The accounts that matter most
Some accounts carry far more power than others. The global administrator account for Microsoft 365 or Google Workspace can read mail, reset passwords and delete data. The login for your domain registrar controls where email and your website point. The firewall admin account controls who gets into your network. Backup console logins control whether you can ever get data back. These are the keys to the business.
Other important ones include accounts for your accounting software subscription, website hosting, phone system, Wi-Fi controller, printer management and any line-of-business software. Many offices have never listed them all in one place, which is the first job: know what keys exist before worrying about who holds them. A short spreadsheet listing each system, its admin login name and who can use it is a good start, as long as the passwords themselves live somewhere safer.
How businesses lose control
It usually happens gradually. A provider sets up Microsoft 365 using one of their own email addresses as the admin. The domain is registered in the name of a past IT contractor. A staff member who handled IT years ago set up the firewall and kept the password on a sticky note at home. Nothing is wrong until someone leaves, a relationship ends badly or a provider closes down.
Recovering control is possible, but it can be slow and stressful. Domain registrars and cloud vendors have recovery processes, yet they require proof of ownership and time. Meanwhile, email might be interrupted, a website might lapse, or a critical change cannot be made. Owning the accounts from the start avoids all of this.
What good ownership looks like
The business holds a break-glass account for each critical system: a top-level admin login registered to a company address, with a strong unique password and multi-factor sign-in, stored somewhere the owner or a nominated director controls. It is used rarely, only when normal access fails, and any use of it is noticed and explained.
Your IT provider then gets its own named accounts or delegated admin access with the permissions it needs. Each technician should sign in as themselves, not through a shared login, so actions can be traced. When the relationship ends, you remove their access without needing to reset the passwords your business relies on.
Storing credentials safely
A business password manager is the practical answer. It stores credentials encrypted, lets you share specific entries with specific people, and keeps a record of who accessed what. The business should own the password manager account itself, with the provider given access to a shared vault rather than the other way around. Avoid spreadsheets, shared documents and notebooks.
Keep a sealed emergency copy of the most critical details, such as the break-glass logins and recovery codes, somewhere secure and offline. A safe or a sealed envelope with your lawyer or accountant works. The aim is that if both your office and your provider were unavailable, a trusted person could still regain control.
Taking back control without drama
If you suspect your provider holds the keys, ask politely for a list of every admin account they manage for you and confirmation of who owns each one. Ask them to create break-glass accounts in your name and hand over the credentials. Most providers will help readily; it is simply good practice that sometimes gets skipped.
For domain names, log into your registrar account or ask for the registrant details to be changed to your company if needed. For Microsoft 365, check the list of global administrators yourself and make sure at least one belongs to your business. Do this calmly, as routine housekeeping, rather than as an accusation. A good provider will welcome it.
Keeping it current
Ownership is not a one-off task. Each time a new system is added, a new admin account appears, and it should be recorded in the password manager straight away. Review the list of admin accounts at least once a year, removing old ones and confirming the break-glass logins still work and their multi-factor sign-in is tied to a current device.
Build this into your offboarding process too. When any staff member or contractor with elevated access leaves, review every system they could reach. Rotate shared credentials they knew and confirm their personal accounts have been disabled. Those few steps close one of the most common gaps found in small business security reviews.
In short
- Your business should own every top-level admin account.
- Give your provider its own named access, never your only login.
- Keep break-glass credentials in a business-owned password manager and a sealed offline copy.
- Review admin accounts yearly and whenever someone with access leaves.