Microsoft 365

Before cloud services, companies ran their own servers for everything — an email server, a file storage server, video conferencing software. Each one needed hardware, IT staff, physical space, and ongoing maintenance.

Microsoft 365 changes this. Microsoft runs everything in their data centers. You pay monthly per user and get access to all the tools through a browser or installed apps.

WHAT'S INCLUDED: Productivity apps you've heard of: Word, Excel, PowerPoint, Outlook, Teams, OneNote.

Most organizations use both local Active Directory AND Microsoft 365. This is called hybrid identity — the most common setup you'll encounter.

THE PROBLEM: Users have accounts in two places — local AD (for domain computers) and M365 (for email/Teams). Managing both separately means double work and double the chance of mistakes.

THE SOLUTION: MICROSOFT ENTRA CONNECT A small application installed on an on-premise server that automatically syncs user accounts from local AD up to M365 every 30 minutes. Create a user in local AD → Entra Connect creates the matching cloud account automatically.

THE CRITICAL RULE: ONE-WAY SYNC Entra Connect syncs from on-premise to cloud ONLY — not the other way.

If you make a change directly in the M365 admin center for a synced account, Entra Connect will OVERWRITE that change on the next sync. Always make changes in local Active Directory for synced accounts. Never edit synced users directly in M365.

FORCING AN IMMEDIATE SYNC: PowerShell on the Entra Connect server: Start-ADSyncSyncCycle -PolicyType Delta (Delta = only sync changes since last sync, much faster than full sync)

Multi-Factor Authentication is one of the most important security features in modern IT. You'll enable it, troubleshoot it, and explain it constantly.

WHY PASSWORDS ALONE FAIL: Passwords get stolen through phishing, data breaches, password reuse, and guessing. If a password is the only thing protecting an account, a stolen password equals full access.

Even if an attacker steals your password, they still can't log in without your phone. Stealing two different types of proof simultaneously is dramatically harder.

MICROSOFT AUTHENTICATOR — HOW IT WORKS: You enter your password. A notification appears on your phone. You approve it. You're in.

NUMBER MATCHING — why it matters: MFA Fatigue is when attackers who have your password keep sending approval requests hoping you tap "Approve" by accident. Number Matching defeats this: you must type a number displayed on the login screen into the app. You can't accidentally approve anything without actively looking at both screens.

Offboarding an employee in M365 is one of the most checklist-dependent tasks in IT. Missing a step is a security risk.

One of the most common points of confusion in M365. They look similar but serve fundamentally different purposes.

THE TEAMS CONNECTION: Every Teams channel stores its files in SharePoint behind the scenes. When you upload a file to a Teams channel, you're saving it to a SharePoint document library. You can access it through Teams or directly through SharePoint — it's the same file.

THE PRACTICAL RULE: "Is this just mine, or does the team need it?" Just yours → OneDrive Team needs it → SharePoint or a Teams channel

SharePoint is one of the most misunderstood tools in Microsoft 365. People think it's just a file storage system. It's much more than that — it's a platform.

SharePoint integrates with almost everything in M365. When you use Teams, file storage in channels is actually SharePoint. When you use OneDrive, it's built on the same platform. When you search in Outlook, results come from SharePoint's search index.

THE TWO TYPES OF SHAREPOINT SITES:

HUB SITES — connecting related sites Hub sites let you group related team sites and communication sites together. They share a consistent navigation bar, unified search across all sites in the hub, and consistent branding. Example: a Finance hub site connecting the Finance team site, the Budget committee site, and the Financial Policies communication site — all findable from one navigation.

SharePoint document management is where it seriously outperforms network drives and basic file storage. These features protect your work and enable collaboration at scale.

VERSION HISTORY SharePoint automatically maintains a complete history of every change made to a document. Every time someone saves, a new version is recorded with the editor's name and timestamp.

To view version history: click the ellipsis (...) next to a document > Version History. You can view, restore, or delete any previous version.

When to use check-out: policy documents, templates, compliance documents where only a few people author content but many view it. Avoids accidental overwriting in high-traffic documents.

When NOT to use check-out: most team collaboration scenarios. Check-out DISABLES co-authoring. If multiple people need to edit simultaneously, don't require check-out.

CO-AUTHORING — editing simultaneously Without check-out required, multiple people can edit the same document at the same time in real time. Each person's cursor is visible to others. Changes appear live. This is the preferred mode for active team collaboration. SharePoint auto-saves versions continuously as edits happen.

CONTENT APPROVAL Libraries can require an approval workflow — new documents or edits stay in "Pending" status until an approver reviews and approves them. Useful for policy libraries, intranet pages, and any content that needs editorial oversight before publishing to a broader audience.

SharePoint has one of the most granular permission systems in M365. Understanding it prevents both accidental exposure and over-restriction.

THE PERMISSION HIERARCHY: Permissions flow downward from site to list/library to individual item: Site permissions → Library permissions → Document permissions

By default, everything inherits from above. A document inherits from its library, which inherits from the site. You can "break inheritance" at any level to set unique permissions for a specific library or document — but use this sparingly. Breaking inheritance in too many places creates a maintenance nightmare.

