IT Administration Blueprint: M365 Admin Console

Module 1: User Lifecycle & Offboarding Playbook

1.1 User Creation Mechanics & Identity Types

IT System Administrators manage user provisioning via Users > Active users in the M365 Admin Center (`admin.microsoft.com`). Provisioning requires defining the User Principal Name (UPN), Primary SMTP address, Usage Location (mandatory for license entitlement), and Initial Password state.

1.2 Mailbox Conversion & Soft/Hard Deletion Timelines

Module 2: Groups, DLs & Mail-Enabled Entities

The M365 Admin Console supports four distinct group types under Teams & groups > Active teams & groups. Choosing the correct group architecture is critical for security, access control, and communication efficiency.

2.1 Group Types & Technical Comparison

2.2 Dynamic Membership Rules vs. Static Assignment

While static groups require manual member management, Dynamic Groups evaluate membership automatically based on user identity attributes synchronized from Entra ID:

// Example Dynamic Group Rule for IT Department:
(user.department -eq "Information Technology") -and (user.country -eq "United States")

// Example Rule for Frontline Workers:
(user.userType -eq "Member") -and (user.jobTitle -startsWith "Retail")
            

Module 3: License Management & Optimization

3.1 License Allocation Methods

Under Billing > Licenses, administrators track available stock, expiration dates, and assigned services across core Stock Keeping Units (SKUs) such as Microsoft 365 E3, E5, Business Premium, and F3.

• Direct Assignment: Assigned manually per user via Admin Console UI or PowerShell. Disadvantage: Difficult to track, audit, or scale.
• Group-Based Licensing (GBL): Licenses are bound to an Entra ID Security Group. When a user account enters the group, Entra ID provisions the sub-services automatically. Removing the user revokes the license.

3.2 Granular Service Plan Toggling

Administrators can disable individual sub-services (Service Plans) within a master license SKU. For example, an IT team can assign an M365 E5 license while disabling Viva Engage or Exchange Online for specific user profiles.

Module 4: Microsoft Teams Admin Controls

While deep policy configuration occurs in the Teams Admin Center (`admin.teams.microsoft.com`), high-level org-wide settings, team creation, and external access policies are managed directly inside the main M365 Admin Center.

4.1 External Access vs. Guest Access

4.2 Organization-Wide Teams Settings in M365 Console

Located under Settings > Org settings > Microsoft Teams:

• Email Integration: Control whether users can send emails directly to a channel email address.
• File Sharing Integrations: Enable/disable third-party cloud storage options (Dropbox, Box, Google Drive) within Teams files tabs.

Module 5: OneDrive for Business Administration

Managed via Settings > Org settings > OneDrive or the user details pane in admin.microsoft.com.

5.1 Storage Quotas & Provisioning Limits

• Default Storage Limit: Configurable from 100 GB up to 1024 GB (1 TB) default per user.
• Expansion Criteria: For enterprise plans (E3/E5) with 5+ users, administrators can manually increase individual user quotas up to 5 TB (5120 GB) via PowerShell. Beyond 5 TB, Microsoft Support can provision up to 25 TB storage allocations for specialized heavy-data users.

5.2 Retention on Account Deletion & Access Handoff

When an M365 account is deleted, OneDrive initiates a cleanup process:

[User Account Deleted] 
        │
        ▼
[30-Day Default Retention Window Starts (Configurable up to 3650 Days)]
        │
        ▼
[Automatic Notification Email Sent to Manager with Direct Link to OneDrive Access]
        │
        ▼
[Manager Copies Business Files] ---> [Retention Expires] ---> [OneDrive Moved to Recycle Bin (30 Days)]
            

Module 6: SharePoint Online Core Governance

6.1 External Sharing Levels

Configured centrally in M365 Admin Center under Setup > Sharing data with external users or via the SharePoint Admin Center. External sharing settings operate on a tier system where child sites cannot have a more permissive setting than the global tenant setting:

6.2 Access Control for Unmanaged Devices

Restricts access from non-hybrid or non-Intune compliant personal devices: options include Full Access, Allow Limited Web-Only Access (prevents file downloads, printing, or local sync), or Block Access completely.

Module 7: Automation Scripts & Graph API Reference

Below are production-ready PowerShell scripts using the modern Microsoft.Graph and ExchangeOnlineManagement modules for common M365 Admin tasks.

7.1 Complete Employee Offboarding Script (PowerShell)

# Install modules if required: Install-Module Microsoft.Graph, ExchangeOnlineManagement
Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.AccessAsUser.All"
Connect-ExchangeOnline -UserPrincipalName admin@yourtenant.onmicrosoft.com

$UserUPN = "departing.employee@yourtenant.com"

# 1. Block Sign-In
Update-MgUser -UserId $UserUPN -AccountEnabled:$false

# 2. Revoke active OAuth refresh tokens (Force sign-out)
Revoke-MgUserSignInSession -UserId $UserUPN

# 3. Convert User Mailbox to Shared Mailbox
Set-Mailbox -Identity $UserUPN -Type Shared

# 4. Delegate Mailbox Access to Manager
Add-MailboxPermission -Identity $UserUPN -User "manager@yourtenant.com" -AccessRights FullAccess -AutoMapping $true

# 5. Remove Paid License SKUs
$UserLicenses = (Get-MgUser -UserId $UserUPN -Property AssignedLicenses).AssignedLicenses
foreach ($License in $UserLicenses) {
    Set-MgUserLicense -UserId $UserUPN -RemoveLicenses @($License.SkuId) -AddLicenses @()
}

Write-Host "Offboarding completed successfully for $UserUPN" -ForegroundColor Green
            

7.2 Updating Default OneDrive Storage Quota to 5 TB

# Connect to SharePoint Admin Service
Connect-SPOService -Url "https://yourtenant-admin.sharepoint.com"

# Set default quota for new users to 5TB (5242880 MB)
Set-SPOTenant -OneDriveStorageQuota 5242880

# Increase specific user's OneDrive to 5TB
Set-SPUserOneDriveQuota -User "poweruser@yourtenant.com" -Quota 5242880
            

Module 8: Top 5 Specialized M365 Workload Consoles

Below are the essential sub-consoles directly linked from the main M365 Admin Center (`admin.microsoft.com`):

Module 9: Interactive Knowledge Verification Quiz (20 Questions)

Test your operational mastery of the M365 Admin Console. When you submit your answers, the quiz will highlight correct choices in green, wrong choices in red, calculate your score, and display detailed explanations for every question.