Microsoft 365 Tenant Cleanup and Reseller Extraction

Why tenant cleanup matters

Many organizations discovered that their Microsoft 365 tenant is effectively owned by a reseller or third party, leaving them with limited admin access and rigid billing arrangements. Others have tenants that have drifted over years. Orphaned accounts, underutilized licenses, inconsistent conditional access policies, and stale group memberships have created a messy environment that is expensive to maintain and difficult to secure.

The risk goes beyond inefficiency. A messy tenant is a security risk: dormant accounts get compromised, conditional access gaps go unnoticed, and license sprawl makes it impossible to enforce a clear baseline. Cleanup is a one time investment that reduces operational drag and closes meaningful security gaps.

What is included

• Reseller Extraction - full technical and administrative transfer of your tenant from resellers (including GoDaddy and other CSPs) to your direct control or to a Cloud Solution Provider relationship that fits your needs.
• License Optimization - identification of unused or underutilized licenses and recommendations for consolidation that match the way your organization actually works.
• Mailbox and Group Cleanup - decommissioning of orphaned mailboxes, shared mailboxes no one uses, and inactive groups that clutter the tenant.
• Conditional Access Policy Review - documentation, audit, and refresh of conditional access policies to align with current security baselines.
• SharePoint and OneDrive Audit - identification of orphaned sites, stale permissions, and external sharing that needs governance.
• Security Baseline Implementation - alignment to Microsoft Secure Score recommendations and current best practice.
• Documentation - written record of the tenant configuration, conditional access policies, and operational decisions for ongoing reference.

How the engagement runs

Discovery audits the current tenant state including licensing, identity, conditional access, SharePoint, and Exchange configuration. Design produces a target state that resolves the issues identified. Reseller extraction (if applicable) coordinates the partner change directly with Microsoft. Cleanup executes the agreed actions including license consolidation, conditional access updates, and decommissioning of stale objects. Baseline implementation aligns the tenant to current security best practice. Documentation closes the engagement with a written record of the new state.

What you receive

• Reseller extraction - direct control of your tenant, freed from reseller lock in.
• Tenant audit report - documented findings across identity, licensing, and configuration.
• License optimization plan - prioritized recommendations and executed consolidation.
• Mailbox and group decommissioning - cleanup of orphaned and stale objects.
• Conditional access refresh - documented, current policies aligned to security baseline.
• Baseline documentation - written record of the new tenant configuration.

Who tenant cleanup is for

Organizations trapped in reseller managed tenants who want direct control. Businesses with Microsoft 365 environments that have drifted over years. Companies preparing for an audit, cyber insurance renewal, or merger where tenant hygiene matters. Organizations whose IT team inherited a tenant from a previous administrator and need documentation and a clean baseline.

Frequently asked questions

If our tenant is managed by GoDaddy, can we really transfer it?

Yes. M365 tenants purchased through GoDaddy can be transferred to a direct Cloud Solution Provider relationship or directly to Microsoft. The process takes 2 to 4 weeks and requires coordination between Anneal Tech, GoDaddy, and your chosen CSP or Microsoft. GoDaddy will release the tenant once you follow their transfer procedures.

What happens to my data and licenses during the extraction?

Your data remains in the tenant throughout the extraction. Licenses stay active during transfer. The only change is the administrative ownership and billing relationship. Users do not experience any service interruption.

Can we do tenant cleanup without extracting from a reseller?

Yes. If you already own your tenant directly, we can scope cleanup (orphaned licenses, abandoned groups, policy review) as a standalone engagement. Extraction is only necessary if a reseller currently controls the tenant.

How much does license optimization typically save?

License optimization savings vary widely depending on tenant age and state. Organizations often recover 15 to 25 percent of annual M365 spend through consolidation. We quantify savings during the audit phase.

What if we are currently in a contract with GoDaddy or another reseller?

Contract terms are between you and your current provider. We coordinate the technical transfer, but contract negotiations and early termination fees are your responsibility. We recommend reviewing your contract before engaging cleanup.

How long does the extraction and cleanup process take?

Extraction typically takes 2 to 4 weeks depending on reseller cooperation and tenant complexity. Cleanup phases (audit, remediation, validation) take an additional 2 to 3 weeks. Total engagement is usually 4 to 8 weeks for combined extraction and cleanup.

Are there any services we lose during the transfer?

No. Your M365 services (Exchange, SharePoint, Teams, and others) remain active and functional throughout the transfer. The change is administrative ownership and billing; service delivery is not interrupted.

What is the cost of M365 Tenant Cleanup?

Pricing is determined during the discovery phase based on extraction requirements and cleanup scope. Extraction from a reseller and comprehensive cleanup is typically a fixed-fee engagement. Reach out for a detailed proposal.

Engagement model and program integration

Microsoft 365 Tenant Cleanup is a fixed scope engagement that typically runs two to four weeks depending on tenant size and accumulated complexity. Week one runs the audit: license utilization over the previous 90 days, orphaned and unlicensed accounts, guest user inventory, security group sprawl, conditional access policy review, sharing and external access settings, and a Security Baseline Audit against current Microsoft recommended configurations. Weeks two and three execute the cleanup with a documented change log, and the final week delivers the closeout report and ongoing recommendations.

The cleanup focuses on three categories. First, license rightsizing: identifying users on E3 or E5 who only use Exchange and Office, identifying paid Visio or Project licenses that are not in active use, and proposing a downgrade plan that often pays for the engagement in the first three months. Second, security hardening: enforcing MFA, disabling legacy authentication, tightening default sharing settings, and aligning conditional access to your actual risk tolerance. Third, hygiene: removing former employee accounts after backing up their mailbox and OneDrive content, consolidating duplicate security groups, and cleaning up the Global Address List.

The cleanup is often a precursor to a Workspace Migration moving from a different platform or consolidating multiple tenants. It is also a common follow on to a Cybersecurity Risk Assessment that flagged Microsoft 365 misconfiguration as a control gap. For organizations that want the gains to persist, Security Core Identity managed cybersecurity takes ownership of MFA enforcement, conditional access, and tenant configuration on an ongoing basis so the tenant does not drift back into the same state over the next year.

Why Anneal Tech

Anneal Tech operates Microsoft 365 tenants in production for organizations across regulated industries. Tenant cleanup engagements are delivered by practitioners who run these environments day to day, so the cleanup work is grounded in operational reality rather than checklist theory. Cleanup pairs cleanly with Business Pro, Identity Migration, and our broader cloud productivity portfolio.

Contact Anneal Tech or book a tenant cleanup scoping call. Call 512-593-8001.