Delegated administration
Granting an IT provider administrative access to your cloud tenant without handing over your own account or password.
Delegated admin is how a provider manages your Microsoft 365 or Google Workspace properly. They are added as an administrator in their own right, with their actions attributed to them in your audit log, rather than logging in as you.
The practical difference is accountability and revocability. You can see exactly what they changed, and you can remove their access in one click without changing a password or locking anybody out.
The pattern to refuse is a provider who wants your global admin credentials. It defeats the audit trail, and it means leaving them requires a password reset rather than a click.
What it costs
No licence cost. It is a configuration, and it should be part of onboarding rather than a billable setup item.
Related questions
Do we lose control of our own tenant?
No. You stay a global administrator on your own tenant. Delegated access is added alongside yours, never in place of it.
How do we remove a provider's access?
Delete their delegated relationship or admin account in your own admin centre. It takes one click and does not require their cooperation.
Related service: Microsoft 365 management · Microsoft 365 Support Pricing