--- title: "SaaS for MSPs: managing client tenants, security and backup" description: "How managed service providers run client SaaS: least-privilege admin access, multi-tenant consoles, Microsoft 365 and Google Workspace backup, and billing." canonical: "https://saascron.com/msp-saas/" language: "en-US" author: "Ricardo Machado" author_url: "https://saascron.com/author/ricardo-machado/" published: "2026-10-29T12:00:00-04:00" updated: "2026-10-29T12:00:00-04:00" category: "SaaS Operations" tags: ["Msp", "Microsoft 365", "Backup", "Access management"] --- # SaaS for MSPs: managing client tenants, security and backup > How managed service providers run client SaaS: least-privilege admin access, multi-tenant consoles, Microsoft 365 and Google Workspace backup, and billing. You run IT for twenty small businesses, or you are about to hire a firm that does. Each client has its own Microsoft 365 or Google Workspace, its own admins, and its own idea of who is responsible when files disappear. You need a way to manage all of them without holding a master key to everything, and a clear answer on backup. A managed service provider (MSP) is a company paid to run another company's IT. With SaaS, the vendor runs the software, as explained in [What is SaaS?](https://saascron.com/what-is-saas/). Configuration, access, security settings and backup still need an owner, and for many small businesses that owner is an MSP. ## MSP work in plain terms Think of a property manager who looks after fifty apartments. A careful one holds a separate key for each apartment, only for the rooms it services, and logs every visit. A careless one carries one master key to the whole building. Both can fix a leaking tap. Only one of them is a disaster if the keys are stolen. Two terms do most of the work: - **Tenant:** one client's instance of a SaaS service, with its own users, settings and data. In Microsoft 365, each client organization is a tenant. - **Delegated administration:** admin rights that a client grants to a partner, so the partner can manage the client's tenant without a user account inside it. ## Access: separate, limited keys per client Microsoft's answer to the master-key problem is granular delegated admin privileges (GDAP). Microsoft describes it as least-privileged access that is "granular and time-bound", and customers "must explicitly grant" it. Partners who manage Azure no longer receive the Global Admin role on a customer's tenant by default. Roles are assigned through security groups, with a limit of 100 security groups per customer. In practice, that means a help-desk technician gets a role that can reset passwords, and only the senior engineer gets a role that can change security policy. Each client grants access to the partner separately, so a compromise at one client does not open all of them. ## One console for many tenants Managing fifty tenants one admin portal at a time does not scale. Microsoft 365 Lighthouse is Microsoft's multi-tenant console for MSPs. Its documentation lists multi-tenant views across customer environments, a default security baseline for small and medium-sized business tenants, multifactor authentication and self-service password reset setup, and alerts on risky sign-ins. Microsoft says there is no additional cost to use it. It is available to partners in the Cloud Solution Provider program, both direct-bill partners and indirect resellers, and both partner and customer tenants must meet its requirements. Third-party tools cover the same ground across more vendors: multi-tenant management consoles, remote monitoring tools, ticketing and billing systems, and SaaS security posture tools, covered in [SSPM explained](https://saascron.com/sspm/). This guide does not rank them. ## Backup: what the vendor keeps, and what it does not The most common client question after an incident is "can you get it back?" The answer depends on what was set up before the incident. **Microsoft 365.** Microsoft 365 Backup protects SharePoint sites, OneDrive accounts and Exchange mailboxes. It costs $0.15 per GB per month for all protected data, and restores are free. The recovery window is set per backup policy: 3 months, 6 months, 1 year or 2 years. It is billed pay-as-you-go, by consumption, not per user. Partner backup applications can also be built on the same storage platform; in that case the partner's application manages and bills it. **Google Workspace.