You can create custom permission levels — for example, "Contribute without Delete" — if the standard levels don't match your needs.

ACTIVE DIRECTORY INTEGRATION: SharePoint works with your AD security groups. Instead of adding individual users to SharePoint site groups, add the AD group. When someone joins or leaves that AD group in Active Directory, their SharePoint access updates automatically. This is the scalable approach — manage people in AD, not in SharePoint.

SECURITY TRIMMING: SharePoint search results are automatically security-trimmed — users only see documents they have access to in search results. You cannot accidentally expose a document by having it indexed.

OneDrive is your personal online file storage — 1TB per user included with most M365 plans. Understanding it deeply matters because it's where users store most of their personal work files, and it's your responsibility to protect that data and ensure continuity.

ONEDRIVE vs SHAREPOINT — the clear line: OneDrive = private files (just yours, until you share) SharePoint = team files (accessible to whoever has site access)

If you start something in OneDrive and it grows to needing team access, move it to SharePoint (Move to option). The version history travels with the file when you move (it doesn't when you copy).

THE ONEDRIVE SYNC APP: Users can install the OneDrive sync app on their computer. This creates a local folder (in the Windows File Explorer under your name) that automatically syncs to the cloud. Changes made locally sync up; changes made in the browser sync down. Offline edits sync when back online.

ADD A SHORTCUT TO ONEDRIVE: Users can "shortcut" SharePoint document libraries to their OneDrive. The library appears in their File Explorer alongside their personal OneDrive files. The files are still in SharePoint (with all SharePoint permissions) but accessible locally through the OneDrive sync app. This is the modern alternative to mapped network drives.

Teams is your collaboration hub — chat, meetings, voice calls, and file sharing in one application. But understanding what Teams actually is under the hood matters for administration.

This is why Teams, SharePoint, Outlook groups, and Planner all seem connected — they are. They're all manifestations of the same M365 Group.

FILES IN TEAMS: Files shared in a Teams channel are stored in the corresponding SharePoint document library. The "Files" tab in a channel IS the SharePoint library. You can click "Open in SharePoint" from the Files tab to see the full SharePoint library view with all its features.

Files in private chats are stored in the sender's OneDrive.

Licensing is one of the most practically important M365 topics because it determines what features are available. Assigning the wrong license wastes money or leaves users unable to do their work.

ENTERPRISE PLANS (E3 and E5): E3: Full enterprise features, desktop Office, compliance tools, Intune E5: Everything in E3 plus advanced security (Defender for Endpoint P2), compliance, analytics, and Power BI Pro

SHARED MAILBOXES: Under 50GB need NO license. This is significant — convert departed employee mailboxes to shared before removing the license.

The Power Platform is a set of tools for building business solutions without traditional coding. For a desktop admin, understanding what these tools are — even if you don't build with them — helps you support users and answer questions.

No-code/low-code — built with a visual drag-and-drop designer. Non-IT users can build their own workflows. IT's role: understand what connectors exist, manage which connectors are allowed in your tenant, troubleshoot failed flows.

Apps can run in a browser or as a mobile app. Data typically stored in SharePoint lists or Dataverse.

Microsoft Purview (formerly the Compliance Center) is where M365's data governance, compliance, and information protection capabilities actually live — genuinely essential knowledge for any admin working in a regulated industry, or simply responsible for keeping organizational data properly managed.

WHY PURVIEW EXISTS AS ITS OWN DEDICATED ADMIN CENTER: While the standard M365 Admin Center handles user and license management, and Exchange Admin Center handles mail flow, Purview specifically centralizes the tools needed for data governance across the ENTIRE M365 ecosystem — email, SharePoint, OneDrive, Teams — rather than requiring separate compliance configuration scattered across each individual service's own admin interface.

THE BROAD CAPABILITY AREAS PURVIEW COVERS: Information protection (classifying and protecting sensitive data through sensitivity labels, covered in the next lesson), data loss prevention (covered in its own dedicated lesson), records management, insider risk management, eDiscovery (covered later in this topic), and audit logging — a genuinely comprehensive suite specifically addressing the "are we handling our data responsibly and can we prove it" set of concerns that connect directly to the GRC frameworks covered in this platform's Security+ topic.

UNIFIED AUDIT LOGGING — THE FOUNDATION MOST OTHER PURVIEW FEATURES DEPEND ON: Purview's unified audit log captures activity across the entire M365 ecosystem — file access in SharePoint, email actions in Exchange, Teams messages, admin configuration changes — in one single, centralized, searchable location. This needs to be enabled (it's on by default in modern tenants, but worth explicitly confirming) before many other Purview investigation and compliance features can genuinely function, since they depend on this underlying audit data actually existing.

