Microsoft 365

Introduction

Microsoft 365 is one of the most widely deployed business technology platforms in the world. A modern organisation might use it for user identities, corporate email, calendars, meetings, instant messaging, file storage, intranets, document collaboration, identity security, multifactor authentication, device management, data protection, compliance, and cloud application access.

For someone working in IT support, system administration, identity and access management, cybersecurity, cloud engineering or a Security Operations Centre, understanding Microsoft 365 is extremely important. However, it should not simply be understood as "Word, Excel and Outlook" — it is an interconnected cloud ecosystem, and Microsoft Entra ID sits at the centre of it.

Large organisations frequently operate hybrid environments, meaning some infrastructure remains inside corporate data centres while other services run in Microsoft 365:

Understanding both sides of this architecture is essential.

Learning Objectives

By the end of this module, you should understand what a Microsoft 365 tenant is, how its services interact, Microsoft Entra ID, the relationship between Active Directory and Entra ID, cloud-only versus hybrid identities, Microsoft Entra Connect and Cloud Sync, Exchange Online and Exchange hybrid, Teams architecture, SharePoint Online, OneDrive, Microsoft 365 Groups, multifactor authentication, modern vs legacy authentication, Conditional Access, device-based access controls, authentication strength, guest/external identities, and common Microsoft 365 troubleshooting techniques.

You should also recognise legacy technologies including Azure Active Directory, AD FS, Exchange Server, Skype for Business, SharePoint Server, classic Teams, Basic Authentication, app passwords, legacy Office clients, and per-user MFA.

1☁️ Understanding Microsoft 365

Microsoft 365 is Microsoft's cloud productivity and collaboration platform, historically heavily associated with the Office 365 brand, which originally concentrated on Exchange Online, SharePoint Online, Skype for Business Online, and Office applications. Over time, Microsoft's business platform expanded into identity, security, device management and compliance.

Today you'll frequently encounter Microsoft 365, Office 365, Microsoft Entra, Azure, Microsoft Defender, Microsoft Purview, and Microsoft Intune — related but not all the same product.

What Is a Microsoft 365 Tenant?

When an organisation purchases Microsoft 365, a logical cloud environment is created for it — commonly called a tenant. Microsoft might initially allocate contoso.onmicrosoft.com; the company can then verify its real domain, contoso.com, so users can have identities such as john.smith@contoso.com.

The tenant contains objects and configuration relating to users, groups, applications, devices, domains, licences, security policies, authentication methods, mailboxes, SharePoint sites, Teams, and administrative roles. The Microsoft Entra tenant forms the identity foundation for Microsoft 365.

Global Enterprise Example

Consider a multinational Contoso Group operating across the UK, Germany, France, US, India, Singapore and Australia. Employees may all authenticate against the same Microsoft Entra tenant, with domains including contoso.com, contoso.co.uk, contoso.de, contoso.fr. The organisation could simultaneously operate on-premises Active Directory (corp.contoso.com) and Microsoft Entra ID (contoso.com), with identities synchronised between the two.

Microsoft 365 Administration

There is no single administration console containing every configuration option. Administrators regularly work across the Microsoft 365 Admin Center, Microsoft Entra Admin Center, Exchange Admin Center, Teams Admin Center, SharePoint Admin Center, Microsoft Intune Admin Center, Microsoft Defender Portal, and Microsoft Purview Portal. Different IT teams may own different areas:

In smaller companies, one Microsoft 365 administrator may perform most of these tasks.

2🔑 Microsoft Entra ID

Microsoft Entra ID is Microsoft's cloud identity and access management service, previously called Azure Active Directory – Azure AD. Students will see both names throughout documentation, old scripts, job descriptions, error messages, certification material and enterprise environments — AAD, Azure AD, Entra ID, and Microsoft Entra ID generally refer to the same directory service across different periods of Microsoft's naming.

Active Directory vs Microsoft Entra ID

This distinction is extremely important. Microsoft Entra ID is not simply Active Directory hosted in Azure — the two use different architectures.

Traditional Active Directory commonly uses domains, forests, domain controllers, Kerberos, NTLM, LDAP, Group Policy, OUs, and DNS: PC → Kerberos/LDAP → Domain Controller → Active Directory.

