HomeServicesManaged IT ServicesClaude DeploymentInsightsAnswersAboutContact
Managed IT & administration

What is included in managed Microsoft 365 services?

By Accred Consulting Microsoft 365 Practice | Company facts

Short answer

Managed Microsoft 365 services cover the ongoing administration of your tenant: user lifecycle and licensing, identity and Conditional Access upkeep, security alert review, Intune device management, mail flow and domain health, SharePoint and Teams governance, Microsoft change tracking and regular reporting. A good contract states exactly which tasks are included, how fast requests are handled and who owns decisions.

Key facts

  • Managed Microsoft 365 is ongoing administration, not a one-time project.
  • The scope document matters more than the plan name: list tasks, response targets and exclusions.
  • Microsoft ships changes to the service every week, so change tracking is part of the job.
  • Security alert review and Conditional Access upkeep should be explicit line items, not assumptions.
  • You should keep Global Administrator break-glass accounts and ownership of the tenant.

The core scope of a managed Microsoft 365 service

Most managed Microsoft 365 services are built around the same set of recurring tasks. The difference between providers is how much of each task is included, how quickly they respond and whether they act proactively or only on tickets.

Expect the following areas to appear in any serious scope document. If one is missing, ask whether it is excluded or simply unwritten.

  • User lifecycle: onboarding, role changes, offboarding, shared mailboxes, distribution lists and Microsoft 365 groups.
  • Licensing: assigning and reclaiming licenses, group-based licensing, renewal reviews and spotting unused seats.
  • Identity: Entra ID users and groups, MFA registration, Conditional Access policy changes, Entra Connect or Cloud Sync health.
  • Security operations: reviewing Defender and Entra ID Protection alerts, risky sign-ins, quarantine release and phishing reports.
  • Devices: Intune enrollment, compliance policies, configuration profiles, app deployment and Windows update rings.
  • Email: mail flow rules, connectors, SPF, DKIM and DMARC records, and message trace investigations.
  • Collaboration: SharePoint site requests, external sharing settings, Teams creation policy and guest access reviews.
  • Change tracking: reading Message Center and the Microsoft 365 roadmap and acting on changes that affect you.

Proactive work versus reactive tickets

A help-desk-style service waits for tickets. A managed service should also run scheduled work that nobody asks for: monthly reviews of admin role assignments, stale accounts, guest users, expiring app secrets, Secure Score recommendations and license usage.

Ask the provider to show a sample monthly report. It should list what changed in the tenant, which alerts were reviewed and closed, which Microsoft changes are coming and what they recommend you do. If the report is only a ticket count, the service is mostly reactive.

Typical service tiers

Providers package managed Microsoft 365 in different ways. The labels vary, but the shapes are similar.

ModelWhat it usually coversFits when
Admin retainerA block of hours each month for admin tasks and small changesYou have in-house IT and need Microsoft 365 depth on call
Co-managedProvider owns the tenant platform; your team handles end usersYour help desk is solid but tenant engineering is thin
Fully managedAdmin, security review, devices, reporting and user supportYou have little or no internal IT staff
Security-focusedAlert review, Conditional Access, Defender tuning, reportingOperations are covered but security oversight is not

What is usually excluded

Most managed services exclude large projects and price them separately. Common exclusions are tenant-to-tenant migrations, new SharePoint intranets, Teams Phone rollouts, Power Platform builds, Copilot or other AI deployments and major Conditional Access redesigns.

Also check how the contract treats third-party apps, line-of-business software, on-premises servers, network gear and printers. Many Microsoft 365 specialists do not support these, and a gap here causes friction during an incident.

Finally, confirm whether a 24x7 security operations center is included. Many Microsoft 365 managed services review alerts during business hours only. If you need round-the-clock monitoring, it may come from a separate managed detection and response provider.

Contract terms to check before signing

The tenant is yours. The contract should say so and the setup should prove it.

  • You keep at least two cloud-only break-glass Global Administrator accounts that the provider does not control.
  • Provider access uses named admin accounts or granular delegated admin privileges (GDAP), with least-privilege roles and time limits.
  • Response and resolution targets are stated for each priority level.
  • Changes to Conditional Access, mail flow and sharing settings go through a documented change process.
  • Documentation of your configuration is delivered and kept current, and you can take it with you if you leave.
  • Exit terms describe how access is removed and how handover works.

How to tell if a managed service is working

After the first quarter you should see fewer repeat issues, a cleaner admin role list, no stale licensed accounts, current documentation and a predictable cadence of reviews. Secure Score trends and alert closure times are useful signals, but they are not goals on their own. The real test is whether Microsoft changes and security events are handled before users notice them.

How Accred Consulting approaches it

Accred Consulting starts managed Microsoft 365 work with a discovery of the tenant: admin roles, Conditional Access, licensing, devices, mail flow and sharing. The proposal then sets a clear scope, a fixed price and the review cadence, so you know which tasks are included and which are projects. You work directly with the US-based specialists assigned to your tenant, with no offshore handoffs. Accred documents the configuration at handover and offers optional Support retainers for ongoing administration, security review and Microsoft change tracking, built on 11 years of hands-on Microsoft delivery experience on the practice team.

Track record: 475+ client projects, 2,000+ migration workstreams and 210,000+ users migrated by a US-based team. Company facts · Case studies

Related questions

Sometimes. Some providers include user support for Outlook, Teams and OneDrive questions, while others only manage the tenant and leave end-user support to your internal team or a separate help desk. Ask whether password resets, device issues and how-to questions are in scope, and what the response targets are for each.
They need enough access to do the work, but standing Global Administrator rights for every technician is a risk. Prefer named accounts or GDAP with specific roles such as User Administrator, Exchange Administrator and Intune Administrator, use Privileged Identity Management where licensed, and keep your own break-glass accounts outside the provider's control.
Common models are per user per month, a fixed monthly retainer for a defined scope or a block of hours. Cost is driven by user and device count, how much security review is included, response targets and how complex the tenant is. Get a written scope with inclusions and exclusions before comparing prices.
Yes, and it is common. A migration, security hardening or tenant health check gives the provider a documented baseline. Moving to managed services afterward means ongoing work starts from a known configuration instead of an inherited one with unknown settings.

Want this scoped for your environment?

Book a free consultation. After discovery you get a written plan with scope, a fixed price and a timeline.

Book a free consultation