We run the operational layer across Microsoft Entra, Exchange Online, Teams, SharePoint, OneDrive, Intune, and the Microsoft 365 admin centre. Every material change receives an owner, authority, verification record, and evidence link.
Essential builds a tenant your own team can operate. Operate includes the mobilisation needed to validate that foundation or build what is missing, then keeps the queue, Microsoft change cycle, access model, and operating evidence current.
Do not send credentials, tenant IDs, administrative exports, recovery codes, or personal data through the public contact form. Scoped access is arranged after approval through a secure channel.
2
Clear service levels
Essential foundation or recurring Operate
10
Named runbooks
Readable operating procedures in the delivery kit
Read-only
First access mode
Observation before production change
Client-owned
Operating record
Decisions, evidence, and handover stay with you
The operational gap
A tenant rarely fails because one portal is missing. It becomes expensive when ownership, authority, exceptions, Microsoft changes, and verification live in different places.
Mailbox permissions, guest access, Teams policies, and licence exceptions arrive as messages. The decision disappears once the request is closed. We move material work into one queue with an owner, authority, verification, and evidence record.
Routine work should not require Global Administrator or a shared account. Roles are mapped to the job, activated only when needed where the tenant supports PIM, and separated per tenant through GDAP when partner access fits.
Message Center posts can affect user experience, policy behaviour, data handling, or feature retirement. We assess relevance, assign an owner, record the action, and connect the change to communication and validation.
Entra, Exchange, Teams, SharePoint, OneDrive, Intune, and the Microsoft 365 admin centre all change independently. A shared baseline and exception ledger make the operating state inspectable.
Operating coverage
The scope follows the tenant, subscriptions, internal ownership, and business dependencies. Workload projects stay separate. Operate covers the routine administration and governance paths explicitly agreed in the service catalogue.
Connect joiner, mover, leaver, guest, group, and administrator work to named business authority.
Operate mail changes as controlled production work instead of isolated admin clicks.
Keep collaboration usable while ownership, sharing, and lifecycle remain visible.
Coordinate routine device and app administration where Intune is selected in the scope.
Distinguish a Microsoft incident from a tenant action, then keep stakeholders working from the same record.
Record why a licence exists, who approved an exception, and when the decision must be revisited.
Tenant operations ledger
The mechanism is deliberately practical. Work appears with an owner and authority question. A material change moves through explicit gates. The reason and evidence remain after the portal view changes.
Privileged access
Routine operations do not justify routine Global Administrator. The access model separates daily tasks, time-bound privilege, partner delegation, and customer-owned emergency access.
Emergency access stays outside normal administration.
The client remains the custodian. The operating model records monitoring, exclusions, validation, authority, and what must happen if an emergency identity is used.
The baseline begins with observation. Credentials, tenant IDs, exports, and administrative data are exchanged only through an approved secure channel after scope approval.
Routine work uses the least-privileged role for the task. PIM provides eligible or time-bound role activation where the selected Microsoft Entra licence supports it.
Where GDAP fits, each tenant grants granular, time-bound, explicitly approved access. Shared administrator accounts and universal credentials are excluded.
Emergency-access accounts stay outside normal administration. They remain under client control, are monitored for use, and are validated through a scheduled operating test.
Tenant-wide consent, data deletion, retention changes, security-control reduction, emergency access, and high-impact enforcement require explicit authority defined in the scope.
Two service levels
Both service levels include client ownership, explicit boundaries, and a documented exit. Operate adds recurring administration and operating cadence, with capacity and response objectives fixed in the SoW.
Tenant Operations Foundation
An internal IT team that inherited a fragmented tenant and needs one documented way to run it.
Essential establishes ownership, authority, baselines, runbooks, and the operating backlog. It can stand alone or become the mobilisation stage for Operate.
Included
Operating arc
Outcome
A documented tenant your own team or a successor provider can operate.
Managed Tenant Operations
An organisation that wants the tenant queue, Microsoft change cycle, and operating evidence actively maintained.
Operate includes a scoped mobilisation to validate an equivalent operating foundation or build what is missing, then keeps the agreed administration service running through named work queues and client-controlled change authority.
Included
Operating arc
Outcome
A tenant with a named operating cadence, a visible queue, and evidence for every material action.
Managing a tenant portfolio?
Operate can use a shared standard with local overlays, separate access, evidence, owners, and rollout decisions for each tenant. Microsoft 365 Lighthouse is used only where its requirements are met.
What lands
Every artefact answers a practical question: who owns the service, who may approve the change, which role was used, what changed, how it was verified, and what remains open.
Evidence supports operations. It does not issue assurance.
Framework mapping can be added for agreed control objectives. The pack is not legal advice, certification, regulator approval, or a guarantee that every Microsoft audit record is retained indefinitely.
TENANT-OPERATING-BASELINE.md
In-scope workloads, owners, authoritative sources, current state, known exceptions, dependencies, and the ranked operating backlog.
ADMIN-ACCESS-REGISTER.md
Named identities, roles, assignment type, GDAP relationship, PIM requirement, approver, purpose, expiry, and review result.
