When the person who set up Microsoft 365 has gone, or a provider relationship has ended, the business often cannot administer its own email. There is a route back, and it starts with the domain.
The domain is the lever. If your business can prove it owns the domain your email runs on, there is a documented route to administrative control of the Microsoft 365 tenant attached to it, whoever currently holds the password.
The usual situations are undramatic. A contractor set it up years ago on their own account. An employee who has left is the only global admin. A provider relationship ended badly. In each case the business has been paying for something it cannot administer.
The order matters. Trying to tidy a tenant before you control it wastes the work.
Often less than people expect, which is fine. The domain name is enough to start.
This is the first real question, and occasionally it turns out the domain is the bigger problem.
Cooperative handover where possible, the ownership process where it is not. Written scope and price before starting.
Business owned admin account, MFA on it, recovery details recorded.
The written record most businesses have never had.
Fix the findings, keep us running it, or take it in house now that there is something to hand over.
What usually follows:
Usually, and it depends on whether you control the domain. Microsoft has a process for proving that a business owns a domain and taking administrative control of the tenant attached to it. It is paperwork and it takes time rather than minutes.
Where it gets harder is when somebody else holds the domain registration as well. That becomes two recoveries rather than one, and it is worth starting early.
This happens, and it is more often disorganisation than malice: the accounts were never separated and nobody wants to admit what a mess it is.
Either way you are not stuck. If the business owns the domain, the route back exists regardless of who is holding the keys. What we would avoid is a fight over credentials while your mail is still flowing through their setup.
Usually, because taking administrative ownership and changing mail routing are separate things. Regaining control does not require moving anybody's mailbox.
Where mail is at risk is when the recovery ends up requiring a domain move. We would tell you before that point, not during.
Administrative control in an account the business owns, with the recovery details recorded somewhere you can reach without asking anyone. A written record of what exists: accounts, licences, domains, mailboxes, who had access.
Most businesses have never had that document, and it is worth as much as the access itself.
A fixed scope review of who has access, how sign-in is protected, where mail goes and what you are paying for.
Untangle the accounts, domains and logins nobody has a full list of.
Licences, accounts, security settings and the day to day of running a tenant.
Tell us what you do know: the domain, roughly how many people, and who set it up. That is usually enough to work out which route applies.