Explanation/Reference:
Explanation:
The question states that "Another employee provisions the company's Office 365 tenant". The person who provisions an Office 365 tenant will automatically be assigned to the Global administrator role. In Office
365, a Global administrator is also a SharePoint Online administrator.
We could prevent the employee from creating or managing site collections by removing the employee from the SharePoint Online administrator role. However, as a Global Administrator, the employee could add himself/herself back to the SharePoint Online administrator role. Therefore, we should remove the employee from the Global Administrator role.
References: https://support.office.com/en-us/article/Assigning-admin-roles-in-Office-365-eac4d046-1afd-
4f1a-85fc-8219c79e1504?ui=en-US&rs=en-US&ad=US