Why admin access exists in the first place
Your provider needs admin rights to do normal work: creating and removing users, resetting passwords, fixing mail flow, recovering deleted messages and cleaning up after a compromised account. Some of those tasks, like tracing a phishing email or setting up a departed employee's mailbox for a manager, involve touching mailbox contents. The point isn't to have no access. It's to have controlled access.
What good controls look like
Ask your provider whether they:
- Use separate, named admin accounts for each technician, protected with strong multi-factor authentication, instead of a shared login.
- Give technicians only the roles they need. Microsoft 365 has many admin roles, and most daily tasks don't need global admin.
- Keep auditing turned on. Microsoft 365 can record admin activity and mailbox access. See Microsoft's documentation on audit log search.
- Require a request before opening a mailbox, such as a ticket from an authorized person at your firm.
Hold your own top-level admin account
Make sure your firm holds its own top-level admin account, so you're never locked out of your own tenant. Blue Tree Technology®'s policy: if a client requests one, we create a Break Glass Account. Read more here.
Our article on how MSP administrative access is secured goes deeper on this.
Does Blue Tree Technology® read our email?
Like most MSPs, Blue Tree Technology® needs full administrative control of your email tenant to support and secure it. We do not read email unless a request requires it. Those requests usually come from one of three places:
- A security review. Our email filter flags a message, and we need to make a judgment call on whether it is malicious.
- An owner or leadership request. The owner or leadership asks us to forward an account or find email for an employee.
- A litigation search. A legal matter requires a search of mailbox content.
In all cases, there is an audit trail that can be reviewed later.
Extra care for law, CPA and financial firms
If your email holds privileged communications, tax records or client financial data, write down who at your provider may access mail and under what circumstances. That fits naturally in your information security policy or WISP. Your contract or agreement with the provider should cover confidentiality too. For law firms, see IT for law firms. For tax practices, see what a CPA firm's WISP should include.
What about the owner reading employee email?
That's a different question with legal angles. Company email on company systems is generally company property, but the rules depend on your policies, location and circumstances. Talk with your attorney before monitoring employee mail, and put the policy in writing so employees know.
How to check for yourself
You or your provider can review the audit log for mailbox access by admins, the list of people with admin roles and any mailbox permissions that grant one user access to another's mail. Doing this once or twice a year is a reasonable habit.
FAQ
Can my provider read email without me knowing?
Someone with enough admin rights could, which is exactly why logging, limited roles and a written access policy matter.
Should we remove our provider's admin access?
Usually not. They need it to support you. Limit and log it instead.
Does encryption stop admins from reading mail?
Standard Microsoft 365 encryption protects mail in transit and at rest, but admins with the right permissions can still access it within the service. Stronger options exist for specific needs; ask before assuming.
Related Blue Tree Technology® pages
- Microsoft 365 services
- Cybersecurity services
- Who controls your accounts when you leave an IT provider
- What Is a Break Glass Account?
Still have a question?
Ask Little Sprout, the assistant on our website, for general information. To talk through who can access your email and how to tighten it, schedule a free 15-minute discovery call.