Who Should Own Licenses and Admin Accounts
Last updated
May 13, 2026
Reviewed by:
IT Service Delivery Lead
Speakable Summary
The business must own its licenses and top-leveladmin accounts. Book a Fit Check to confirm you control billing, recovery, and every critical admin login.
Opening
Most lock-in is not about contracts. It is aboutwho controls the tenant, billing, and admin access.
If the business does not own licenses and adminaccounts, switching providers becomes slow and risky. Renewals get messy, outages take longer, and you can end up paying just to regain access.
This page explains what the business must control, what an IT provider can manage, and how to set it up so support stays fast without surrendering ownership.
Direct Answer
The business should own licenses and top-level admin accounts for all critical systems. Providers can administer those systems through delegated or role-based access, but the business must control billing and recovery.
Clear definitions
Ownership definition
Ownership means the business controls billing, admin access, and account recovery.
Administration definition
Administration means a provider performs work using access the business grants.
What the business must control
The business must control
A provider can manage
Billing account and payment method
Day-to-day license assignments
Tenant ownership for Microsoft 365 or Google Workspace
User onboarding and license allocation
Domain registrar and DNS ownership
DNS changes with change control
Primary global admin ownership
Role-based admin work inside the tenant
Account recovery methods and backup codes
Operational support and monitoring tasks
Password vault ownership
Shared vault folders you control
Vendor portals that affect operations
Vendor coordination and case handling
The key rule is simple. The provider can workinside your systems, but they cannot be the only key-holder.
Admin accounts the business must own
Microsoft 365 or Google Workspace top-level admin
Your business must own the top-level adminaccount. The account should be in the business name, controlled by thebusiness, and recoverable by the business.
Providers can have delegated access or their ownrole-based admin accounts. The business still retains the master ownership.
Domain registrar and DNS
If you do not control the domain, you do notcontrol email. Registrar access is one of the highest priority ownership items.
Backup platform admin and restore authority
Backups are useless if you cannot access themduring a dispute or incident. The business must be able to log in and requestrestores.
Network equipment admin access
Firewall, router, switch, and Wi-Fi admincredentials should be stored in a business-owned vault. You should never have“we can’t find the firewall password” during an outage.
Vendor portals that can stop the business
ISP, VoIP, payroll, accounting, andline-of-business portals should be accessible to the business. Vendors oftencontrol timelines during outages and renewals.
Who should own licenses
The business should own the licenses
Licenses should be purchased and billed to thebusiness. That keeps renewals clean and avoids dependency on a provider forbilling changes.
If a provider resells licenses, the businessstill needs transparency. You should be able to see quantities, costs, renewaldates, and cancellation terms.
Providers can manage licensing operations
Providers can handle assigning licenses tousers, adjusting counts, and making sure new hires get the right entitlements.
The business still controls the billingrelationship. That is what prevents lock-in.
The policy that prevents lock-in
The business owns billing and master access
Billing accounts and top-level admin credentialsbelong to the business. Recovery methods belong to the business.
A provider can be granted access. A providershould not be the only access.
Use delegated access whenever possible
Delegated access reduces password sharing. Italso makes it easier to remove access cleanly during transitions.
Role-based access reduces risk and improvesaccountability. It also reduces the blast radius of a compromised account.
Use a business-owned password vault
Store critical credentials and recovery methodsin a vault owned by the business. Keep at least two internal owners forcontinuity.
The provider can have access to shared folders.Ownership stays with the business.
Document recovery and break-glass access
Recovery methods are part of ownership. Backupcodes, trusted contacts, and recovery steps should be documented and storedsecurely.
If you cannot recover an admin account, you donot truly control it.
We are Optitech provide the best quality It solution neque porro quisquam est qui dolorem ipsum quia golor sit amet, conse ctetur, adipisci velit, sed eligendi optio cumque nihil impedit quo minus id quod maxime plac eat take a trivial example, which of us ever undertakes laborious physical exercise, except to obtain some an advantage take a trivial example, which of us ever undertakes laborious physical exercise, except to obtain some advantage from more than a great system of the maintainance several way done
Optitech is the same is the same of the maintain the majororro quisquam est qui dolorem ipsum quia golor sit amet, conse ctetur, adipisci velit, sed eligendi optio cumque nihil impedit quo minus id quod maxime plac eat take a trivial example, which of us ever undertakes laborious physical exercise, except to obtain
- IT Management provide the most service neque porro quisquam est qui dolorem ipsum quia golor sit amet, conse ctetur, adipisci velit is the more than effective way to solve the quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, velit, sed quia non numquam
- IT Management provide the most service neque porro quisquam est qui dolorem ipsum quia golor sit amet, conse ctetur, adipisci velit is the more than effective way to solve the quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, velit, sed quia non numquam
- IT Management provide the most service neque porro quisquam est qui dolorem ipsum quia golor sit amet, conse ctetur, adipisci velit is the more than effective way to solve the quisquam est, qui dolorem ipsum quia dolor sit amet, consectetur, velit, sed quia non numquam
Optitech is the same is the same of the maintain the majororro quisquam est qui dolorem ipsum quia golor sit amet, conse ctetur, adipisci velit, sed eligendi optio cumque nihil impedit quo minus id quod maxime plac eat take a trivial example, which of us ever undertakes laborious physical exercise, except to obtain
We are Optitech provide the best quality It solution neque porro quisquam est qui dolore ipsum quia golor sit amet, conse ctetur, adipisci velit, sed eligendi optio cumque nihil take a trivial example, which of us ever undertakes laborious physical exercise except
We are Optitech provide the best quality It solution neque porro quisquam est qui dolorem ipsum quia golor sit amet, conse ctetur, adipisci velit, sed eligendi optio cumque nihil impedit quo minus id quod maxime plac eat take a trivial example, which of us ever undertakes laborious physical exercise, except to obtain some an advantage take a trivial example, which of us ever undertakes laborious physical exercis
Former-employee access is prevented by disablingaccounts fast, revoking sessions, and removing access across email, apps, anddevices. The controls that work are a written leaver checklist, clearownership, and verification.
