Our access to your Microsoft 365 and Azure environment follows Microsoft's recommended least-privilege model. We never create local accounts in your tenant and we do not keep standing Global Administrator or other privileged roles switched on. Our technicians work from our own managing tenant with their own identities and elevate access only when a task needs it.
Core principles
- No standing admin accounts in your tenant. We use delegated access from our managing tenant, not Global Admin accounts left open in your environment.
- Least privilege. We hold only the roles a task actually requires, scoped as narrowly as possible.
- Just-in-time access with PIM. Privileged roles are activated on demand for a limited time, with MFA and approval, and expire automatically. Zero standing access.
- Phishing-resistant identity on our side. Our staff sign in with MFA and phishing-resistant methods.
- Full auditability. Every action is tied to a named technician and logged in your tenant.
Microsoft 365 — how we connect
- GDAP (Granular Delegated Admin Privileges): a Global Administrator in your tenant approves a relationship that grants our managing tenant a specific, least-privilege set of Microsoft Entra roles for a limited duration. This replaced the old, broad DAP model. We sign in with our own identities, never a local account in your tenant.
- Microsoft 365 Lighthouse: for management at scale across tenants (users, devices, security baselines, threat overview), built on top of GDAP.
- PIM for delegated roles: we can make the GDAP access itself just-in-time using PIM for Groups, so even delegated admin roles are only active when a technician activates them.
Microsoft 365 Lighthouse is an overview across tenants, not a replacement for the admin centers. Services configured in the Microsoft 365 admin center and the specialized admin centers (Exchange, SharePoint, Teams, Microsoft Purview and others) cannot be managed inside Lighthouse. For that work we access the relevant admin center directly through GDAP, still with delegated, least-privilege access and no local account.
Azure — how we connect
- Azure Lighthouse (delegated resource management): you deploy a small ARM template that delegates a chosen scope, a subscription or a resource group, to our managing tenant with specific Azure RBAC roles. We manage your resources from our tenant, with no guest or local accounts in your directory.
- Least-privilege RBAC: we receive only the built-in roles the work requires, on the exact scope you delegate.
- Just-in-time with PIM (eligible authorizations): privileged Azure roles are eligible rather than permanent. A technician activates a role for a limited time (up to eight hours), with MFA and optional approval, after which it expires.
You stay in control
You keep ownership and full visibility of both environments. You can see every delegation, review exactly which roles are granted, and revoke our access at any time. Access is least-privilege, time-bound and revocable, with no hidden admin accounts and nothing privileged left switched on when it is not being used.