Deploy and manage a Microsoft 365 tenant

1.1 Implement and manage a Microsoft 365 tenant

Creating a tenant

A tenant is a dedicated, isolated instance of Microsoft Entra ID created automatically when an organisation signs up for a Microsoft cloud subscription (M365, Azure, or Dynamics 365). It is the security and identity boundary for your organisation.

• The tenant gets an initial default domain of the form yourcompany.onmicrosoft.com. This can never be deleted and is used as a fallback routing address.
• Choose the country/region at sign-up — it is permanent and determines data residency and which services are available. It cannot be changed later.
• Tenant type is set at creation: Workforce (employees) vs the newer external/CIAM configurations; for MS-102 think standard organisational (workforce) tenant.

Implementing and managing domains

Add a custom domain (e.g. contoso.com) so users sign in and send mail with your brand instead of *.onmicrosoft.com.

1. Add the domain in the Microsoft 365 admin center (or Entra admin center).
2. Verify ownership by adding a Microsoft-supplied TXT (or MX) record to your public DNS.
3. Configure DNS records for the services: MX (mail routing), CNAME for autodiscover, TXT for SPF, CNAME records for Teams/Skype (sip, lyncdiscover) and SRV records, plus optional DKIM CNAMEs.
4. Set the default domain used for new users if desired.

Organisation settings (Security & privacy, Organization profile)

Found under Microsoft 365 admin center → Settings → Org settings, grouped into Services, Security & privacy, and Organization profile.

Organization profile

Org name, address, technical contact, release preferences (Standard vs Targeted release for early features), and custom themes (logo, colours in the app header).

Security & privacy

Self-service password reset link, sharing settings, idle session timeout, privacy statement, and the password expiration policy (Microsoft recommends "never expire").

Services

Per-service toggles: Bookings, Cortana, Microsoft Forms, reports (anonymised names), user owned apps and services, mail, etc.

Monitoring Service Health & notifications

Health → Service health shows the live status of every service (Exchange, Teams, SharePoint, Entra, etc.). Each issue is an advisory (limited impact) or an incident (broad/critical impact).

• Message center (separate from Service health) announces upcoming changes, new/planned features and required actions — you can configure weekly digest emails and assign Message center reader role.
• Configure Service health notifications (Preferences) to email up to 2 addresses per profile when incidents/advisories are posted.

Network connectivity insights

Under Health → Network connectivity. Microsoft 365 collects connectivity telemetry and surfaces a Network connectivity score per location.

• Key guidance: follow the Microsoft 365 connectivity principles — identify & differentiate Optimize-category traffic, egress locally, avoid backhauling and hairpinning, and bypass proxies/inspection for Optimize endpoints.
• Add office locations to get location-specific insights; data is collected from the Microsoft 365 client and the connectivity test tool (connectivity.office.com).

Microsoft publishes endpoints in three traffic categories — handle each differently at the network edge:

Software updates via the admin center

The Microsoft 365 Apps update channels control how often desktop Office apps get features/fixes:

Within the admin center, Settings → Org settings → Microsoft 365 Apps Installation options and the Microsoft 365 Apps admin center (config.office.com) manage channels, servicing profiles, and inventory.

Monitoring adoption & usage

• Reports → Usage: per-service activity (email, Teams, SharePoint, OneDrive, active users, etc.). Default retention windows of 7/30/90/180 days.
• Microsoft 365 Adoption Score (Reports → Adoption Score): organisational benchmarks across communication, meetings, content collaboration, mobility, teamwork, plus endpoint/network experiences.
• Privacy: in Org settings you can de-identify (conceal) user, group and site names in all reports.

Configure & manage Microsoft 365 Backup

Microsoft 365 Backup is a Microsoft-native, pay-as-you-go (Azure-billed, requires billing/syntex setup) service protecting Exchange Online, OneDrive, and SharePoint.

• Provides fast, large-scale restore to a point in time within the last 365 days, with data kept inside the Microsoft 365 security/compliance boundary (no third-party copy).
• Set up via the Microsoft 365 admin center → Settings → Microsoft 365 Backup; requires pay-as-you-go billing linked to an Azure subscription & resource group.
• Backup policies target sites/accounts (by inclusion rules); restores are self-service and much faster than legacy methods.

1.2 Manage users and groups

Creating & managing users (incl. external users)

Users live in Microsoft Entra ID. Create them in the M365 admin center or Entra admin center. Key attributes: UPN (sign-in name, must use a verified domain), display name, usage location (required before assigning licences), and group memberships.

