Your company plans to use Office 365 and Microsoft SharePoint Online. Another employee provisions the company’s Office 365 tenant. You discover that the
employee can create and manage SharePoint site collections.
You need to prevent the employee from creating or managing site collections. From which role should you remove the employee?

A.
Service administrator

B.
SharePoint Online administrator

C.
Global administrator

D.
Site collection administrator

Explanation:

The person who provisions the company Office 365 tenant is the first global administrator who in turn is a SharePoint Online Administrator. As long as this person is
a global administrator they will be able to create SharePoint sites. Now once the site collection is provisioned you can prevent them from managing the site itself by
removing them from the Site Collection Administrator role. By doing this if they went directly to the site they wouldn’t be able to manage it, but they could always add
themselves back to that role
The way the question is stated you would need to be a global administrator yourself and then remove the person who created the tenant as a global administrator.
“Add an administrator to the Site Collection Administrators list If you are a Global Administrator or a SharePoint Online Administrator in SharePoint Online in Office
365 plans other than Office 365 Small Business, you must add your user name account to the Site Collection Administrator list on the SharePoint admin center
page before you can add other site collection administrators via the Team Site. If you are a Global Administrator or SharePoint Online Administrator and you add
yourself as a site collection administrator, performing this action is known as taking ownership of a site.” https://support.office.com/en-au/article/Manageadministrators-for-a-site-collection-9a7e46f9-3fc4-4297-955a-82cb292a5be0 https://blogs.office.com/2015/06/11/more-control-over-data-access-with-workloadspecific-admin-roles/