Microsoft Entra ID is designed primarily for cloud authentication and modern applications — OAuth 2.0, OpenID Connect, SAML, REST APIs, Microsoft Graph, modern authentication:

Microsoft Entra therefore often becomes the central Identity Provider – IdP for an organisation.

Objects Inside Entra ID

Single Sign-On (SSO): authenticate once and gain access to multiple authorised services — a user signs into Windows, then ideally uses Outlook, Teams, SharePoint, ServiceNow and Salesforce without repeatedly entering their password.

Cloud-Only Identity vs Hybrid Identity

Some organisations operate completely in the cloud — a user created in Entra ID with no traditional Active Directory environment. This is increasingly common for start-ups, small companies, cloud-native businesses, new subsidiaries, and organisations modernising their IT.

Large enterprises frequently still have Active Directory, so an employee exists in AD, synchronises to Entra ID. Microsoft describes hybrid identity as maintaining a common user identity across on-premises and cloud environments.

Microsoft Entra Connect

Historically, one of the primary technologies used to synchronise Active Directory identities into the Microsoft cloud is Microsoft Entra Connect Sync (previously Azure AD Connect): Domain Controller → Entra Connect Server → Microsoft Entra ID. Attributes that may synchronise include username, display name, email, department, group membership, password hash, and proxy addresses, depending on configuration.

Password Hash Synchronisation (PHS)

The user's clear-text Active Directory password is not simply uploaded into Microsoft 365 — Microsoft Entra Connect performs additional cryptographic processing before synchronising the resulting credential representation. With PHS, john@company.com can normally use the same password for Windows, Microsoft 365, Teams, Outlook, and cloud applications. Microsoft currently recommends password hash synchronisation as the default sign-in approach for most organisations that don't have requirements demanding another authentication architecture.

Pass-Through Authentication (PTA)

Instead of validating the user's password completely within Microsoft Entra ID, authentication agents communicate with the organisation's on-premises Active Directory: User → Microsoft Entra ID → PTA Agent → Domain Controller. Organisations with particular regulatory or authentication requirements may still encounter PTA.

Federation and AD FS

Historically, many large enterprises implemented Active Directory Federation Services – AD FS: Internet User → Microsoft 365 → Microsoft Entra ID → redirect → AD FS → Active Directory. Microsoft Entra redirects the user to the federation service, the organisation's infrastructure performs authentication, and Microsoft Entra then trusts the resulting authentication assertion.

Microsoft continues to support federation scenarios including AD FS, although cloud authentication generally reduces infrastructure and operational complexity. Students entering large organisations should understand AD FS because it remains present in many long-established enterprise environments.

Microsoft Entra Cloud Sync

Cloud Sync uses lightweight provisioning agents while much of the synchronisation configuration and orchestration occurs within Microsoft cloud services. Microsoft describes Cloud Sync as its strategic direction for hybrid identity synchronisation and highlights scenarios including multiple and disconnected Active Directory forests — useful in global enterprises following acquisitions, mergers, regional separation, or historic IT decisions.

Example: Company Acquisition

Suppose Contoso (contoso.local) buys Fabrikam (fabrikam.local). Instead of immediately rebuilding both Active Directory environments, identities can potentially be integrated into a common cloud identity architecture. This demonstrates why hybrid identity knowledge is important in enterprise IT.

3📧 Exchange

Microsoft Exchange provides enterprise email and calendaring. In modern Microsoft 365 environments, organisations typically use Exchange Online — user mailboxes, email, calendars, contacts, shared mailboxes, distribution groups, resource mailboxes, mail flow, message transport, and mobile email access.

Mailbox Types

An employee might receive alice.smith@contoso.com containing email, calendar, contacts, tasks and folders. Exchange Online provides several recipient types: user mailboxes, shared mailboxes, room and equipment mailboxes, mail users, mail contacts, distribution groups and Microsoft 365 Groups.

A shared mailbox is normally accessed by multiple users — support@company.com, sales@company.com — with permissions such as Full Access, Send As, and Send on Behalf. This is extremely common in enterprise environments.

A distribution group forwards messages to multiple recipients — email one group instead of five people individually. Dynamic distribution groups calculate membership dynamically, for example everyone where Department = Finance, which can be useful in organisations containing thousands of users.

Exchange can also represent resource mailboxes — meeting rooms, projectors, company vehicles — that employees can book using Outlook.