COMPLIANCE MANAGER — TRACKING YOUR ORGANIZATION'S COMPLIANCE POSTURE: Compliance Manager provides a scored assessment of your organization's actual configuration against various regulatory frameworks and standards, offering specific, actionable improvement recommendations — directly connecting to the compliance scoring and assessment concepts covered in this platform's Endpoint Management and Security+ topics, just applied here specifically at the M365 tenant configuration level.

WHY PURVIEW MATTERS BEYOND FORMAL REGULATORY COMPLIANCE: Even organizations without a specific hard regulatory requirement (HIPAA, GDPR, and similar frameworks covered in this platform's Security+ topic) genuinely benefit from Purview's capabilities — understanding what sensitive data exists where, controlling how it can be shared, and maintaining a genuine audit trail of significant actions are broadly valuable practices, not purely a checkbox exercise for regulated industries alone.

ROLE-BASED ACCESS TO PURVIEW FEATURES: Just as covered for least-privilege access throughout this platform, Purview supports assigning specific, scoped roles — a compliance officer might need eDiscovery search capability without needing broader tenant administrative rights, and Purview's role-based access control lets you grant exactly that narrow, appropriate scope rather than requiring full Global Administrator access for genuinely routine compliance work.

CONNECTING PURVIEW TO THE BROADER M365 ECOSYSTEM: Purview policies (DLP rules, retention policies, sensitivity labels) apply across the services they're configured to cover — a single DLP policy can simultaneously protect data in Exchange email, SharePoint documents, OneDrive files, and Teams messages, rather than needing entirely separate, disconnected policy configuration in each individual service.

THE PRACTICAL TAKEAWAY: Purview represents Microsoft's answer to a genuinely important question every organization eventually faces: as data spreads across email, files, chat, and collaboration tools, how do you maintain consistent visibility and control over it all? Understanding Purview's role as the central hub for this concern is foundational for any M365 administrator moving beyond basic user and license management into genuine data governance responsibility.

DLP policies automatically detect and act on sensitive information being shared inappropriately across M365 services — directly connecting to the DLP concepts covered in this platform's Security+ topic, this lesson focuses specifically on how DLP actually gets configured and enforced within M365.

WHAT A DLP POLICY ACTUALLY DETECTS: DLP policies use sensitive information types — built-in pattern matching for things like credit card numbers, social security numbers, and various other regulated data patterns, plus the ability to define genuinely custom patterns specific to your own organization's particular sensitive data formats (a specific internal customer ID format, for instance).

WHERE DLP POLICIES CAN ACTUALLY BE APPLIED: A single DLP policy can span Exchange email, SharePoint sites, OneDrive accounts, Teams chat and channel messages, and even on-premise file shares and SQL databases if you've deployed the Microsoft Purview Information Protection scanner — genuinely comprehensive coverage across where sensitive data might actually live or move through.

DLP ACTIONS — WHAT HAPPENS WHEN A POLICY MATCH IS DETECTED: Policies can block the action entirely (preventing an email containing detected sensitive data from actually being sent), show a policy tip warning the user before they complete the action (educating in the moment, rather than purely blocking), require override justification (letting a user proceed but requiring them to document why, creating an audit trail), or simply log the detection silently for reporting purposes without directly interrupting the user's actual workflow at all.

POLICY TIPS — THE EDUCATIONAL, IN-THE-MOMENT APPROACH: Rather than purely blocking or purely logging, a policy tip appears directly within Outlook or SharePoint at the exact moment a user is about to share something matching a DLP rule — genuinely valuable for building organizational awareness over time, catching accidental sharing before it happens while still respecting that most instances are honest mistakes rather than deliberate policy violations.

TESTING DLP POLICIES IN SIMULATION MODE BEFORE ENFORCEMENT: Directly mirroring the AppLocker Audit mode concept covered in this platform's GPO topic, DLP policies support a test mode that shows what WOULD have been detected and acted upon, without actually enforcing any blocking action yet — genuinely essential for confirming a new policy's accuracy and appropriate scope before deploying it in full enforcement mode and potentially disrupting legitimate business workflows unexpectedly.

FALSE POSITIVES — A GENUINE, ONGOING TUNING CHALLENGE: DLP pattern matching, particularly for less rigidly-structured data types, can genuinely produce false positives — flagging something that superficially matches a sensitive pattern but isn't actually genuinely sensitive in context. Ongoing policy tuning, reviewing actual detection reports and adjusting confidence thresholds or adding exceptions, is a genuine, continuous administrative responsibility rather than a one-time setup task.

DLP AND ENDPOINT DATA LOSS PREVENTION: Beyond the cloud-service-focused DLP covered in this lesson, Microsoft also offers Endpoint DLP, extending detection and control to actions taken directly on a managed Windows device — copying sensitive data to a USB drive, printing a sensitive document — directly connecting to the USB/peripheral device control concepts covered in this platform's Endpoint Management topic, just applied here specifically through the DLP policy engine rather than pure device-level blocking.

WHY DLP REQUIRES ONGOING ATTENTION, NOT JUST INITIAL SETUP: As an organization's actual sensitive data types and sharing patterns genuinely evolve over time, DLP policies need periodic review and adjustment to remain genuinely effective — a policy configured once and never revisited will likely drift out of alignment with the organization's actual current data landscape and legitimate business needs.

Sensitivity labels let users (and automated policies) classify documents and emails according to their actual genuine sensitivity level, directly connecting to the data classification concepts covered in this platform's Security Fundamentals topic — this lesson covers how that classification actually gets implemented technically within M365.

HOW SENSITIVITY LABELS DIFFER FROM SIMPLE FOLDER-BASED ORGANIZATION: Rather than relying purely on WHERE a file is stored to imply its sensitivity (a document in a "Confidential" folder), sensitivity labels attach classification metadata directly to the actual file or email itself — meaning the classification travels genuinely with the content wherever it goes, even if it's moved, emailed externally, or downloaded to a different location entirely.

WHAT A SENSITIVITY LABEL CAN ACTUALLY DO BEYOND SIMPLE CLASSIFICATION: Beyond visual marking (a watermark, a header/footer indicating classification level), labels can enforce genuine technical protection — encryption restricting who can actually open a document, restricting forwarding of a labeled email, or applying specific access permissions that travel with the content even after it leaves the organization's direct control.

MANUAL VS. AUTOMATIC LABEL APPLICATION: Users can manually apply an appropriate label themselves when creating or saving a document — but automatic labeling (based on detected sensitive content matching the same sensitive information types covered in the DLP lesson) can apply a label automatically without requiring the user to remember or correctly judge the appropriate classification themselves every single time, genuinely reducing the risk of a user simply forgetting to classify something appropriately.

LABEL INHERITANCE FOR CONTAINERS — SITES, TEAMS, AND GROUPS: Beyond individual documents, sensitivity labels can also be applied to SharePoint sites, Teams, and M365 Groups themselves — a label applied at this container level can enforce settings like whether external sharing is permitted at all for that specific site or team, or whether guest access is allowed, applying genuine governance at the container level rather than purely at the individual document level.

CO-AUTHORING AND SENSITIVITY LABELS — A GENUINE TECHNICAL EVOLUTION: Historically, applying strong encryption-based protection to a document could break real-time co-authoring capability (multiple people editing simultaneously) — modern sensitivity label implementations have genuinely improved this, supporting co-authoring even on labeled, encrypted documents in most current scenarios, though this remains worth verifying for your specific configuration and M365 licensing tier.

DEFAULT LABELS AND MANDATORY LABELING POLICIES: Organizations can configure a default label automatically applied to new content, and can make labeling genuinely mandatory before a document can be saved or an email sent — directly connecting to the "secure by design" and "secure defaults" architectural principles covered in this platform's Security+ topic, ensuring classification happens consistently rather than depending purely on optional user discretion.

TRAINABLE CLASSIFIERS — MACHINE LEARNING-ASSISTED CLASSIFICATION: Beyond simple pattern-matching sensitive information types, Purview supports trainable classifiers — machine learning models trained on your organization's own sample content to recognize genuinely more nuanced, less structurally-patterned categories of sensitive information (like a specific type of legal document, or a particular category of internal strategic content) that simple pattern matching alone genuinely can't reliably capture.

LICENSING CONSIDERATIONS FOR SENSITIVITY LABELS: Different levels of sensitivity label capability require different specific M365 licensing tiers — basic manual labeling is broadly available, while automatic labeling, trainable classifiers, and more advanced protection capabilities typically require higher-tier licensing (E5, or specific add-on licenses), directly connecting to the licensing tier concepts covered in this topic's existing M365 Licensing lesson.

THE PRACTICAL TAKEAWAY: Sensitivity labels are what makes data classification genuinely actionable and enforceable within M365, rather than purely an organizational policy document that depends entirely on consistent, correct human judgment with no actual technical backing or enforcement mechanism at all.

Beyond the baseline anti-spam and anti-malware filtering covered in this platform's Exchange topic, Defender for Office 365 provides genuinely advanced threat protection specifically for the email and collaboration attack vectors most commonly exploited against organizations.

WHY EMAIL-SPECIFIC ADVANCED THREAT PROTECTION MATTERS BEYOND BASIC SPAM FILTERING: Basic spam filtering catches obviously malicious or unwanted bulk email — but sophisticated phishing and targeted attacks (covered conceptually in this platform's Security Fundamentals topic) are specifically designed to evade simple pattern-based detection, requiring genuinely more advanced techniques to reliably catch.

SAFE ATTACHMENTS — DETONATING SUSPICIOUS FILES IN A SANDBOX: Rather than relying purely on signature-based scanning of an email attachment, Safe Attachments actually opens and executes suspicious attachments in an isolated, genuinely safe sandbox environment first, observing their actual real behavior before determining whether they're genuinely safe to deliver to the actual intended recipient — catching malware whose signature isn't yet known but whose actual behavior is genuinely malicious once actually run.