CHANGE-AND-EXCEPTION-LEDGER.md
Request, owner, authority, role used, before and after state, reversal path, verification, evidence, residual risk, and review date.
TENANT-SERVICE-REGISTER.md
Workload, business owner, technical owner, approver, escalation route, support dependency, and communication audience.
LICENCE-ASSIGNMENT-LEDGER.md
Assignment method, business need, usage evidence when available, exception, renewal dependency, decision owner, and next review.
MICROSOFT-CHANGE-AND-HEALTH-LOG.md
Message Center items, Service Health incidents, affected services, required actions, stakeholder updates, support cases, and closure notes.
runbooks/
Human-readable procedures for identity lifecycle, licences, guests, sharing, Microsoft changes, emergency access, and transfer-out.
EXIT-KIT.md
Current owners, access removal, baselines, registers, runbooks, open work, evidence locations, and successor-provider handover.
Scope boundaries
Managed administration works when the request catalogue, authority, service window, capacity, and escalation boundaries are explicit. Operate is not an unlimited support promise.
Public operating guidance
These references support the access, change, service-health, and multi-tenant mechanics described on this page. Service scope still depends on the actual tenant and subscriptions.
The central administration surface for users, billing, reports, service health, Message Center, settings, and workload admin centres.
Tenant-relevant feature changes, required actions, rollout timing, impact, and planning information for administrators.
Active incidents, advisories, organisation-specific actions, history, notifications, and issue reporting.
Microsoft guidance on assigning the least-permissive role, limiting Global Administrators, and protecting administrator identities.
Eligible and time-bound role assignments, just-in-time activation, approvals, reviews, and audit history where the required licence is present.
Explicitly approved, least-privileged, time-bound partner access partitioned per customer tenant.
Customer-owned cloud-only emergency identities, monitoring, exclusions, and recurring validation outside routine administration.
Multi-tenant views, deployment journeys, device and risk insights, service health, and common administration for eligible CSP-managed customers.
Microsoft relationship
CSP Indirect Reseller
CSP Indirect Reseller active. PLA 7113951.
Delivery
Founder-led
The person scoping the operating model remains directly involved in delivery.
Administration
Least privilege
Named identities, scoped roles, explicit approvals, and no shared Global Administrator.
Exit
Client-owned
Registers, runbooks, evidence, and handover records stay in the approved client repository.
Questions before the scope
No. Essential gives the internal team a documented operating model. Operate can own the agreed recurring queue while business authority and strategic decisions remain with the client.
No. The SoW defines the workloads, standard request types, service window, included capacity, response objectives, escalation path, and overflow treatment. End-user helpdesk and deskside support are separate.
Only pre-authorised standard changes may follow a standing approval model. Normal and emergency changes follow the client's documented authority matrix. High-impact actions always require explicit authority.
Read-only roles are used first. Routine work uses the least-privileged workload role. GDAP provides granular and time-bound partner access where appropriate. PIM is used for just-in-time role activation where the tenant is licensed for it.
Not for routine operations. A time-bound high-privilege role may be required for a narrowly approved task when Microsoft has no lower-privilege path. Customer-owned emergency-access accounts remain outside the normal administration route.
Operate checks Service Health, distinguishes a Microsoft incident from a tenant issue, coordinates the support case where appropriate, records impact, and updates named stakeholders during the contracted service window. ITSailor cannot repair Microsoft's service or guarantee its availability.
No. Their availability and control depth depend on the subscriptions in the tenant and the agreed service scope. Major deployments remain separate projects. The operating model records missing prerequisites rather than promising unavailable features.
Yes. Each tenant keeps a separate GDAP relationship, access group, operating baseline, exception register, evidence location, and local owner. Microsoft 365 Lighthouse can support portfolio visibility where the tenants and partner relationship meet its requirements.
Operate can execute a client-triggered and pre-authorised containment step that is explicitly written into a runbook and the SoW. Continuous monitoring, threat hunting, forensics, breach command, MDR, and 24/7 response are separate.
No. The operating record can support control-to-evidence mapping for agreed objectives. It is implementation evidence, not legal advice, certification, assurance, or regulator approval.
The current baseline, access register, service ownership, change and exception ledger, licence decisions, Microsoft change record, runbooks, backlog, evidence locations, and access-removal confirmation remain in the Exit Kit.
Delivery is founder-led. The SoW names the delivery and client roles without inventing a larger service team. If retained specialist coverage or an external provider is required, that dependency is stated before the scope is signed.
Send the workloads, tenant count, internal ownership, current request path, service window and the work your team wants to keep. We scope Essential, Operate, or say when a separate project is the honest answer.
Illustrative operating queue
Each item carries a workload, state, authority question, and evidence requirement. These examples show the record shape, not customer data or a promised queue volume.
Entra and SharePoint
Confirm the business owner, sites in scope, access purpose, and expiry before the guest is renewed or removed.
Decision record required
Operator rule
Observe first. Activate the role only after authority is clear.
Closure rule
The queue closes when verification and evidence are linked.