** Google Vault handles retention, legal holds and eDiscovery search and export. Google's overview says "Vault isn't a data archive", and that "Vault doesn't retain data until you set up retention rules." Retention keeps deleted data available to search and export. It is not the same as restoring a user's files to where they were. For the edition and seat details of each suite, see [Microsoft 365 as SaaS](https://saascron.com/microsoft-365-saas/) and [Google Workspace as SaaS](https://saascron.com/google-workspace-saas/). ## Who does what The table sets out a common split of duties. The middle column describes the vendor's tools named above; the right column is a starting point for your contract, not a rule from any vendor. | Area | What the SaaS vendor provides | What the MSP usually takes on | Evidence to keep | |---|---|---|---| | Admin access | Delegated admin roles (GDAP in Microsoft's partner program) | Role design per client, quarterly access review | List of active relationships and roles per client | | Security settings | Baselines and alerts (Lighthouse's SMB baseline, risky sign-in views) | MFA rollout, alert response, exceptions | Baseline status report per client | | Backup | Microsoft 365 Backup (paid per GB); Vault retention rules (Google) | Policies, retention choices, restore tests | Restore test log with dates and times | | Billing | Per-user subscriptions; per-GB backup charges | Resale, pass-through or bundling | Monthly reconciliation of vendor bills to client invoices | ## Worked example: backup inside a flat per-user fee **Example:** a labeled hypothetical that uses Microsoft's published backup price. A client has 40 users and 2.5 TB of data across SharePoint, OneDrive and Exchange. You charge a flat $60 per user a month for managed services and want to include backup. Assume 1 TB = 1,000 GB. - Backup cost today: 2,500 GB x $0.15 = $375 a month. - Your fee: 40 x $60 = $2,400 a month. - Backup per user: $375 / 40 = $9.38, or $9.38 / $60 = 15.6% of the fee. Now suppose the client's data grows 3% a month. - After 12 months: 2,500 x 1.03^12 = 2,500 x 1.4258 = 3,564 GB. - Backup cost: 3,564 x $0.15 = $534.60 a month. - Per user: $534.60 / 40 = $13.37, or 22.3% of the same $60 fee. The fee did not move, the headcount did not move, and backup grew from 15.6% to 22.3% of your revenue from the client. A per-GB cost inside a per-user price shifts the growth risk onto you. Pass it through at cost, or include a storage allowance and bill above it. ## Checklist for each new client - Set up delegated access with the narrowest roles that cover the contract. - Remove any shared or legacy global admin accounts. - Apply a security baseline and record what is excluded and why. - Decide on backup in writing: which services, which recovery window, who pays. - Run a test restore in the first month and log how long it took. - Agree how per-user and per-GB charges appear on the invoice. ## Common mistakes 1. **One global admin account used for every client.** If it is phished, every client is exposed at once. Why it happens: it is the fastest way to start. Instead: use delegated, least-privilege roles per client and review them each quarter. 2. **Treating retention as backup.** Vault keeps nothing until a rule exists, and keeping data for search is not the same as restoring it. Why it happens: both promise that deleted data is "still there". Instead: decide on a backup tool per client and write down what it covers. 3. **Bundling a per-GB cost into a flat per-user fee with no cap.** In the example, backup rises from 15.6% to 22.3% of the fee in a year. Why it happens: one flat price is easier to sell. Instead: pass storage costs through or set an included allowance. 4. **Never testing a restore.** The first restore is the one the client is watching. Why it happens: backups report success every night, so nobody checks. Instead: restore a mailbox and a site for each client once a quarter and keep the log. ## Sources - Microsoft Learn, [GDAP introduction](https://learn.microsoft.com/en-us/partner-center/customers/gdap-introduction), checked October 17, 2026. - Microsoft Learn, [Overview of Microsoft 365 Lighthouse](https://learn.microsoft.com/en-us/microsoft-365/lighthouse/m365-lighthouse-overview), checked October 17, 2026. - Microsoft Learn, [Overview of Microsoft 365 Backup](https://learn.microsoft.com/en-us/microsoft-365/backup/backup-overview), checked October 17, 2026. - Google Workspace Admin Help, [Vault overview](https://knowledge.workspace.google.com/vault/getting-started/vault-overview), checked October 17, 2026. ## In three sentences An MSP running client SaaS needs separate, least-privilege admin access per client, one console to watch many tenants, and a backup decision made before anything is lost. Microsoft offers GDAP for access, Lighthouse as a no-cost console and Microsoft 365 Backup at $0.15 per GB a month, while Google Vault keeps nothing until retention rules exist. In the example, backup inside a flat $60 fee grows from 15.6% to 22.3% of it in a year, so pass per-GB costs through and test restores quarterly. --- Canonical: