Free service-design template
Who approves the change—and who is allowed to make it?
A managed Microsoft 365 agreement fails when the supplier can execute changes but nobody has established who may approve them. Start with this responsibility matrix, change it to match the organisation and attach the result to your service agreement.
Download editable CSVTen decisions with named responsibilities
This is a model to tailor, not an assertion that Pearl Lemon currently provides every listed capability. Customer accountable owners and delivery permissions need to be verified for each engagement.
| Work item | Customer approval | Possible executor | Escalation / consultation | Evidence to retain |
|---|---|---|---|---|
| New joiner identity | Hiring manager | User administrator | Company identity owner | Requested role, manager, start date and licence approval |
| MFA and sign-in method policy | Security owner | Approved identity administrator | Tenant/security owner | Policy impact and approved exceptions |
| Conditional Access change | Security owner | Authorised conditional-access administrator | Identity/security lead | Licence, report-only test and emergency-access plan |
| Role assignment | Privileged access owner | Appropriate privileged-role administrator | Security lead | Least privilege and expiry review |
| SharePoint guest access | Data/site owner | SharePoint administrator | Data protection owner where required | Approved group/site, guest, expiry and audit trail |
| Exchange shared mailbox | Mailbox owner | Exchange administrator | Data/security owner | Delegation rights and send-as authorisation |
| Licence procurement/change | Budget owner | Licence administrator | Finance/procurement | Product needs, existing committed term, agreed spend |
| Leaver and retention | HR/manager and records owner | User/Exchange/SharePoint administrators | Legal/records owner where required | Sign-in restriction, handover, preservation, retention and revocation |
| Security incident escalation | Incident commander appointed by customer | Only contracted responders | Customer security lead | Severity, contact route and separately agreed incident scope |
| Monthly control review | Named service owner | Scope-defined service administrator | Customer sponsor | Reconciled tickets, privileged changes, open exceptions and next owners |
RACI is not a Microsoft role model. The “possible executor” column describes tasks, not permissions guaranteed by a licence or support contract. A qualified tenant administrator must verify which actual Entra, Exchange and SharePoint roles can perform each operation.
How to turn this into an enforceable operating arrangement
1. Name an accountable person
Every request needs a real decision-maker with authority over staff, spending, confidential data or security. A ticket submitter does not always have authority to approve a change.
2. Define the execution boundary
State the supported tenants, applications, hours, roles, approvals, escalation paths, exclusions and supplier availability. Do not give unrestricted global administrator access for routine operations.
3. Require evidence
For each high-impact change retain an approval, request identifier, outcome, reviewer and reversal or exception procedure. Do not put user secrets in tickets or analytics.
Example: external SharePoint access
A manager asks for a contractor to join a confidential SharePoint site. The site owner decides the files and duration; an authorised administrator configures the right membership; the records/security owner is involved where policy requires it. The completion receipt records approval and observed access, not merely “ticket closed”.
Primary source
Microsoft Entra — least privileged roles by task should be consulted for the exact current permissions. This example does not grant rights or verify the customer's licence.
For leaving employees, use the separate offboarding evidence checklist; for estimated monthly support effort, use the support workload planner.
Source reviewed 9 November 2026; independent commercial and technical sign-off is outstanding. This draft remains noindex.
Discuss an accountable support scope