ms365-tenant-manager

---
name: ms365-tenant-manager
description: Use when administering Microsoft 365 as Global Administrator — tenant setup, Azure AD user lifecycle, Conditional Access policies, security hardening, or PowerShell/Graph script generation.
category: Engineering
version: 1.0.0
tools: []
---

# Microsoft 365 Tenant Manager

Expert guidance for Microsoft 365 Global Administrators managing tenant setup, user lifecycle, security policies, and organizational optimization. Generate PowerShell scripts (Microsoft Graph SDK) for the administrator to review and run in their own tenant.

## Quick Reference Commands

Security audit:
```powershell
Connect-MgGraph -Scopes "Directory.Read.All","Policy.Read.All","AuditLog.Read.All"
Get-MgSubscribedSku | Select-Object SkuPartNumber, ConsumedUnits, @{N="Total";E={$_.PrepaidUnits.Enabled}}
Get-MgPolicyAuthorizationPolicy | Select-Object AllowInvitesFrom, DefaultUserRolePermissions
```

Bulk provision users from CSV (columns: DisplayName, UserPrincipalName, Department, LicenseSku):
```powershell
Import-Csv .
ew_users.csv | ForEach-Object {
    $passwordProfile = @{ Password = (New-Guid).ToString().Substring(0,16) + "!"; ForceChangePasswordNextSignIn = $true }
    New-MgUser -DisplayName $_.DisplayName -UserPrincipalName $_.UserPrincipalName `
               -Department $_.Department -AccountEnabled -PasswordProfile $passwordProfile
}
```

Conditional Access policy (MFA for admins, start report-only):
```powershell
$adminRoles = (Get-MgDirectoryRole | Where-Object { $_.DisplayName -match "Admin" }).Id
$policy = @{
    DisplayName = "Require MFA for Admins"
    State = "enabledForReportingButNotEnforced"
    Conditions = @{ Users = @{ IncludeRoles = $adminRoles } }
    GrantControls = @{ Operator = "OR"; BuiltInControls = @("mfa") }
}
New-MgIdentityConditionalAccessPolicy -BodyParameter $policy
```

**Decision logic for bulk/repeatable work**: build a setup checklist (prerequisites → DNS records → license plan) before provisioning; for user creation, validate every record first and require it to pass validation before generating the creation script; review every generated script against the workflows below before it runs in the tenant.

---

## Workflow 1: New Tenant Setup

Confirm prerequisites before provisioning: Global Admin account secured with MFA, custom domain purchased and accessible for DNS edits, license SKUs confirmed (E3 vs E5 feature requirements noted).

**Configure and verify DNS records** — after adding the domain in the admin center, verify propagation (NS/MX/TXT/SPF lookups) before bulk user creation; propagation can take up to 48 hours.

**Apply security baseline** — disable legacy authentication (block Basic Auth protocols) via a Conditional Access policy with `BuiltInControls = @("block")` on legacy client app types, and enable the unified audit log.

**Provision users** — assign the confirmed license SKU per user, wrap creation in try/catch, and spot-check 3–5 accounts in the admin portal to confirm licenses show "Active."

---

## Workflow 2: Security Hardening

**Run a security audit** — export the Conditional Access policy inventory and pull the authentication-method registration report to find accounts without MFA registered.

**Create an MFA policy in report-only mode first** (`State = "enabledForReportingButNotEnforced"`), review sign-in logs in Entra ID for 48 hours to confirm the expected users would be challenged, then flip `State` to `"enabled"`.

**Review Secure Score** — retrieve the current Microsoft Secure Score and top improvement actions:
```powershell
Get-MgSecuritySecureScore -Top 1 | Select-Object CurrentScore, MaxScore, ActiveUserCount
Get-MgSecuritySecureScoreControlProfile | Sort-Object -Property ActionType |
    Select-Object Title, ImplementationStatus, MaxScore | Format-Table -AutoSize
```
Apply Microsoft Secure Score recommendations as part of every hardening pass.

---

## Workflow 3: User Offboarding

1. **Block sign-in and revoke sessions immediately**:
   ```powershell
   Update-MgUser -UserId $user.Id -AccountEnabled:$false
   Invoke-MgInvalidateAllUserRefreshToken -UserId $user.Id
   ```
2. **Preview license removal** before executing — list the SKUs that would be removed (dry-run, no mutation).
3. **Execute**: remove licenses (`Set-MgUserLicense -RemoveLicenses $licenses`), convert the mailbox to shared (`Set-Mailbox -Type Shared`), and remove the user from all groups (`Remove-MgGroupMemberByRef`).
4. **Validate** in the admin portal: account shows "Blocked," no active licenses, mailbox type "Shared."

---

## Best Practices

**Tenant setup**: enable MFA before adding users; configure named locations for Conditional Access; use separate admin accounts with PIM; verify custom domains and DNS propagation before bulk user creation; Apply Microsoft Secure Score recommendations.

**Security operations**: start Conditional Access policies in report-only mode; review sign-in logs for 48 hours before enforcing a new policy; never hardcode credentials — use Azure Key Vault or interactive credential prompts; enable unified audit logging for all operations; conduct quarterly security reviews and Secure Score check-ins.

**PowerShell automation**: prefer the Microsoft Graph module over legacy MSOnline; wrap operations in try/catch with logging for an audit trail; preview bulk destructive operations before running them; test in a non-production tenant first.

---

## Limitations

| Constraint | Impact |
|------------|--------|
| Global Admin required | Full tenant setup needs highest privilege |
| API rate limits | Bulk operations may be throttled |
| License dependencies | E3/E5 required for advanced features |
| Hybrid scenarios | On-premises AD needs additional configuration |

Required roles: **Global Administrator** (full tenant setup), **User Administrator** (user management), **Security Administrator** (security policies), **Exchange Administrator** (mailbox management). Required PowerShell modules: Microsoft.Graph, ExchangeOnlineManagement, MicrosoftTeams.