Microsoft 365 Groups

Microsoft 365 Groups connect several collaboration technologies — a single Group Identity can provide a shared mailbox, calendar, SharePoint site and collaboration services. Teams is also closely integrated with Microsoft 365 Groups. This relationship is important during troubleshooting: deleting or incorrectly modifying what appears to be "just a group" can affect several underlying services.

Exchange Mail Flow

Email delivery involves considerably more than Outlook. Simplified incoming flow: Internet → DNS MX record → Exchange Online Protection → Exchange Online → user mailbox. Outgoing: User → Exchange Online → Internet → recipient mail server.

Exchange administrators can also create mail flow rules (historically "transport rules"), for example adding an external-sender warning, or applying extra security action when a message to Finance contains sensitive information.

Incoming email typically passes through Microsoft's Exchange Online Protection services, which identify spam, malware, phishing, suspicious attachments/URLs, and spoofing attempts. More advanced environments may additionally use Microsoft Defender for Office 365.

Exchange Online PowerShell & Message Trace

Large environments cannot always be efficiently managed through graphical interfaces:

Get-Mailbox

Learning PowerShell becomes especially valuable when managing thousands of users. When a user reports "the customer sent me an email but I never received it," don't immediately assume Outlook is broken — use Exchange Online's message tracing to ask: did Microsoft 365 receive the email? Was it rejected, quarantined, delivered, or redirected? Did a mail flow rule apply? Did the sender use the correct address?

Exchange Server – Legacy and Hybrid Environments

Many enterprises historically operated Exchange Server 2003 through 2019. On-premises Exchange has not disappeared completely — the current on-premises product family is Exchange Server Subscription Edition (Exchange SE), which entered support in July 2025. Exchange Server 2016 and 2019 reached end of support on 14 October 2025, although organisations may still encounter those systems in production. Running software and supported software are not the same thing.

Exchange Hybrid

During migrations and in certain long-term architectures, organisations operate both Exchange Server and Exchange Online — an Exchange Hybrid Deployment. Users may share the same SMTP namespace (@company.com) even though some mailboxes are on-premises and others in Microsoft 365. Hybrid configurations can involve mail routing, certificates, Autodiscover, OAuth, directory synchronisation, mailbox migrations, connectors, DNS, and firewall configuration — considerably more complex than purely cloud environments.

Basic Authentication vs Modern Authentication

This is one of the most important historical changes in Microsoft 365. Older applications sent a username and password with every request — Basic Authentication — historically used by POP, IMAP, Exchange ActiveSync, EWS, older Outlook clients, and old PowerShell integrations. Modern Microsoft 365 environments primarily use token-based authentication such as OAuth.

Exchange Online Basic Authentication is now disabled across tenants for the affected protocols and cannot simply be re-enabled by an administrator or Microsoft Support. This matters for troubleshooting legacy applications: an old scanner failing to authenticate may not have "the wrong password" — it may be using unsupported legacy authentication entirely.

4💬 Microsoft Teams

Microsoft Teams provides instant messaging, group conversations, voice/video calls, meetings, channels, file collaboration, screen sharing, application integration, and external collaboration. Microsoft describes Teams as being built on Microsoft 365 Groups, Microsoft Graph, and Microsoft 365's broader security, compliance and management capabilities.

Teams and SharePoint

When users upload files into a standard Teams channel, those files are stored in the associated SharePoint site's document library — Microsoft's documentation explicitly describes the Files experience for a standard channel as a folder inside the team's SharePoint document library. Teams is often the interface; SharePoint provides underlying storage.

When "files in my Teams channel have disappeared," the administrator may need to investigate Teams membership, SharePoint permissions, the SharePoint site, the document library, retention, and deleted items — not simply the Teams desktop client.

Teams Channels

Modern collaboration therefore requires administrators to understand identity boundaries and external access.

Teams Meetings and Calling

Meetings may include internal employees, external guests, anonymous participants, and federation partners. Organisations can configure policies controlling who can create meetings, bypass the lobby, present, record, transcribe, join anonymously, and share screens — particularly important in regulated environments.

Some organisations also replace traditional telephony with Teams Phone, PSTN connectivity, calling plans, Operator Connect, Direct Routing, and session border controllers — meaning collaboration engineers may need networking and telephony knowledge alongside Microsoft 365 knowledge.

