[windows software] Office 365

[sippo]

Not sure if this is correct, but apparently our software provider needs full admin permissions to our Office 365 tennant. Is this correct?

 

The Global Admin status is a requirement of the CSP programme however the way Global Admin’s are managed at a Microsoft provider level is different to the way in which an end user manages their own Global Admin, access is required for a support point of view. Bytes will have these permissions on over 8,000 tenants in the UK and as such take this position very seriously. All customers are managed by the Microsoft Partner Centre and we adhere to all the requirements as set forth from Microsoft. This includes all accounts having MFA, large amounts of actions managed via the Microsoft APIs (covered by the Microsoft Secure Application Model framework) and access limited to only staff in the higher tiers of the support team. Also whenever we need to access the end users tenants (which is only for a technical support case) we will gain permission to do so from the end user.

 

In regards to the actual end user, as everything Bytes do is through the Microsoft partner centre this provides Microsoft with an audit trail on what all their partners are doing and each time a new area of the partner centre is navigated to another check/MFA request is made. So essentially the full area is very much locked down and traceable. We take this position very seriously, if Microsoft deem we are not following their guidance then we risk having our partner status revoked and this would effect all of our partners and by that extension their end users.

 

Bytes as a company recently floated on the London stock exchange and as such means that we are held to the highest of standard as any slip can have a large and negative effect on the whole company. We have over 60 Security specialists within the company and our Chief Information Security Officer (CISO) also acts as a Virtual CISO for 5 FTSE 100 Companies – essentially sitting at board level for 5 of the largest listed companies in the UK!

[jtotheb]

Seems to be legit, even if it does seem a bit extreme.

https://www.microsoftpartnercommunity.com/t5/Key-Resources-and-Guides/CSP-and-Delegated-Admin-security-concerns-MFA-is-great-but-what/m-p/11041

[jmak]

This came up recently:

 

https://www.edugeek.net/showthread.php?t=222499

 

I think Microsoft are going to have to adjust how they do this or explain it better as lots of customers will be unhappy.