Recognize the concentration of risk
Government cybersecurity agencies warn that attackers target MSPs because their access can create paths into customer environments. This is a reason to conduct diligence, not a reason to conclude that every provider is unsafe. Customers and MSPs should define security responsibilities and maintain appropriate access protections. [S01]
Ask how the provider protects its own identities and remote-management systems. A demonstration of the security products sold to customers is not evidence that the provider applies equivalent controls to itself.
Ask for the minimum necessary access
Distinguish routine support from high-privilege administration. Ask whether access is named, role-specific, time-limited where appropriate, and reviewed. Understand whether the provider uses shared credentials, delegated access, unattended agents, or emergency accounts, and how each is controlled.
For Microsoft partner administration, GDAP supports granular, customer-approved, time-bound privileges. It is one relevant mechanism, not a complete answer for every account, device, or third-party application. Verify what is actually configured in your environment. [S02]
Follow the trail of a sensitive action
Use a hypothetical example: a technician needs to change an executive's access or disable an account during an incident. Who approves the task? How is the requester verified? Which identity performs the work, and what record is retained? Who reviews unusual activity?
Also ask how contractors and specialist partners obtain access. Include data-location or confidentiality requirements that matter to your business. Request sanitized evidence or a controlled explanation; do not ask a provider to expose another customer's credentials or security records.
Keep customer control and recovery practical
Maintain a documented company-authorized recovery path and an inventory of provider permissions. Restrict who can use emergency access and test the procedure securely. Owning an account does not mean every executive should use an unrestricted administrator login for daily work.
During offboarding, remove or replace delegated permissions, remote agents, sessions, recovery methods, and shared secrets through an approved transition plan. Verify replacement protection before removing the previous tool.
Ask Blue Tree Technology® to explain the administration model proposed for your systems, including approval, logging, partner access, and revocation. The right answer is not "you will never need to think about access again." It is a documented arrangement that makes necessary support possible without granting unnecessary, permanent control.