External Access vs Guest Access

External access allows communication with users in another organisation without necessarily giving them membership of your tenant's collaboration resources (chat/calls with another company). Guest access creates or uses an external identity that can participate in resources within your organisation, for example an external consultant joining a project Team. External identities must be governed carefully — when a consultant's contract ends, access should be removed.

Skype for Business & Classic Teams – Legacy Technology

Before Teams, many organisations used Microsoft Lync, which became Skype for Business. Skype for Business Online was retired on 31 July 2021, though on-premises deployments and coexistence concepts (Islands Mode, TeamsOnly) may still appear in established organisations. The classic Teams client reached end of support and is no longer available as of 1 July 2025 — instructions written for it may no longer accurately represent current clients.

5📁 SharePoint

SharePoint is Microsoft's enterprise content and collaboration platform; in Microsoft 365 the cloud service is SharePoint Online, used for document storage, collaboration, intranet sites, team sites, communication sites, lists, permissions, knowledge management, and business processes.

An organisation may create sites for its intranet, Finance, HR, Cybersecurity, or individual projects, each containing pages, document libraries, lists, permissions, navigation, metadata, and applications. Unlike a traditional file server, a document library can provide version history, metadata, co-authoring, sharing, retention, search, and workflow integration.

OneDrive vs SharePoint

A useful simplified distinction: OneDrive is primarily associated with an individual user's working files. SharePoint is primarily used for organisational or team-owned information. Ask "does this file belong to the individual, or the organisation/team?" — a team-owned file generally shouldn't depend permanently on one employee's personal storage.

SharePoint Permissions

SharePoint permissions can become complex — site owners, members, visitors, Microsoft 365 Groups, SharePoint groups, direct permissions, sharing links, and guest access can all layer on top of each other. Removing a user from one group may not remove all their access. This is an important IAM concept: always understand the complete access path.

SharePoint On-Premises

Before SharePoint Online became dominant, organisations deployed SharePoint farms on-premises (2007–2019). Microsoft's current on-premises line is SharePoint Server Subscription Edition. SharePoint Server 2019 reaches end of support on 14 July 2026, and Microsoft recommends moving to Subscription Edition rather than deploying 2019 as a new upgrade destination. Global organisations may operate SharePoint Online alongside legacy SharePoint Server farms for applications that haven't yet migrated.

6🔐 Multifactor Authentication

Passwords alone are no longer considered sufficient protection for important organisational systems. MFA requires additional evidence beyond a password, from categories including something you know (password, PIN), something you have (phone, security key, authenticator, smart card, certificate), and something you are (fingerprint, face).

An attacker who steals only the password may therefore be unable to authenticate.

Microsoft Entra MFA Methods

Depending on configuration, students may encounter Microsoft Authenticator, passkeys, FIDO2 security keys, Windows Hello for Business, certificate-based authentication, OATH tokens, SMS, voice, and Temporary Access Pass. Microsoft's current documentation places increasing emphasis on phishing-resistant methods such as passkeys/FIDO2, Windows Hello for Business, and certificate-based authentication.

Microsoft Authenticator can provide push notification, number matching, passwordless authentication, and passkeys. Number matching (enter the number shown on screen) is significantly better than a simple Approve/Deny prompt because it helps reduce MFA fatigue attacks — where an attacker who has stolen a password repeatedly triggers MFA requests hoping the victim eventually presses Approve just to stop the notifications (also called MFA bombing or push bombing). Unexpected MFA prompts are a security warning, not an annoyance to dismiss.

SMS MFA is still widely encountered and is better than password-only authentication, but SMS/OTP codes can be phished, social engineered, relayed, or intercepted in some attack scenarios — modern security strategies increasingly favour cryptographically bound authentication.

FIDO2 and Passkeys

Passkeys use public-key cryptography rather than a reusable password or manually entered OTP: the device holds a private key and provides cryptographic proof to Entra ID, which holds only the public key. The private credential does not need to be sent to the server, making properly implemented passkey/FIDO authentication strongly resistant to traditional credential phishing.

Authentication Strength, Legacy Per-User MFA & Security Defaults

Not all MFA methods provide the same security — an organisation might allow any approved MFA for normal Microsoft 365 access but require phishing-resistant MFA only for a privileged admin portal. Microsoft Entra Conditional Access supports authentication strengths, letting security teams enforce stronger authentication for administrators than normal employees.