SAFE LINKS — REAL-TIME URL PROTECTION AT THE MOMENT OF CLICK: Safe Links rewrites URLs within emails to route through Microsoft's own protection service, checking the destination's actual current reputation at the genuine moment a user actually clicks — critically, this happens at click-time, not merely at the moment the email was originally received, since a URL that was genuinely safe when the email first arrived could have since been compromised or repurposed for malicious use by the time someone actually clicks it later.

ANTI-PHISHING POLICIES — SPECIFICALLY TARGETING IMPERSONATION ATTEMPTS: Beyond general spam/malware detection, Defender's anti-phishing capability specifically detects impersonation attempts — an email claiming to be from your own CEO but actually originating from an external, unrelated domain, or a domain deliberately designed to closely resemble a genuinely trusted partner's actual domain — directly connecting to the business email compromise concepts covered in this platform's Security+ topic.

ATTACK SIMULATION TRAINING — BUILDING ON THE SECURITY AWARENESS CONCEPTS COVERED ELSEWHERE: Defender for Office 365 includes built-in capability for running simulated phishing campaigns against your own organization's users, directly connecting to the security awareness training concepts covered in this platform's Security Fundamentals topic — letting you run this kind of training directly within the M365 ecosystem rather than needing an entirely separate, disconnected third-party simulation tool.

THREAT EXPLORER — INVESTIGATING ACTUAL DETECTED THREATS: Threat Explorer provides a centralized view for investigating actual detected threats across your tenant — which specific users received a particular malicious email, whether they actually clicked a malicious link, and letting an admin take direct remediation action (like removing a malicious email from every recipient's mailbox after the fact) directly from within this same investigation interface.

AUTOMATED INVESTIGATION AND RESPONSE (AIR): Beyond purely manual investigation, Defender for Office 365's AIR capability can automatically investigate certain alert types and, depending on configuration, take genuinely automated remediation action — directly connecting to the automated recovery and response concepts covered in this platform's Endpoint Management and OpCon topics, just applied here specifically to email-based threats rather than endpoint or batch job failures.

LICENSING TIERS — PLAN 1 VS. PLAN 2: Defender for Office 365 Plan 1 provides the core Safe Attachments, Safe Links, and anti-phishing capability. Plan 2 adds Threat Explorer, Attack Simulation Training, and Automated Investigation and Response — genuinely worth understanding this tier distinction when evaluating what licensing level actually meets your organization's specific security requirements and budget.

THE PRACTICAL TAKEAWAY: Defender for Office 365 represents the specific, purpose-built layer addressing email and collaboration-based threats within the broader M365 security ecosystem — directly complementing, rather than duplicating, the endpoint-focused security capabilities covered in this platform's Endpoint Management topic.

M365 presents administrators with several genuinely different group types, and choosing the correct one for a given scenario matters — this lesson provides the clear comparison this platform's other lessons have referenced but not yet fully, directly addressed.

DISTRIBUTION GROUPS — THE SIMPLEST, EMAIL-ONLY OPTION: A Distribution Group exists purely to route email to multiple recipients simultaneously — sending to the group's email address delivers to every member. It provides no shared resources, no shared calendar, no collaborative workspace at all — genuinely just a mailing list mechanism, nothing more.

SECURITY GROUPS — ACCESS CONTROL, WITH OPTIONAL EMAIL CAPABILITY: A Security Group is primarily used for granting access to resources — SharePoint sites, applications, specific permissions — and can optionally also be mail-enabled, letting it additionally function as a distribution list while still primarily serving its core access-control purpose.

M365 GROUPS — THE MODERN, COLLABORATION-FOCUSED OPTION: An M365 Group (sometimes still referred to by its older name, Office 365 Group) provisions a genuinely complete set of shared collaboration resources simultaneously — a shared mailbox and calendar, a SharePoint site and document library, a Planner plan, and optionally an underlying Teams team — all created together automatically the moment the group itself is created.

WHY M365 GROUPS UNDERLIE MICROSOFT TEAMS SPECIFICALLY: Every Microsoft Team is actually built on top of an M365 Group behind the scenes — creating a new Team automatically creates the underlying M365 Group (with all its associated resources), and this relationship is worth understanding since it explains why deleting a Team also removes its associated SharePoint site, shared mailbox, and other group resources together as one connected unit, not as separate, independent pieces.

CHOOSING THE RIGHT GROUP TYPE FOR A GIVEN SCENARIO: Need purely to email a defined list of people, nothing more? Distribution Group. Need to grant access to a specific resource, optionally with email capability too? Security Group. Need a genuinely complete collaborative workspace — shared files, shared calendar, group chat — for an actual working team? M365 Group (likely provisioned through creating a Team, which handles this automatically).

DYNAMIC MEMBERSHIP — AVAILABLE FOR BOTH SECURITY AND M365 GROUPS: As covered conceptually in this platform's Active Directory topic regarding dynamic groups, both Security Groups and M365 Groups in Azure AD support dynamic membership rules, automatically adding or removing members based on defined attribute criteria (department, job title, location) rather than requiring purely manual, ongoing membership management.