External / guest users (Entra B2B): invited collaborators who authenticate with their own identity. Managed under Entra ID → External Identities: configure external collaboration settings (who can invite), guest user permissions, and cross-tenant access settings. Deleted users go to a recycle bin and are recoverable for 30 days.

Governing external collaboration (Entra ID → External Identities):

• External collaboration settings — who can invite guests (everyone / admins & specific roles / nobody), guest permission level, and an allow/deny domain list for invitations.
• Cross-tenant access settings — granular B2B inbound/outbound trust per partner Entra tenant: which users/groups/apps, and whether to trust their MFA & device compliance claims (so guests don't re-do MFA).
• Guests can authenticate via their home Entra account, a Microsoft account, one-time passcode email, or configured identity providers (Google/SAML).

Mail contacts

Contacts (M365 admin center → Users → Contacts, or Exchange) are external people with no licence/mailbox who appear in the Global Address List. Useful for vendors/partners you email frequently. A mail-enabled user differs — it has a sign-in but mail delivered externally.

Groups, Microsoft 365 Groups & shared mailboxes

Membership types: Assigned (manual), Dynamic user, or Dynamic device (rule-based on attributes — requires Entra ID P1). A group can't be both dynamic-user and dynamic-device.

Shared mailboxes let multiple users read/send as a common address (e.g. support@). They are free up to 50 GB and need no licence — unless they exceed 50 GB or you enable In-Place Archive/Litigation Hold, which require an Exchange Online Plan 2 licence.

Microsoft 365 Groups governance

Licences & group-based licensing

Licences can be assigned directly to a user or via group-based licensing (assign the licence to a group → all members inherit it). Group-based licensing requires Entra ID P1 for the licensing engine.

• Usage location must be set on the user before any licence is assigned (drives service availability by region).
• You can disable individual service plans within a licence (e.g. turn off Yammer while keeping Exchange).
• If two groups assign overlapping licences, the user receives the union; conflicts (e.g. not enough licences, conflicting service plans) surface as licensing errors to resolve.

Bulk user management & PowerShell

Options: CSV bulk add/import in the admin center, and PowerShell. The MSOnline and AzureAD modules are deprecated/retired — the exam now expects Microsoft Graph PowerShell (and the Microsoft Entra PowerShell module).

# Modern: Microsoft Graph PowerShell SDK
Install-Module Microsoft.Graph -Scope CurrentUser
Connect-MgGraph -Scopes "User.ReadWrite.All"

# Bulk-create users from a CSV
Import-Csv users.csv | ForEach-Object {
  $pwd = @{ Password = 'P@ssw0rd!'; ForceChangePasswordNextSignIn = $true }
  New-MgUser -DisplayName $_.Name -UserPrincipalName $_.UPN `
    -MailNickname $_.Alias -AccountEnabled -PasswordProfile $pwd -UsageLocation "US"
}

1.3 Manage roles and role groups

Roles in Microsoft 365 & Entra ID

Apply least privilege: assign the most specific role for the task rather than Global Administrator. Microsoft recommends fewer than 5 Global Admins and emergency "break-glass" accounts.

Workload permissions (Defender XDR, Purview)

• Microsoft Defender XDR & Microsoft Purview historically use their own role groups (e.g. Purview's Compliance Administrator, eDiscovery Manager; Defender's email & collaboration permissions). These can be managed in-portal or mapped from Entra roles.
• Microsoft is consolidating these under Microsoft Defender XDR Unified RBAC and Entra roles — but role groups still appear on the exam (add/remove members to grant scoped admin rights without Global Admin).

Delegation with Administrative Units (AUs)

An administrative unit scopes an admin's authority to a subset of users/groups/devices (e.g. one region or department). Requires Entra ID P1 for members; assigning roles scoped to an AU lets, say, a "London Helpdesk Admin" reset passwords only for London users.

• AU membership can be assigned or dynamic (rule-based, P1 required).
• Restricted Management AUs (newer) protect members so that only AU-scoped admins — not tenant-level admins like User Admin — can manage them.

Privileged Identity Management (PIM)

PIM provides just-in-time, time-bound, approval-based privileged access — you make roles eligible rather than permanently active. Requires Microsoft Entra ID P2 (or Entra ID Governance).

Per-role settings (Role settings): max activation duration, require MFA on activation, require justification/ticket, require approval (and approvers), and activation/assignment notifications. Access reviews periodically re-attest eligibility.