Older environments often configured MFA individually per user (per-user MFA: enabled/enforced/disabled). Modern environments generally prefer Conditional Access for MFA enforcement where licensing allows; Microsoft's current guidance recommends Conditional Access for tenants with Entra ID P1/P2, and Security Defaults (a simple baseline on/off) for organisations without those licences, rather than per-user MFA as the primary model.

Older applications that couldn't understand MFA sometimes used app passwords instead of the user's normal password — but since Exchange Online Basic Authentication has been removed for the affected protocols, app passwords cannot be treated as a modern solution for old Exchange clients.

7⚖️ Conditional Access

Conditional Access is one of the most important Microsoft Entra security technologies — Microsoft describes it as its Zero Trust policy engine. Policies evaluate signals and decide whether access should be allowed, blocked, or allowed with additional requirements: if certain conditions are true, then apply an access control.

Microsoft specifically provides guidance for requiring phishing-resistant MFA for privileged roles such as Global Administrator, Conditional Access Administrator, Exchange Administrator, and SharePoint Administrator.

Signals and Grant Controls

Conditional Access can evaluate user, group, administrative role, application, device platform, device state, compliance, network/location, authentication context, and sign-in/user risk (some risk-based capabilities require additional licensing). Grant controls can require MFA, authentication strength, a compliant device, a hybrid-joined device, approved client/app conditions, a password change, or simply block access.

A mature organisation might name policies clearly — CA001-BLOCK-LegacyAuth, CA010-REQ-MFA-Admins, CA020-REQ-CompliantDevice-Finance — rather than vague CA1, CA2, CA3, which is significantly harder to troubleshoot.

The Danger of Conditional Access

Conditional Access is extremely powerful, and a badly designed policy (e.g. requiring a condition nobody can satisfy, applied to all users and all applications) could lock the entire company out. Enterprise administrators should therefore use testing, pilot groups, report-only mode, emergency access accounts, change control, peer review, justified exclusions, and rollback plans. Never treat identity policy changes casually.

Report-only mode lets administrators see how a policy would have behaved ("would this login have been blocked? yes — but still allow it") before enforcement, which is particularly important for organisations with 50,000 users, hundreds of applications, legacy systems, service accounts, and multiple countries — a policy perfect for London employees might unexpectedly break a factory authentication system in Germany or a service account in Singapore.

The What If tool lets administrators evaluate a specific scenario (this user, this app, this location, this device — which policies apply?) as part of Conditional Access troubleshooting and planning.

Conditional Access Troubleshooting

Imagine Alice reports she can access Outlook from her laptop but not her personal phone. An inexperienced technician might reinstall Outlook. A better investigation asks: is authentication successful? Which Conditional Access policies apply? Is mobile access permitted? Is the phone enrolled and compliant? Is MFA satisfied? Is the application approved? Is the device platform blocked? The problem may be policy, not software.

Sign-In Logs

Microsoft Entra sign-in logs are critical for identity troubleshooting — a sign-in event can show the user, application, timestamp, IP, location, device, authentication method, authentication requirement, Conditional Access result, failure reason, and correlation ID. Instead of "Microsoft 365 isn't working," an engineer should determine which user, which application, which authentication request, which timestamp, which policy, which failure code — the difference between guessing and troubleshooting.

Example: alice@company.com tries SharePoint Online from a personal Android phone. Logs show Authentication: SUCCESS, Conditional Access: FAILURE, Policy: Require Compliant Device. The password is correct, MFA might even be correct — access is denied purely because the device doesn't satisfy policy.

Authentication vs Authorization, and the Token Model

Authentication asks "who are you?" Authorization asks "what are you allowed to access?" A successful login does not mean the user is authorised for every resource — Alice can authenticate successfully but still be denied the Finance SharePoint site if she isn't a member of Finance.

A simplified Microsoft 365 authentication flow: user opens an application → redirected to Microsoft Entra ID → authenticates → Conditional Access evaluates the request → MFA may be required → Entra issues tokens → the application receives and validates the token → access is granted. The application should not normally receive the user's password directly.

Modern applications use access tokens (limited authorisation to a resource, containing issuer, audience, subject, permissions, and expiry) and refresh tokens (used to obtain new access tokens without repeatedly asking for credentials). Troubleshooting cloud authentication therefore requires understanding the authentication session, tokens, Conditional Access, and application configuration — not just passwords. You'll explore OAuth, OpenID Connect and JWT in later modules.

