE-REGISTER.mdLicence decision ledger
Assignment method, business need, usage evidence when available, exception, renewal dependency, decision owner, and next review.
LICENCE-ASSIGNMENT-LEDGER.mdMicrosoft change and health record
Message center items, Service health incidents, affected services, required actions, stakeholder updates, support cases, and closure notes.
MICROSOFT-CHANGE-AND-HEALTH-LOG.md
The ten runbooks, by name
- Joiner provisioning
- Mover and role change
- Leaver offboarding
- Licence assignment change
- Guest and sponsor review
- External-sharing change
- Microsoft service incident
- Message center impact
- Emergency-access validation
- Provider transfer-out
What the ten hours cover
Operate usually follows one of these. What the hours usually go on depends on the work that came before it.
After tenant hardening
Policy reviews, new joiners and exceptions, kept against the baseline.
After detection and response
Reviews of the tuning ledger and the alerts that keep coming back.
After backup and recovery
The restore drill, run again and written up.
After workflow engineering
Flow maintenance when a connector, a licence or a process changes.
After licensing and renewals
The renewal decisions, made before each renewal fires.
Operate
A tenant that stays the way it was handed over, with a record of every change.
Ten hours a month for changes, reviews and questions on what I built or reviewed. The hours run through one queue, and every change follows the approval path below.
What Operate includes
- One work queue and agreed change windows
- Approved identity lifecycle and routine workload administration
- Licence assignment and exception reconciliation
- Guest, group, site-owner and privileged-access reviews
- Message center impact notes and Service health triage
- Microsoft support case coordination with a kept record
- Drift review against the agreed baseline
- Updated runbooks, the evidence pack and the Exit Kit
No engagement yet?
Operate needs a tenant I know. The first step is tenant hardening, whose handover phase sets up the owners, the admin register and the runbooks Operate keeps current.
Managing a tenant portfolio?
Operate can run across several tenants with one shared standard and separate access, evidence and owners per tenant. The hours are agreed per tenant.
How it runs and what I need from you
Every material change ends with a record of why it was made: who asked, who approved, the role I used, how I checked it and where I recorded it. No response time is promised.
Capture
Record the business need, affected users or services, requestor, desired window, and decision authority.
Assess
Check the current state, required role, licence dependency, user impact, evidence need, and whether the work is standard or project-sized.
Approve
A named client approver accepts the action, window, risk, communications, and reversal approach before production changes begin.
Apply
Execute through the least-privileged role. Use pilot groups or limited rollout where the Microsoft service provides that control.
Verify
Confirm the configuration state and the affected user journey. Reverse or open an exception when the acceptance criteria are not met.
Record
Link the before and after state, operator role, approval, verification, exception, and next review date to the operating record.
What I need from you
- Authoritative HR, identity, asset, licence, and business-owner information
- Named requestors, approvers, risk owners, and communication contacts
- Appropriate Microsoft subscriptions for selected features
- Approved secure access, evidence location, change windows, and user communication
- Your own path for urgent work, because I promise no response time
What is not included
Separate project or provider
Ten hours a month is a retainer for a tenant I know, not an unlimited support promise.
- Unlimited end-user helpdesk, deskside support, or hardware logistics
- 24/7 SOC, MDR, on-call duty, live breach command, forensics, or the decision whether to notify a CSIRT or a data protection authority, which stays with your organisation
- Tenant hardening, Defender deployment, backup, migration or a device baseline, each a project of its own
- Microsoft 365 Copilot rollout, adoption programme, or custom agent implementation
- An audit, certification, regulator approval, legal advice, or a guarantee of Microsoft service availability
Check it before you scope it
The evidence snapshot bundle holds a Secure Score snapshot script, an inactive licensed-user audit script, a failed sign-in KQL query and the permissions guide that goes with them. Nothing writes to the tenant.
The register of information holds the legal entity, data location, sub-processors and exit terms in one block, written to be copied into your own register.
Pricing
The price is given in writing at the handover.
- Billing basis
- Monthly, invoiced in advance. No minimum term, 30 days' notice on either side.
- Hours
- Ten hours a month. Unused hours do not roll over. Work beyond them is quoted in contract days before it starts, without the two-day minimum, and starts only once you accept the quote.
- Currency
- EUR, excluding VAT.
- VAT
- Reverse charge for EU businesses outside Malta whose VAT number validates in VIES. Malta VAT otherwise.
- Invoiced by
- Michal Jatczak, sole trader registered in Malta.
- Service level
- No SLA and no on-call duty. Dates are written into the Statement of Work.
- Licences
- Licences are priced on their own lines, from Pax8's suggested retail, and quoted before anything is committed.See the Microsoft 365 seat price
- Terms
- The signed Statement of Work, and the Terms of Service for everything else.
The detail, if you want it
What the service covers, by workload
The scope follows the tenant, subscriptions, internal ownership, and business dependencies. Workload projects stay separate. Operate covers the routine administration and governance paths explicitly agreed in the service catalogue.
Identity lifecycle
Connect joiner, mover, leaver, guest, group, and administrator work to named business authority.