GROUP EXPIRATION POLICIES — PREVENTING M365 GROUP SPRAWL: Given how easily end users can self-service create new M365 Groups (and their associated Teams), organizations commonly configure group expiration policies, automatically prompting group owners to confirm a group is still genuinely needed after a defined period, and archiving or deleting genuinely abandoned, unused groups — directly connecting to the broader concern about accumulated, unmanaged sprawl covered elsewhere on this platform in different contexts.

NAMING POLICIES AND GOVERNANCE FOR SELF-SERVICE GROUP CREATION: Organizations can configure naming policies (automatically prefixing or suffixing group names according to a defined convention) and can restrict which users are actually permitted to self-service create new M365 Groups at all — directly applying the same governance thinking covered throughout this platform to the genuinely real risk of ungoverned group sprawl if self-service creation is left entirely unrestricted.

THE PRACTICAL TAKEAWAY: Understanding these three genuinely distinct group types — and specifically recognizing that Teams sits on top of M365 Groups, not as a separate, independent construct — resolves a lot of otherwise genuinely confusing behavior new M365 administrators frequently encounter when first working with groups, permissions, and Teams together.

When an organization faces litigation, a regulatory investigation, or an internal HR matter requiring evidence, eDiscovery is the M365 capability for finding, preserving, and exporting genuinely relevant content — directly connecting to the digital forensics and legal hold concepts covered in this platform's Security+ and OpCon topics.

WHY eDISCOVERY EXISTS AS A DEDICATED M365 CAPABILITY: Relevant content for a legal or investigative matter could genuinely be scattered across email, SharePoint documents, OneDrive files, and Teams messages — eDiscovery provides a unified way to search across all of these locations simultaneously, rather than needing to separately search each individual service using entirely different tools and interfaces.

CONTENT SEARCH — THE FOUNDATIONAL SEARCH CAPABILITY: Content Search lets you search across mailboxes, SharePoint sites, and OneDrive accounts using keywords, date ranges, and sender/recipient criteria — the basic building block underlying more sophisticated eDiscovery workflows, genuinely useful even for simpler, more routine searches not necessarily tied to a formal legal matter.

eDISCOVERY (STANDARD) — CASE-BASED ORGANIZATION: eDiscovery cases let you organize a specific search and its associated legal hold within a defined "case," keeping everything related to one specific legal or investigative matter genuinely organized together, rather than having disconnected, unorganized searches scattered across the tenant with no clear connection to the actual matter they relate to.

eDISCOVERY (PREMIUM) — ADVANCED CAPABILITY FOR COMPLEX MATTERS: The Premium tier adds genuinely more sophisticated capability — custodian management (tracking which specific individuals are relevant to a given matter and their associated hold status), review sets with advanced filtering and analytics, and the ability to actually export content in formats appropriate for legal review platforms, appropriate for genuinely larger, more complex litigation matters beyond what Standard's simpler capability comfortably handles.

LEGAL HOLD — PRESERVING CONTENT BEFORE IT'S ROUTINELY DELETED: As introduced in this platform's Security+ topic, a legal hold suspends normal retention and deletion policies for content relevant to an anticipated or active legal matter — within M365, this can be applied at the mailbox, SharePoint site, or OneDrive account level, ensuring relevant content survives even if a user or an automated retention policy would otherwise have deleted it during the hold period.

CUSTODIAN-BASED HOLDS — TRACKING SPECIFIC INDIVIDUALS' CONTENT: In eDiscovery Premium specifically, a "custodian" represents a specific individual whose content is relevant to a given matter — placing a hold on a custodian automatically covers their mailbox, OneDrive, and other associated content locations together, rather than requiring separately, manually configuring holds across each individual content location one at a time.

WHY INVOLVING LEGAL COUNSEL IN eDISCOVERY WORKFLOWS MATTERS: Just as covered for digital forensics generally in this platform's Security+ topic, eDiscovery work with genuine legal implications should genuinely involve legal counsel — determining the appropriate scope of a search and hold, and ensuring the process itself is conducted in a way that will genuinely hold up if challenged later, isn't purely a technical IT decision made in isolation.

ROLE-BASED ACCESS FOR eDISCOVERY: Given eDiscovery's access to potentially genuinely sensitive content across the entire organization, role-based access control (directly connecting to least-privilege principles covered throughout this platform) is genuinely critical — eDiscovery Manager and eDiscovery Administrator roles provide appropriately scoped access, ensuring not every IT admin automatically has the ability to search and export potentially sensitive content across the entire tenant.

THE PRACTICAL TAKEAWAY: eDiscovery is specialized, genuinely high-stakes functionality that most M365 administrators won't use routinely day-to-day, but understanding what it does and how it connects to legal hold and content search capability is valuable foundational knowledge for when a genuine legal or investigative need actually arises.

M365 is a genuinely constantly-evolving service, with Microsoft regularly rolling out new features, deprecating old ones, and occasionally experiencing service disruptions — the Service Health dashboard and Message Center are the tools admins use to stay genuinely informed about all of this.

