What’s a safe way to hand over a small Microsoft 365 tenant?

Make the handover a short, verified sequence. First, help the client set up an administrator account they control, with their own sign-in and MFA method. Assign it the Global Administrator role, then have them sign in and confirm they can reach the admin centre. Don’t remove your role until that check succeeds.

If practical, arrange a second client-controlled admin account too. Make sure the client knows how its sign-in and recovery methods are maintained. Once access is verified, remove your admin role and account as agreed, and confirm the client can still sign in afterward.

Keep the security setup simple enough that the client can actually maintain it. Have them register MFA on a device they control, and don’t handle or keep their password or recovery codes. If you’re guiding them remotely, they should enter those details privately.

I’d avoid adding complicated emergency-account or conditional-access rules during a handover unless the client understands how to manage and test them. A security measure that nobody can operate can become a lockout problem.

Send a plain-language handover note, not just a list of technical settings. Include who the client’s admin accounts are, how to reach the admin centre, what was changed, and where the shared mailboxes and SharePoint site are. Also note any open tasks or decisions the client still needs to make.

Ask the client to confirm in writing that they can access the tenant and have received the handover. Then remove your access and document that step. Keep the record factual, and don’t send passwords in ordinary email.