JUMP TO SECTIONChoose a lesson section
Understand the dependencies, not just the buttons.
A first-day request crosses several services. Before learning which screen to click, understand what each service owns and what *must* exist before the next task can work.
One organization. Multiple services.
A tenant is an organization's cloud identity and service boundary. It contains identities, configuration, subscriptions and relationships to Microsoft 365 services. A verified custom domain lets the organization use a recognizable sign-in and mail domain; it does not grant someone access to resources.
Microsoft Entra ID holds the directory identity and group information used across many Microsoft 365 services. Exchange Online provides mailboxes, SharePoint Online hosts sites and content, and Intune handles supported device/app management. They interoperate, but a healthy user object in Entra isn't proof the other services are provisioned or accessible.
A subscription purchases access to services; a license assignment makes eligible service plans available to a user. Permissions inside the application remain separate. Users can exist without licenses or application access.
Click a service. Follow its dependencies.
Explore the fictional Northstar Services tenant. Selecting each service shows what it manages, which prerequisites matter, and what that service does not automatically grant.
Tenant / Microsoft 365
Provides the organization's cloud service boundary, configured domains, subscriptions and administration context.
Created tenant, approved domains and service subscriptions.
A tenant does not give every member access to every application.
Conceptual diagram, not a live Microsoft admin center. Microsoft services exchange identity and configuration information, but provisioning and permissions remain distinct.
Know which control plane owns the task.
Microsoft 365 admin center
Create and manage users, assign licenses, check service health, access the main administrative entry points, and handle many common tenant settings.
Start a new employee account and assign a subscription.Microsoft Entra admin center
Manage identities, groups, authentication, enterprise apps, roles and Conditional Access where licensed and available.
Confirm the user's account, authentication requirements and group membership.Exchange admin center
Manage existing Exchange Online mailboxes, recipients, mail flow, and mail permissions. Ordinary new-user provisioning is typically initiated by creating and licensing the account.
Review mailbox provisioning and troubleshoot mail delegation.SharePoint admin center
Manage SharePoint sites, sharing and organization-level settings. Individual site permissions may also be controlled through site or Microsoft 365 group membership.
Verify a Finance site exists and review its permissions.Intune admin center
Enroll and manage supported devices, deployment profiles, configuration, compliance, and applications as appropriate to the organization's licensing.
Investigate a device that isn't compliant for a protected service.Available administrative settings vary by role, organization and subscription. A Global Administrator can see an enormous amount, but everyday tasks should be performed through appropriately scoped roles. Don't use broader privileges just to avoid learning the right admin center.
Created doesn't mean licensed. Licensed doesn't mean authorized.
For a typical new hire, confirm a valid usage location and an available approved license. License assignment may be direct or based on group membership. Group-based licensing can simplify consistent onboarding, but it still has capacity, policy and provisioning considerations.
A suitable product might include Exchange Online and SharePoint Online service plans. Assigning that product can trigger provisioning of the user's mailbox, but the service plan must be enabled and successfully assigned. Real provisioning isn't instantaneous, so a mailbox check must account for normal processing time. Business Premium is used only as a fictional, approved example in our simulation—not as an automatically correct product choice for every company.
A Microsoft 365 product doesn't make Alex a SharePoint site member, an Exchange administrator, or a Finance reporting app user. Always verify the specific resource's access model.
Four objects. Four different jobs.
Security group
Organize identities or devices for access and policy. Membership can grant access when the resource's permissions or rules actually reference the group.
Joining a security group does not inherently provision every SharePoint site or mailbox.Microsoft 365 group
Defines membership for connected collaboration resources, commonly including a group-connected SharePoint team site and other services.
Membership does not automatically give a member administrator privileges.Distribution group
Distributes email to a collection of recipients. Its primary purpose is addressing and mail delivery, not resource authorization.
Don't treat receiving a group email as proof of SharePoint or app access.Shared mailbox
An Exchange mailbox used by multiple permitted users for shared correspondence, with explicit delegated mailbox permissions.
