Ashley Radcliff · August 7, 2026 If you read our last post about how a business impersonation scam played out, you probably landed on one detail: the business's Microsoft 365 was sold and managed through a domain reseller instead of being set up directly. That single detail shaped almost everything else in that story, including what could and couldn't be fixed once the attack was already underway.
So the natural next question is: what does it look like when it's set up right?
Why the reseller setup causes problems in the first place
When you buy Microsoft 365 through a reseller bundled with your domain or website, it's convenient. One bill, one login, one place to manage everything. The problem is what's happening underneath that convenience.
On that kind of setup, the reseller often holds the top level of administrative control, not you and not whoever handles your IT. That means the deepest security tools inside Microsoft 365, the ones that actually stop and reverse an attack, aren't fully in your hands. In the case we wrote about, that gap meant certain checks simply couldn't be completed during the cleanup, not because anyone did anything wrong, but because that level of access wasn't available at all.
Most business owners have no idea this trade-off exists. It's not something a reseller tends to point out when you're signing up.
What "full control" actually means
Full control isn't about being more technical or spending more time in the admin panel yourself. It means the account that holds the keys to your business belongs to your business, plain and simple.
That looks like:
- Direct Global Admin access, not access filtered through a reseller's platform. Whoever manages your IT can actually see and act on everything when something goes wrong, instead of hitting a wall partway through.
- Your domain under your own administrative control, so a missed renewal, a lost login, or a vendor going out of business can't take your website or email down with it.
- Nothing locked behind a third party's dashboard. If you ever want to leave a provider, your email, your files, and your accounts go with you, cleanly.
What "full protection" actually means
Control gets you access. Protection is what you do with it. A properly managed Microsoft 365 setup has these working together, not sitting there unused:
Multi-factor authentication, enforced everywhere
Not optional, not turned on for some people and not others. Every login gets a second check, so a stolen password alone isn't enough to get in. Passkeys are a must.
The right license tier for what a business actually needs
Basic Microsoft 365 plans don't include the security tools that stop modern attacks. The tier built for this, Business Premium, includes device management, advanced threat protection, and the identity protections that catch an account takeover early instead of after the damage is done.
Email authentication actually configured
Three settings, SPF, DKIM, and DMARC, tell the rest of the internet who's actually allowed to send email using your name. Without them, anyone can forge a message that looks like it came from you. With them properly set up, most of that gets blocked before it ever reaches an inbox.
Real-time account monitoring
This is the difference between finding out about an attack from an angry customer and finding out the moment it starts. Tools built for this watch for the exact signs of an account takeover, hidden mailbox rules, logins from unusual places, and unauthorized app access, and alert a real person immediately.
Relying solely on cloud storage
Cloud storage like OneDrive or SharePoint is built to sync and share files, not to protect them. If a file gets deleted, corrupted, or hit with ransomware, that change often syncs across every device before anyone notices, and cloud storage alone doesn't guarantee you can get the original back. Proper protection means real backups running on their own schedule, separate from your everyday files, so a bad day doesn't turn into a permanent loss.
What it looks like to actually get there
If any of this sounds like where your business is right now, the good news is that fixing it doesn't mean losing anything or starting over. Your email, your files, and your history all stay exactly where they are. What changes is who holds the keys and what protection is running behind the scenes.
Done properly, it happens in a deliberate order, with no surprise downtime and nothing left half-finished. A business keeps working normally through the whole thing, and comes out the other side with an environment that's actually theirs, and actually protected.
A quick checklist
If you're not sure where your business stands, ask whoever manages your IT these questions:
- Do we have direct Global Admin access to our own Microsoft 365, or is it filtered through a reseller?
- Is multi-factor authentication turned on for every single person, no exceptions?
- Do we know our current SPF, DKIM, and DMARC status, or has it never been checked?
- Would we actually find out if someone got into an account, and how fast?
- Do we have backups? Have they ever actually been tested with a real restore?
If any of those answers are "I'm not sure," that's worth a conversation, not a source of panic. Most businesses end up in this spot because nobody ever told them there was another option, not because they did anything wrong.
How we help
At NTPC, this is exactly the kind of setup we build for every client from day one, direct administrative control, enforced security, monitored accounts, and backups that are actually tested. We're Texas-based and staffed with local people, so when something needs attention, you're talking to someone who already knows your environment.
Not sure where your business stands? Get in touch and we'll go through it with you.