Who has administrative access to my Azure environment under CSP — me or the partner?

You retain full administrative control of your own tenant and resources by default. A CSP partner only gets administrative access if you explicitly grant it, typically through Granular Delegated Admin Privileges (GDAP), which lets you scope exactly what the partner can and can't do, and for how long.

This is designed to be your choice, not an automatic consequence of using CSP billing — you can run a CSP relationship purely for billing/licensing while keeping all technical administration in-house, if that's what you prefer.