- User, group, and role ownership register
- Joiner, mover, and leaver paths with exception handling
- Guest sponsor and expiry review coordination
- Routine roles separated from emergency access
- PIM and access reviews where the selected licences support them
Exchange Online
Operate mail changes as controlled production work instead of isolated admin clicks.
- Mailbox, shared mailbox, delegation, and forwarding requests
- Accepted-domain and connector ownership
- Distribution group and mail-enabled group administration
- Transport and organisational setting changes
- Microsoft support escalation with a retained case record
Teams, SharePoint, and OneDrive
Keep collaboration usable while ownership, sharing, and lifecycle remain visible.
- Team and site ownership decisions
- External-sharing and guest-access exceptions
- Orphaned team, group, and site review
- Sharing-link and collaboration setting changes
- Copilot content-discoverability dependencies recorded where relevant
Intune and applications
Coordinate routine device and app administration where Intune is selected in the scope.
- Policy and application assignment requests
- Pilot group and rollout ownership
- Configuration conflict and deployment follow-up
- Exception and temporary exclusion review
- A device baseline is its own engagement, on its own page
Service health and Microsoft change
Distinguish a Microsoft incident from a tenant action, then keep stakeholders working from the same record.
- Service health incident and advisory assessment
- Message center relevance and action review
- Stakeholder communication ownership
- Microsoft support case coordination
- Change calendar and retirement tracking
Licence and service governance
Record why a licence exists, who approved an exception, and when the decision must be revisited.
- Group-based assignment model and direct-assignment exceptions
- Inactive-account and licence reconciliation
- Usage evidence where Microsoft exposes it
- Renewal and service dependency register
- Procurement kept separate from the technical recommendation
How administrative access is held
I do not take the Global Administrator role. The access model separates daily tasks, time-bound privilege, partner delegation, and customer-owned emergency access.
Read-only first
The baseline begins with observation. Credentials, tenant IDs, exports, and administrative data are exchanged only through an approved secure channel after scope approval.
No Global Administrator
I work in the least-privileged role for the task and do not take the Global Administrator role. PIM provides eligible or time-bound role activation where you hold Microsoft Entra ID P2 or Microsoft Entra ID Governance.
Tenant-specific partner access
Where GDAP fits, each tenant grants granular, time-bound, explicitly approved access. Shared administrator accounts and universal credentials are excluded.
Customer-owned emergency access
Emergency-access accounts stay outside normal administration. They remain under client control, are monitored for use, and are validated through a scheduled operating test.
Client decision authority
Tenant-wide consent, data deletion, retention changes, security-control reduction, emergency access changes, and high-impact enforcement require explicit authority from the person named in the scope, given in writing, email included. Where personal data is involved, that authority is your documented instruction (Terms section 14, GDPR Art. 28(3)(a)).
Primary sources
- Overview of the Microsoft 365 admin centerMicrosoft Learn
- Track new and changed features in the Microsoft 365 Message centerMicrosoft Learn
- How to check Microsoft 365 service healthMicrosoft Learn
- About administrator roles in the Microsoft 365 admin centerMicrosoft Learn
- Start using Privileged Identity ManagementMicrosoft Learn
- Introduction to granular delegated admin privileges (GDAP)Microsoft Learn
- Manage emergency access accounts in Microsoft Entra IDMicrosoft Learn
- Overview of Microsoft 365 LighthouseMicrosoft Learn
Do you replace our internal IT team?
No. Operate takes the agreed changes and reviews off your team; business authority and strategic decisions stay with you.
Is Operate an unlimited helpdesk?
No. It is ten hours a month for changes, reviews and questions on a tenant I know. End-user helpdesk and deskside support are not part of it.
What happens to hours we do not use?
They do not roll over. If a month needs more than ten hours, I quote the extra work in contract days, without the two-day minimum, and start it only once you accept the quote.
How fast do you respond?
No response time is promised. For urgent work you keep your own path. A personal data breach in data I process for you is reported to you without undue delay after I become aware of it (Terms section 14, GDPR Art. 33(2)).
Do you make production changes without approval?
Only standard changes we agreed in advance. Every other change follows your approval path, and high-impact actions always need explicit approval.
Do you need Global Administrator?
No. I do not take Global Administrator. I use the least-privileged role for each task, through time-bound GDAP with no auto-extension or an account you create for me. Your emergency access accounts stay with you.
What happens during a Microsoft outage?
I check Service health, tell a Microsoft incident apart from a tenant issue, open the support case where it helps and keep your named contacts updated. I cannot repair Microsoft's service or promise its availability.
Can we start Operate without a fixed engagement first?
Not usually. Operate keeps a documented tenant current, so the first step is tenant hardening.
What remains if we stop Operate?
The baseline, the access register, the change and exception ledger, the licence decisions, the runbooks, the backlog and my access removal confirmed, all in the Exit Kit. When the work ends I delete the copies of your data I hold, unless the law requires me to keep them (Terms section 14). Either party ends it with 30 days' notice. The aim is that your team or another provider can run the tenant without me.
Who does the work?
I do, Michal Jatczak, with no subcontractors. Only I use the access you grant.
Decide who owns the tenant work before the next change arrives.
Operate starts at the handover of a fixed engagement. If I have not worked on your tenant yet, the first step is tenant hardening.
Every consulting engagement ends with an Exit Kit.