A mainstay of security policy is that no one has more access than they need, which reduces liability both internally and externally. In order to administer an IT environment, you have to have users with administrative access — the keys to the castle. If your company brings in an MSP, for example, the MSP can’t administer your environment unless they have those keys. But they shouldn’t open everything. It’s important to strictly limit that access only to specific areas that MSPs need to perform their work effectively. Wider access means more avenues of entry for bad actors to potentially exploit. https://www.extnoc.com/windows-10-Office-365-migration/