Our IT is outsourced. Who does the export?

Usually your IT firm, because it holds the admin roles an export needs. Your company is still the customer. It decides what goes, should hold one top admin account itself, and can set each export out in a work order.

Who holds the keys to each system?

Whoever holds the top role in each one. How much work is it? lists who can run each bulk export and how to check who holds Microsoft 365’s Global Administrator role. The top roles to find, as of October 2026:

System	Top role	What to know
Microsoft 365	Global Administrator	A partner can hold admin roles through a delegated relationship, covered in the next section
Google Workspace	Super admin	Google says an organization “should have more than one super administrator account, each managed by a separate individual”. A reseller’s access is separate: it can “manage users, groups, and organizational units”, and a super admin can switch it off under Account > Reseller management (Google)
Slack	Primary Owner	“A Slack workspace has a single Primary Owner. Only this person can delete the workspace or transfer ownership to someone else.” On Business+, the application to export private channels and DMs needs the Primary Owner’s approval

Where only the firm’s staff hold a top role, have a company employee added to it first. In your data inventory, the “who can export” column then names both.

Does the IT firm own our Microsoft 365 or Google account?

Normally not, even when it runs the account day to day. Microsoft’s partner guidance (updated January 22, 2026) says “Before you can place an order on a customer’s behalf, the customer must accept and sign the Microsoft Customer Agreement”. How much work is it? covers checking a partner’s admin roles in Microsoft 365 and removing them. Three points it does not:

• Delegated admin rights expire. Microsoft’s granular delegated admin privileges (GDAP) relationships last at most two years and can auto-extend by six months at a time, but not when they include Global Administrator (Microsoft, updated April 20, 2026).
• Removing roles is not ending the relationship. Microsoft: “Removing the admin roles doesn’t remove the partner relationship.” The partner can still work with you, for example as a reseller (updated March 30, 2026).
• A lost top role can be recovered. If the only Google super admin has left, Google’s recovery process asks you to prove you own the domain “by adding a CNAME record to your domain’s DNS settings”. Slack may move the Primary Owner role for you if the workspace was created for a legal entity and a senior staff member submits or authorizes the request (Slack).

What does our IT contract say about the account and the data?

It sets how the firm works inside your systems, which Microsoft’s and Google’s terms do not. Read the managed-services agreement for five things:

1. Whose name the accounts and licenses are in. An article on one MSP-side template says “the ownership of the equipment and software remains with the MSP” for what the MSP provides (Scott & Scott, July 14, 2022), so list which subscriptions are your company’s.
2. Admin accounts. A May 2022 advisory from US, UK, Australian, Canadian and New Zealand cybersecurity agencies tells MSP customers to make sure “the MSP accounts only have access to the services/resources being managed” and that contracts “transparently identify ownership of ICT security roles and responsibilities”.
3. Logs. The same advisory says contracts should require the MSP to “Provide visibility—as specified in the contractual arrangement—to customers of logging activities”.
4. Confidentiality. What the firm may do with what it reads in your mailboxes and channels while it exports them.
5. The end of the contract. Handover of admin credentials, return of your data and deletion of the firm’s copies.

What should we ask the IT firm to do?

Put each export in a short work order:

Ask for	Why
A company employee in the top role of each system	Someone at your company can then see and approve what happens
Counts before any export	Microsoft’s eDiscovery statistics give volumes by mailbox and year without moving anything (Microsoft 365 page)
Only the agreed scope: named mailboxes, channels and dates	The search defines what leaves
Files saved to storage your company controls	Not the firm’s own drives or accounts
A list of what was delivered	To check against the scope in the license
Written confirmation that its working copies are deleted	An export leaves copies wherever it was saved
No app connections or permission grants without your written approval, and removal afterwards	A provider that connects gets access through an admin’s consent, often the firm’s

How much work is it? covers getting a fixed quote against that scope.

How do we see what left?

Through the records each system keeps, which help only if someone at your company can read them. As of October 2026:

• Google Workspace says that “When you start an export, all super admins receive an email that a data export is pending”, and they are emailed again when it finishes. A company-held super admin account gets both.
• Microsoft 365 records eDiscovery activity, including “generating statistics, sample, and exporting from search”, in the audit log, and Audit (Standard) keeps records for 180 days.
• Apps that read your data are listed in the Microsoft Entra admin center under Enterprise apps, where an admin can review each app’s permissions.
• Slack needs the Primary Owner’s approval before a Business+ workspace can export private channels and DMs (Slack page), so a company-held Primary Owner sees that application before the export is switched on.

What if our IT firm brought us the offer?

Ask what you would ask any introducer. Several providers pay for introductions (who gets paid), and Avelence’s referral page lists “Service provider” among its referrer types (as of October 2026). Ask whether the firm is paid if you sign, and by whom.

The license itself is between your company and the buyer. Admin access is not ownership, as the IT managed services page explains from the firm’s side.

What do I do next?

1. Find who holds each top role, and add a company employee wherever nobody does.
2. Read the IT contract for the five points above.
3. Apply before anything is exported. The application asks for a description, not files.
4. When a provider asks for counts or a sample, issue the work order and keep the log records.
5. After delivery, remove any provider access and collect the firm’s written confirmation that its copies are deleted.