Where to buy Microsoft 365 tenants for cold email

A Microsoft 365 tenant is the directory your mailboxes live in. For cold email it is also the blast radius: one tenant holding one domain means a burned domain costs you that tenant and nothing else. That is why agencies buy tenants in quantity rather than piling every domain into one.

The question is where to buy them, and the answer is less obvious than it looks, because most of what is being sold is not the tenant. It is the licensing arrangement behind it, and that is what decides whether the mailboxes can send at all.

What you are actually buying

A tenant on its own is free. Anyone can create one at signup.microsoft.com in about four minutes. What costs money is the licence attached to it, and the work of getting that licence into a state where a mailbox can authenticate over SMTP and send.

So when a reseller quotes you a per-tenant price, they are quoting the licence plus the setup. A tenant delivered without an active licence is a directory with nothing in it, and you will discover that at the first send rather than at purchase.

• The tenant domain, usually something.onmicrosoft.com
• A Global Admin login for it
• An active licence, or a GDAP link that activates one
• Enough seats for the mailboxes you intend to create

The three ways to get tenants

Create them yourself

Cheapest per tenant and slowest per hour. You create the tenant, buy licences at retail, verify a payment method, and repeat. Microsoft rate-limits new tenant creation from a single payment source, so this stops scaling somewhere around the tenth tenant and becomes a second job after that.

Worth doing for one or two. Not worth doing for fifty.

Buy from a CSP partner

A Cloud Solution Provider resells Microsoft licences and can provision tenants under a partner relationship. Licences are cheaper than retail and the tenants are legitimate. The catch is the relationship model: the CSP holds delegated admin rights, and depending on the arrangement you may not hold the Global Admin credentials outright.

Ask directly whether you receive Global Admin. If the answer is that they retain it and act on your behalf, you are renting access rather than owning a tenant, which matters the day you want to move.

Buy from a tenant seller

The cold email specific option. A seller provisions tenants in bulk, attaches licences, and hands you the admin credentials as a spreadsheet. Prices sit in the $7 to $12 per tenant per month range depending on volume, against roughly $6 for a single retail licence with none of the work done.

This is the right shape for an agency, provided the seller actually hands over control. That is the question worth asking before the price.

How to tell a good seller from a bad one

Five questions, and the answers tell you most of what you need to know.

The second question catches the most common failure. A tenant can arrive with a licence assigned but not activated, because the GDAP relationship it depends on has not been accepted. The tenant looks fine in the admin centre and the mailboxes cannot send.

The GDAP step almost nobody explains

GDAP, Granular Delegated Admin Privileges, is how a partner grants a licence to a tenant they provisioned. The relationship has to be accepted from inside the tenant before the licence goes active. If your seller sends a GDAP link per tenant, that link is not optional paperwork. It is the step that turns the licence on.

1. Open the GDAP link in an incognito window
2. Sign in with the tenant credentials from the sheet
3. Click Accept on the relationship page
4. Check the admin centre shows an active licence

Incognito matters because the link authenticates against whichever account your browser already holds, and accepting into the wrong tenant is a mess to unwind.

What a new tenant cannot do yet

A freshly created tenant is rate-limited by Microsoft regardless of its licence. Outbound mail is refused with a 5.7.708 error, and the message says the sending IP is restricted, which sends most people hunting through their own configuration for a fault that is not there.

It is tenant age, and it clears on its own. In our own measurements the restriction lifted somewhere before the fifteenth day: a tenant at that age sent over five hundred messages with no refusals at all, while newer tenants on identical configuration were refused outright.

Never provision production sending onto a tenant under fourteen days old. The configuration is not the problem and no amount of checking it will help.

Practically, this means buying tenants before you need them. A tenant sitting idle costs its licence and ages in the meantime, which is the cheapest possible way to solve a problem that otherwise blocks a launch.

Tenants are not the whole job

Buying tenants gets you directories with licences. Turning them into sending infrastructure still requires a domain per tenant, a DNS zone, SPF, DKIM and DMARC written and verified, mailboxes created with their own credentials, and enough warm-up before the first campaign that the domain survives it.

That work is identical on every tenant, which makes it exactly the kind of thing worth automating rather than repeating. We sell tenants at $9 each and provision them for $1 a domain, which you can see priced on the agency page, but the more useful point is that the provisioning is the part that scales badly by hand, not the buying.