Worked on the other side of the fence. School with IT Staff had appropriate requested permissions (Aka don't ask dont get). Certain none IT Staff had basic permissions again requested. However we always took the line we manage their Tenancy we never owned it so if they switched MSP we created a new GA account provided to new supplier.