This is a hypothetical disaster-recovery planning question. Our UK institution was created by Royal Charter and subsequent Acts of Parliament, so it does not fit the usual company-registration model. Companies House only has a minimal record telling people to contact us directly, and although we are a charity, we are exempt from registration with the Charity Commission.
Our internal records identify the current governing body and senior leadership, but those details are not independently published in the way Microsoft might expect. Governors serve fixed terms and are replaced over time, while some executives are listed by role rather than by name. A few representatives of external organisations sit on the governing body ex officio, but relying on them for verification would be undesirable if another route exists.
Our concern is that a future Microsoft 365 tenant-recovery process might require video calls with people named in official governing documents. Much of our historical documentation is in Latin and refers to long-deceased officeholders, so it would not directly identify the current people responsible for the organisation.
Has anyone dealt with Microsoft's Data Protection or account-recovery teams in a similar situation? What evidence was accepted to verify ownership and transfer control of a recovered tenant, and can the process be planned in advance with a CSP or Microsoft account representative?
2 Answers
In many cases, the key verification is proving control of the organisation’s domain and demonstrating that the requester is connected to the tenant, such as through existing Global Administrator accounts or recognised administrative contacts. A DNS TXT record may be enough for the domain-ownership portion. Your CSP or Microsoft partner should be able to raise a planned support query and ask what evidence would be required for your specific organisation, even if the exact recovery checks are not publicly documented.
Having a Cloud Solution Provider involved can make this kind of situation easier. They may already have an established commercial and support relationship that helps route an escalation, and they can document the organisation’s unusual legal status before an emergency occurs. I would ask the CSP and account team to record the relevant background, confirm the tenant’s verified domains and administrators, and agree on an escalation path rather than waiting until the tenant is inaccessible.
We already use both a CSP and a Microsoft account contact, but neither has been able to promise exactly how authentication would work. The process seems to be handled case by case, so the practical preparation is to keep domain control, administrator access, contracts, incorporation or charter documents, and a current list of authorised officers together in a recovery plan.
The most involved verification I have personally seen was adding a TXT record to the organisation’s DNS. I have not had to prove the identities of current board members through historical constitutional documents.