When the person who set up Microsoft 365 has gone, or a provider relationship has ended, the business often cannot administer its own email. The way back depends on how the tenant was set up and who still has admin rights. TechTruePoint helps business owners in Dallas-Fort Worth and across the US work out which route applies and regain control, remotely. Tell us what access you still have.
This page is for businesses that have lost control of their Microsoft 365. Nobody can sign in as an administrator, or the only people who can are a former employee or a provider you can no longer reach. If you can still sign in as an administrator and want that checked, start with admin account ownership instead.
The way back depends on the kind of tenant. A cooperative handover is quickest. If Microsoft 365 was never properly set up and only exists because staff signed up with their work email, it is an unmanaged tenant, and Microsoft's admin takeover lets the business take control by proving it owns the domain. If the tenant was set up properly and has an administrator nobody can reach, that takeover does not apply: the route is another administrator in the tenant or a request to Microsoft support, where the business proves it owns the account and Microsoft decides. If a provider still holds admin access and refuses to hand it over, that can become a dispute to settle first. Owning the domain helps in every case, but it is not a master key.
The usual situations are undramatic. A contractor set it up years ago on their own account. An employee who has left is the only global admin. A provider relationship ended badly. In each case the business has been paying for something it cannot administer.
Businesses in Dallas-Fort Worth can read how we work locally on the DFW Microsoft 365 page.
If you can still sign in as an administrator, you have not lost control yet. Checking who holds admin rights is admin account ownership, and the full picture is the Security and Cost Review.
The order matters. Trying to tidy a tenant before you control it wastes the work. Anything bigger than the list below, such as a full rebuild of identity or devices, is remediation and is scoped separately.
The domain name, who set it up, who pays the Microsoft bill and what access anyone still has. Often less than people expect, which is fine.
We check the domain, the registrar and the tenant from the outside, then tell you which route applies and how strong the evidence looks. Occasionally the domain turns out to be the bigger problem.
A handover where possible, Microsoft's admin takeover for an unmanaged tenant, a Microsoft support request for a managed one. Scope and price agreed in writing before starting.
Separate admin accounts for named administrators, two emergency access accounts, MFA, recovery details recorded.
The written record most businesses have never had.
Fix the findings, keep us running it, or take it in house now that there is something to hand over.
What usually follows:
Often, but the route depends on how the tenant was set up. If nobody ever set up Microsoft 365 properly, and it only exists because staff signed up for a Microsoft service with their work email, it is an unmanaged tenant. For that kind, Microsoft documents an admin takeover: you prove you own the domain by adding a record to it.
If the tenant was set up properly and has an administrator nobody can reach, that process does not apply. The route then is a handover, another administrator in the tenant, or a request to Microsoft support in which the business proves it owns the account. Microsoft decides that outcome, and it takes time rather than minutes.
Where it gets harder is when somebody else holds the domain registration as well. That becomes two recoveries rather than one, and it is worth starting early.
This happens, and it is more often disorganisation than malice: the accounts were never separated and nobody wants to admit what a mess it is.
Either way, start with a written request for admin access, because a cooperative handover is the quickest route. If the provider has simply disappeared, the route depends on the tenant: an unmanaged tenant can be taken over by proving you own the domain, and a managed one goes to Microsoft support. If the provider is still there and refuses, Microsoft may treat it as a dispute between the two of you, and that can need a legal step before anything else. Owning the domain helps in every case, but on its own it does not take a managed tenant away from whoever administers it.
The evidence that helps either way is Microsoft invoices in the business's name and a domain registered to the business. What we would avoid is a fight over credentials while your mail is still flowing through their setup.
Usually, because taking administrative ownership and changing mail routing are separate things. Regaining control does not require moving anybody's mailbox.
Where mail is at risk is when the recovery ends up requiring a domain move. We would tell you before that point, not during.
Administrative control in an account the business owns, with the recovery details recorded somewhere you can reach without asking anyone. A written record of what exists: accounts, licences, domains, mailboxes, who had access.
Most businesses have never had that document, and it is worth as much as the access itself.
A first assessment. We check the domain and where it is registered, what Microsoft's public sign in details show about the tenant, and what access anyone still has. Then we tell you which route applies and how strong your evidence looks.
To start we need the domain name, roughly how many people use it, who set it up, any admin account names you know, who pays the Microsoft bill, and access to the domain registrar if you have it. Scope and price are agreed in writing before any work starts.
A fixed scope review of who has access, how sign-in is protected, where mail goes and what you are paying for.
Licences, accounts, security settings and the day to day of running a tenant.
MFA, access reviews, joiners and leavers, and devices that are managed rather than just handed out.
Devices enrolled, encrypted and updated, and new laptops that configure themselves.
Untangle the accounts, domains and logins nobody has a full list of.
Review one concern in 15 minutes and leave with up to three prioritized next steps.
What to get control of first, the safe order of the switch, and what to close off afterwards.
Tell us what you do know: the domain, roughly how many people, who set it up and what access anyone still has. We start with a first assessment that tells you which route applies, and scope and price are agreed in writing before any work starts.