SERVICE HEALTH — TRACKING CURRENT AND RECENT INCIDENTS: The Service Health dashboard shows the current operational status of every M365 service your tenant actually uses, and provides detailed information about any ongoing or recent incidents — genuinely the first place to check when users report a widespread problem, helping quickly distinguish "this is a known Microsoft-side issue already being addressed" from "this is something specific to our own tenant configuration that we genuinely need to investigate ourselves."

WHY CHECKING SERVICE HEALTH FIRST SAVES GENUINE TROUBLESHOOTING TIME: If Exchange Online is experiencing a broader Microsoft-side outage, spending time troubleshooting your own tenant's specific mail flow configuration would be genuinely wasted effort — Service Health quickly confirms whether a reported problem is actually a known, broader issue Microsoft is already actively working to resolve, redirecting your troubleshooting energy appropriately.

THE MESSAGE CENTER — PROACTIVE NOTIFICATION OF UPCOMING CHANGES: The Message Center provides advance notice of planned changes — new features rolling out, existing features being deprecated or modified, and changes to default behavior that could genuinely affect your organization's users if you're not proactively aware and prepared for them in advance.

WHY PROACTIVELY MONITORING THE MESSAGE CENTER MATTERS: M365's continuous update cadence means genuinely significant changes can roll out with only weeks (sometimes even less) of advance notice — an admin who doesn't proactively monitor the Message Center risks being caught off guard by a change that genuinely affects users, rather than having had the opportunity to prepare communication, adjust configuration, or provide relevant user training in advance.

FILTERING AND PRIORITIZING MESSAGE CENTER NOTIFICATIONS: Given the genuinely high volume of Message Center notifications for a typical tenant using many M365 services, filtering by service, by category (like specifically security-relevant changes), or by whether a specific notification genuinely requires administrator action helps focus attention on what actually matters most for your specific organization, rather than needing to review every single notification with equal depth and priority.

PLANNING FOR ROADMAP ITEMS BEYOND JUST IMMINENT CHANGES: Beyond notifications about imminent changes, Microsoft also publishes a broader M365 roadmap showing genuinely upcoming features still in development — useful for longer-term planning and understanding the general direction Microsoft is taking specific services, even before those changes reach the more immediate, actionable Message Center notification stage.

SUBSCRIBING TO EMAIL NOTIFICATIONS FOR MESSAGE CENTER UPDATES: Rather than needing to proactively, manually check the Message Center portal on a regular basis, admins can configure email digest notifications, having relevant updates delivered directly rather than requiring active, ongoing manual portal monitoring — genuinely practical for staying informed without needing to remember to actively check yet another separate dashboard.

CORRELATING A REPORTED USER PROBLEM WITH A RECENT MESSAGE CENTER CHANGE: Directly connecting to the "check for recent changes" troubleshooting principle covered throughout this platform, when users report a confusing new problem or unexpected behavior change, checking whether a relevant Message Center notification recently announced a related change is a genuinely reasonable, systematic first troubleshooting step — much faster than assuming the problem is entirely novel and investigating entirely from scratch.

THE PRACTICAL TAKEAWAY: M365's continuous, ongoing evolution means staying informed isn't optional busywork — Service Health and Message Center are the specific tools that let an admin stay genuinely proactive rather than purely reactive, discovering significant changes only after they've already caught users and the admin team completely off guard.

Beyond the cloud services themselves, M365 subscriptions commonly include M365 Apps for Enterprise — the desktop Office application suite — and managing its deployment and updates across an organization requires understanding a few M365-specific concepts beyond simple traditional software installation.

CLICK-TO-RUN — THE MODERN M365 APPS INSTALLATION TECHNOLOGY: Modern M365 Apps use Click-to-Run technology rather than the older traditional MSI-based installation method — applications become usable within moments of installation beginning, with remaining components continuing to stream and install in the background, rather than requiring the entire, complete installation package to finish before the application becomes usable at all.

UPDATE CHANNELS — CONTROLLING HOW FREQUENTLY NEW FEATURES ARRIVE: Current Channel receives new features as soon as they're genuinely ready, updated frequently (multiple times per month). Monthly Enterprise Channel receives features on a predictable monthly cadence, batching changes together rather than delivering them continuously throughout the month. Semi-Annual Enterprise Channel receives new features only twice yearly, providing meaningfully more stability and predictability for organizations that genuinely prefer less frequent change, at the cost of users waiting notably longer for new capability to actually reach them.

CHOOSING THE RIGHT UPDATE CHANNEL FOR YOUR ORGANIZATION: This directly connects to the staged rollout and change management discipline covered throughout this platform — an organization with limited IT capacity for testing frequent changes, or with critical add-ins and workflows genuinely sensitive to Office updates, might reasonably choose Semi-Annual Enterprise Channel, while a more agile organization might prefer Current Channel specifically to get new capability to users as quickly as possible.

