Field notes from the M365 admin world
Practical guides on delegating Microsoft 365 user management without inheriting risk. Aimed at IT directors, MSPs, and the HR and ops folks who actually run new-hire onboarding.
HR needs to onboard, offboard, and reset passwords. IT doesn't want them to be Global Admins. The middle path — scoped delegation with audit and templates — is the security-correct answer most orgs aren't using yet.
Password resets cost $25-70 per ticket in IT labor and lost productivity. For a 100-person org, that's $15K-50K per year spent on a 30-second task. Here's the actual math, and what it costs to make it stop.
The shared 'msp-admin@client.com' account is the default in most MSP shops. It's also a compliance failure, an attribution nightmare, and an audit liability. Here's the pattern that replaces it.
PowerShell scripts, the M365 admin center, IDaaS integration, and delegation portals. Each works for some situations and fails badly for others. Here's the honest comparison.
Microsoft's User Administrator role looks like the natural fit for delegating M365 user management to HR. In practice it's too broad, too unscoped, and uses an interface HR shouldn't be in. Here's what to use instead.
The default IT-owned M365 onboarding takes 45 minutes of back-and-forth. With templates, scoped delegation, and a focused interface, the same workflow takes under 2 minutes. Here's exactly how.
Every extra Global Admin in your M365 tenant costs real money — not in licensing, but in incident response time, compliance audit complexity, and breach impact when (not if) one of them gets phished.
Microsoft 365 has 60+ admin roles. Three of them — Global Admin, User Administrator, and Helpdesk Administrator — cover 90% of real-world use cases. Here's exactly what each one can and can't do.
Your HR team shouldn't need Global Admin to reset a password. Here's how to give them safe, scoped password reset access — and what Microsoft's built-in roles get wrong about delegation.
CIPP and UserDesk both manage Microsoft 365, but they're built for different people. Here's an honest comparison and how to pick the right one for your team.
New employee starts Monday. IT spends 45 minutes setting up their M365 account. Here's a better way — let HR handle it with guardrails, templates, and an audit trail.
Every extra Global Admin in your M365 tenant is an attack surface. Here's why organizations end up with too many, and how to fix it without slowing your team down.
Password resets, new hire accounts, license shuffles — if your IT team spends more time on routine M365 tasks than strategic work, it's time to delegate.
Your HR team shouldn't need Global Admin to onboard a new hire. Here's how to delegate M365 user management without compromising security.
Browse by topic
Newsletter
Practical guides on delegation, security, and reducing IT overhead. No spam, unsubscribe anytime.