Your business should be able to demonstrate authorized control of its domain registration, Microsoft 365 tenant, subscriptions and critical recovery arrangements. An IT provider can administer them, but the business needs a documented route to continue operating if the provider relationship changes or a key employee is unavailable.
“We have the password” is a weak ownership record. Contractual entitlement, billing responsibility, administrative access and account recovery are different things. Record each one rather than assuming that paying an invoice answers all four questions.
Separate the registered customer from the administrator
For a domain name, identify the registrar and the registered holder. ICANN describes a registrant as the person or entity that registers a domain through a registrar and accepts the registration agreement. That relationship matters separately from who edits DNS records or maintains the website. ICANN: information for domain registrants.
For software subscriptions, identify the contracting customer, seller or reseller, renewal terms and the people authorized to manage the service. A subscription is governed by its license terms; “ownership” here means accountable business control and continuity, not a claim that the business owns the vendor’s software.
Build a control ledger
| Asset | Business record | Continuity check |
|---|---|---|
| Domain registration | Domain, registrar, registrant details, renewal owner and billing reference. | An authorized business representative can use the documented recovery route. |
| DNS and website hosting | Providers, account references, administrators and change owner. | The business knows how records and hosting can be handed over. |
| Microsoft 365 tenant | Tenant reference, accountable business owner and authorized administration arrangements. | Emergency access is documented and tested under controlled procedures. |
| Subscriptions and licenses | Purchasing channel, product, quantity, renewal terms and entitlement records. | A provider change does not leave the business guessing what it is entitled to use. |
| Backups and configuration records | Location, responsible owner and authorized retrieval process. | Someone can locate a usable recovery copy without relying on one person’s memory. |
| Provider access | Named accounts or delegated relationships, purpose and review owner. | Access can be reviewed and withdrawn deliberately at handover. |
Store references to the approved password vault, not passwords or recovery codes in this ledger. Restrict the ledger itself because a complete map of business accounts is sensitive operational information.
Test recovery without granting everyone administrator access
Business control does not require every owner or manager to use a highly privileged account for daily work. Microsoft recommends protected emergency-access arrangements for Entra administration, with monitoring and regular validation. Those accounts serve a specific recovery purpose and should be managed through a defined procedure. Microsoft: emergency-access accounts.
Ask the responsible administrator to demonstrate a controlled recovery check and record its date and outcome. Verify that the right business people can find the procedure and contact the authorized custodian. Do not casually expose recovery credentials during a meeting or disable protections to make the demonstration easier.
Plan the provider handover before revoking access
Imagine an organization whose domain renewal messages go only to an employee who has left. The website still works, so the problem remains hidden until a billing or verification event. A control ledger would expose the missing renewal owner while there is time to correct it through the registrar’s normal process.
For a provider transition, agree on a handover list, authorized recipients, timing and completion evidence. Confirm the receiving administrator can operate the required systems before removing the outgoing provider’s access. Transfer records through approved channels, preserve needed logs and verify subscriptions and renewal responsibilities. Keep changes coordinated so that two providers do not make conflicting edits.
These questions complement the contract and exit discussions in our managed service provider selection guide. Bring the ledger to a managed IT services review and resolve unknown owners before the next renewal or handover makes them urgent.
By mjunaid for TX Computing. Sources checked November 7, 2026. The cover is a generated conceptual illustration, not a customer installation.