THE OFFICE DEPLOYMENT TOOL (ODT) FOR CUSTOMIZED, CONTROLLED DEPLOYMENT: Rather than every user individually downloading and installing M365 Apps themselves from a self-service portal, the Office Deployment Tool lets administrators define a precise configuration (which specific applications to include, which update channel, language settings) and deploy that exact configuration consistently across the organization — directly connecting to the standardized deployment and imaging concepts covered in this platform's Endpoint Management and Windows Admin topics.

INTEGRATING M365 APPS DEPLOYMENT WITH ENDPOINT MANAGEMENT TOOLS: M365 Apps deployment and update management can be centrally controlled through Microsoft Intune or, in on-premise/hybrid scenarios, through Configuration Manager — directly connecting to the endpoint management concepts covered in this platform's dedicated Endpoint Management topic, applied here specifically to managing the M365 Apps suite rather than general third-party application deployment.

MONITORING UPDATE COMPLIANCE ACROSS THE FLEET: Just as covered for general patch compliance monitoring elsewhere on this platform, having genuine visibility into which specific machines are actually current on the configured M365 Apps update channel — and which have fallen behind, and specifically why — is essential for maintaining a consistent, predictable, properly supported application experience across the organization.

SHARED COMPUTER ACTIVATION — FOR REMOTE DESKTOP AND SHARED MACHINE SCENARIOS: For scenarios where multiple different users share the same physical or virtual machine (a remote desktop server, a shared kiosk-style workstation), Shared Computer Activation lets M365 Apps activate correctly for whichever specific user is currently signed in, rather than the license being tied to one single specific machine the way standard activation typically works.

REMOVING OLDER OFFICE VERSIONS BEFORE M365 APPS INSTALLATION: The Office Deployment Tool includes capability for automatically removing older, previously-installed versions of Office (MSI-based Office 2016, for instance) as part of the actual M365 Apps installation process — genuinely important since running multiple different Office versions side by side on the same machine can cause real compatibility conflicts and confusing behavior for end users.

THE PRACTICAL TAKEAWAY: M365 Apps deployment, while conceptually similar to general software deployment covered elsewhere on this platform, has its own genuinely specific considerations — update channels, Click-to-Run technology, shared computer activation — worth understanding specifically, rather than assuming it's simply identical to deploying any other standard third-party desktop application.

A user reports that colleagues are receiving emails they didn't send. Their account is likely compromised.

RESET THE PASSWORD: M365 admin center > Users > select user > Reset password The attacker's stolen credentials no longer work.

REVOKE MFA: Entra ID > Users > user > Authentication Methods > delete all registered devices. The attacker may have registered their own phone as MFA.

INVESTIGATE — what did they do? compliance.microsoft.com > Audit > New Search All activity by this user in the past 30 days. Look for: • Emails sent (data exfiltration?) • Files downloaded • Admin actions taken

CHECK FOR FORWARDING RULES — critical step often missed: Attackers almost always create inbox rules to secretly forward emails to themselves. Exchange admin center > find the mailbox > Manage mailbox > Inbox rules. Delete any rules the user didn't create, especially any forwarding to external addresses.

RESTORE ACCESS: Re-enable sign-in, have the user re-register MFA, let them back in. Document everything with timestamps.

A new project team needs a collaborative space with document storage, controlled access, and version tracking. Here is the complete setup workflow.

Step 1 — Create the Team Site SharePoint home (sharepoint.com) > + Create site > Team site Name: Marketing Projects Privacy: Private (members must be added manually) This also creates a Microsoft 365 Group, Teams workspace, shared mailbox, and Planner board automatically.

Step 2 — Set permissions correctly Click the Settings gear > Site permissions Site Owners: Marketing IT contacts and the team lead Site Members: All Marketing staff who need to edit Site Visitors: Senior leadership who need read-only access

Best practice: add AD security groups (Marketing-Staff, Leadership-Group) instead of individual users. When someone joins or leaves those AD groups, their SharePoint access updates automatically.

Step 3 — Create document libraries with versioning The default Documents library already exists. Configure it: Settings gear > Library settings > Versioning settings • Version history: Yes (keep major versions — unlimited recommended for SharePoint Online) • Require Check Out: No (enable co-authoring for the team)

Create additional libraries as needed: Meeting Notes, Proposals, Templates

Step 4 — Set column metadata on the library Add columns to the Proposals library for better organization: + Add column > Choice > "Status" (Draft, Under Review, Approved, Archived) + Add column > Person > "Project Owner" + Add column > Date and time > "Deadline"

Now every document can be tagged and filtered by status, owner, and deadline.

Step 5 — Connect to Teams Go to Teams > + Add a tab in the relevant channel > SharePoint > select the site The team can now access SharePoint files directly from Teams without leaving the app.

Step 6 — Verify access is working Have a test user (member) try to edit a document — should work. Have a test user (visitor) try to edit — should see read-only. Confirm version history is recording by making and saving a small change.

Result: A properly governed SharePoint site with controlled access, version tracking, and Teams integration — matching the way professional organizations deploy SharePoint.