A shared mailbox isn't a replacement for the employee's identity or a generic licensing group.For our fictional organization, Finance Team is a Microsoft 365 group connected to a Finance SharePoint team site. Adding Alex as a member provides the modeled site membership. The separate Finance Reports Access security group is mapped to a reporting application; it does not provide SharePoint membership on its own.
In real tenants, SharePoint site permissions can be managed directly and some organizations enforce additional restrictions. For a group-connected team site, associated Microsoft 365 group membership commonly grants site access; always inspect the actual configuration.
A new employee starts Monday.
Alex Morgan needs a standard Finance account, Exchange mailbox, Finance team site and finance reporting app. The request does not authorize tenant-wide administrator access. Work through an auditable process:
Confirm the request
Validate the new-hire details, start date, manager, department, approved resources and who authorized them. Avoid inventing access.
Create the identity
Create or synchronize the user, set correct sign-in name and department, configure account recovery and onboarding requirements.
Set usage location and license
Set the appropriate user location, verify the subscription has capacity and assign the approved license/services directly or through an approved group policy.
Grant the right membership
Use the authorized Microsoft 365 collaboration group for the Finance team site, then separate security groups for unrelated resource entitlements.
Preserve the security baseline
Keep MFA and applicable Conditional Access controls. Standard employees don't need Global Administrator just because they are new.
Verify each required service
Check account state, license/service plan, mailbox, SharePoint access and any requested app access. Capture ticket-ready evidence and handoff notes.
Don't just ask whether the setting was saved. Ask what an appropriately licensed, nonprivileged employee can do after the change—and whether unrelated resources remain protected.
The mailbox works. Finance SharePoint says Access Denied.
This is exactly where service boundaries matter. If Alex can sign in and use Exchange, the Entra identity and at least one service plan are operating. That narrows the scope—it does not prove group membership, SharePoint permissions or applicable resource-specific policies are correct.
Other causes include additional site restrictions, sign-in policy, account provisioning delay, stale sessions and resource-specific permissions. Avoid changing the organization's entire sharing policy before confirming the narrow fault.
Keep the good protections while fixing the issue.
Standard employees usually do not need any administrator role. Administrators themselves should work with the least-privileged role suitable for the task, avoid routine use of Global Administrator, and preserve authentication protections. A green sign-in or mailbox doesn't remove the need to check MFA and Conditional Access where required.
If multiple employees suddenly lose access to the same Microsoft 365 service, check service health, organization-wide changes and incident history before treating every workstation as an isolated problem. Compare one known-good account, one affected account, and the exact user workflow.
Correct authorization at the resource; don't suppress MFA, weaken Conditional Access or grant tenant-wide permissions merely to make a ticket look resolved.
Can you explain what fails where?
01Alex can sign in, but their Exchange mailbox doesn't appear. Isn't the account working?
An Entra account can authenticate without an Exchange mailbox. Confirm the user has an applicable Exchange Online service plan, a valid usage location and provisioning status. A newly assigned license may require propagation time.
02Alex has Microsoft 365 Business Premium. Why is Finance SharePoint still Access Denied?
Licensing enables eligible services, but it doesn't automatically authorize access to every site. Check the site's access model and Finance group's membership, plus any additional restrictions or Conditional Access requirements.
03Can I put Alex in the Finance Security group to grant SharePoint access?
Only if the site's permissions explicitly reference that security group. For a group-connected Finance team site, membership in its associated Microsoft 365 group commonly provides site membership. Don't conflate distinct group types.
04What's wrong with assigning Global Administrator to simplify onboarding?
It grants far more authority than an employee needs and creates an unnecessary privileged target. Follow least privilege for both the user and the administrator carrying out the change.
05Does an assigned license guarantee every application works immediately?
No. Service provisioning can take time. License service plans can also be disabled or fail assignment; application access policies, groups and resource state still need verification.
06Why check Service health before debugging every user?
A broader Microsoft service incident may explain several affected users. Check impact and scope, then compare individual configuration and logs instead of making unrelated changes.
Know the model; verify the current interface.
Microsoft administration interfaces and licensing requirements change. Use official documentation and your organization's policies. The fictional onboarding scenario doesn't connect to Microsoft Graph, Entra ID or a live tenant.