8🔗 The Relationship Between Microsoft 365 Services

One of the most important concepts in this module is that Microsoft 365 components depend on each other. Creating a Team in Microsoft Teams involves Entra ID, a Microsoft 365 Group, Teams channels, Exchange (mail/calendar), and SharePoint (files) — all behind the scenes. If something goes wrong in Teams, the underlying issue may originate elsewhere:

Understanding dependencies is a major enterprise troubleshooting skill.

9🎫 Microsoft 365 Licensing

Microsoft 365 is licence-driven — a user may exist in Entra ID and authenticate successfully but still lack Exchange Online, Teams, or Office applications if no licence is assigned. An administrator can assign a licence directly, or large organisations frequently automate assignment through group-based licensing (membership of UK-Employees-M365-E5 automatically determines licence assignment), which scales considerably better.

Joiner, Mover, Leaver

Identity lifecycle is frequently described as Joiner → Mover → Leaver.

Poor leaver processes create serious security risk.

10🌐 Global Enterprise Considerations

Microsoft 365 administration becomes significantly more complex at global scale — imagine 100,000 employees, 80 countries, 20 subsidiaries, 15 Active Directory forests, 5,000 SaaS applications, and thousands of contractors. Challenges include identity governance, regional regulation, data residency, guest access, mergers and acquisitions, multiple domains/languages/time zones, licensing, privileged administration, legacy systems, network performance, and security monitoring.

A global company may own many domains (company.com, company.co.uk, company.de...) all within one tenant. When Company A buys Company B, both already having their own tenants, the business must decide how to manage users, domains, mail, Teams, SharePoint, applications, security policies, devices, and guest identities — tenant-to-tenant migrations can become major IT projects.

Global companies also regularly collaborate externally with suppliers, contractors, consultants, auditors, customers, and joint ventures via Microsoft Entra B2B — but external access must have lifecycle governance. A consultant whose contract ended in June but whose account is "still active in December" is a security problem.

11⌛ Legacy Technology Students Must Recognise

Early-career engineers should not assume every organisation uses the latest Microsoft architecture. Real enterprise estates contain technology from several generations.

Office 2016 and Office 2019 reached end of support on 14 October 2025. Office LTSC 2021 reaches end of support on 13 October 2026, while Microsoft currently identifies Office LTSC 2024 as its current volume-licensed LTSC generation. These dates matter because engineers regularly encounter users running old desktop applications against modern cloud services.

🎫 Common Microsoft 365 Support Tickets

Students entering IT roles are likely to encounter tickets like these. Think through what you'd check before revealing.

13🛡️ Security Incidents in Microsoft 365

Microsoft 365 identities are attractive targets because compromising one account can provide access to email, Teams, SharePoint, OneDrive, SaaS applications, and corporate data, depending on that user's permissions.

Business Email Compromise (BEC)

MFA significantly raises the barrier, but stronger phishing-resistant methods and careful session/access controls provide better protection against modern adversaries.

Malicious Inbox Rules

Attackers who compromise a mailbox may create rules that quietly move messages from a known contact to RSS Feeds and mark them read — the legitimate employee may never see important correspondence. During account compromise investigations, mailbox rules are therefore highly relevant.

Suspicious OAuth Applications

Instead of stealing a password repeatedly, an attacker may persuade a user to grant a fake application permissions to read mail, read files, and access their profile. The user presses "Accept." Application permissions and consent therefore form an important part of Microsoft 365 security.

14👑 Administrator Roles

Microsoft 365 follows role-based administration — instead of giving everyone Global Administrator, organisations should assign roles such as Exchange Administrator, Teams Administrator, SharePoint Administrator, User Administrator, Authentication Administrator, Security Administrator, Conditional Access Administrator, and Helpdesk Administrator, following the Principle of Least Privilege. An Exchange administrator does not automatically require full control over every Microsoft 365 service.

More mature organisations may use Privileged Identity Management (PIM): instead of Alice being permanently a Global Administrator 24/7/365, she requests the privilege, satisfies MFA/approval/justification, receives a temporary admin role, and the role expires automatically. This reduces permanent privileged access.

Security-conscious organisations may also give administrators separate identities — alice@company.com for normal work, alice.admin@company.com for administration only — limiting the exposure of privileged credentials.

15🧩 Practical Microsoft 365 Troubleshooting Methodology

When troubleshooting Microsoft 365, avoid random configuration changes. Use a structured approach.

Always consider service health before spending hours reconfiguring user devices.

Lab🦡 Lab 1 — Explore a Microsoft 365 Tenant

Lab👤 Lab 2 — Create a User

Lab👥 Lab 3 — Create Groups

Lab🎫 Lab 4 — Assign a Microsoft 365 Licence

Lab📧 Lab 5 — Create a Shared Mailbox

Lab📧 Lab 6 — Create a Distribution Group

Lab🔍 Lab 7 — Message Trace

Lab💬 Lab 8 — Create a Microsoft Team

Lab📁 Lab 9 — Examine the Teams and SharePoint Relationship

Lab📁 Lab 10 — SharePoint Permissions

Lab🔐 Lab 11 — MFA Registration

Lab⚖️ Lab 12 — Conditional Access in Report-Only Mode

Lab🔍 Lab 13 — Analyse Sign-In Logs

Lab🚫 Lab 14 — Create an Access Failure

🏢 Enterprise Scenario

Consider GlobalBank: 45,000 employees across 28 countries.

Security: MFA, Conditional Access, Microsoft Intune, Microsoft Defender, PIM. Legacy environment: AD FS, old service accounts, SMTP applications, legacy SharePoint applications, on-premises Active Directory, and some Exchange hybrid components.

This architecture is extremely realistic. An engineer working here needs to understand both modern cloud identity and traditional enterprise infrastructure — that is why Active Directory was covered before Microsoft 365.

🎯 What an Entry-Level Engineer Should Know

You do not need to memorise every Microsoft 365 setting. You should be able to explain each of these. Click each one you're already confident on.

1. 1What is Entra ID?
2. 2How does an Active Directory user appear in Microsoft 365?
3. 3What is a mailbox? What is a shared mailbox?
4. 4What is message tracing, and why use it?
5. 5How are Teams, Microsoft 365 Groups and SharePoint related?
6. 6Where are collaborative files actually stored?
7. 7Why isn't a password enough on its own?
8. 8How can identity, location, application and device signals influence access?
9. 9Where can you find evidence explaining why authentication failed?
10. 10What's the difference between authentication and authorization?

🧠 Interview Questions

Try answering each yourself before revealing the model answer.

Key Terms

Students should know:

• Microsoft 365
• Office 365
• Microsoft Entra ID
• Azure AD
• Tenant
• UPN
• Active Directory
• Hybrid Identity
• Microsoft Entra Connect
• Cloud Sync
• Password Hash Synchronisation
• Pass-Through Authentication
• Federation
• AD FS
• SSO
• OAuth
• OpenID Connect
• SAML
• Microsoft Graph
• Exchange Online
• Mailbox
• Shared Mailbox
• Distribution Group
• Microsoft 365 Group
• Exchange Hybrid
• Mail Flow
• Message Trace
• MX
• SPF
• DKIM
• DMARC
• Teams
• Channel
• Guest Access
• External Access
• SharePoint Online
• SharePoint Site
• Document Library
• OneDrive
• MFA
• Microsoft Authenticator
• FIDO2
• Passkey
• Windows Hello for Business
• Conditional Access
• Authentication Strength
• Security Defaults
• Access Token
• Refresh Token
• Authentication
• Authorization
• RBAC
• PIM
• Zero Trust

Module Summary

Microsoft 365 is much more than Office applications. At the centre of the ecosystem is identity — Microsoft Entra ID. Around it sit Exchange Online, Microsoft Teams, SharePoint Online, and OneDrive. Security technologies including MFA, Conditional Access, authentication strengths, device compliance, and privileged access determine how users reach those resources.

The most important concept is that these technologies are interconnected. A Microsoft Teams problem may actually be Entra ID. A file-access problem may actually be SharePoint permissions. An Outlook problem may actually be Exchange. A login problem may actually be Conditional Access. And a cloud authentication problem may originate from on-premises Active Directory, Entra Connect, or AD FS.

The strongest Microsoft 365 engineers therefore do not simply learn where buttons are located in administrative portals. They understand identity, authentication, authorization, dependencies, networking, security, logs, hybrid architecture, and troubleshooting. That understanding allows them to work effectively across modern cloud-first organisations as well as the complicated hybrid and legacy environments still operating throughout global enterprises.