Microsoft 365 Tenant Setup

A Microsoft 365 tenant is a dedicated, isolated instance of Microsoft 365 services (Exchange Online, SharePoint Online, Teams, etc.) created for your organization. It acts as a boundary for identity, security, and compliance policies. Tenants are created when you sign up for a Microsoft 365 subscription; each tenant is associated with a primary domain (e.g., contoso.onmicrosoft.com) and can be linked to one or more custom domains (e.g., contoso.com). The tenant is hosted in a specific geographic region (e.g., North America, Europe, Asia Pacific) based on the country selected during sign-up, which determines where your data is stored at rest.

When you initiate tenant creation via the Microsoft 365 admin center, the following occurs: 1. Identity provisioning: Microsoft Entra ID (formerly Azure AD) creates a new directory with a globally unique tenant ID (a GUID). The directory includes the default domain (tenantname.onmicrosoft.com). 2. Subscription assignment: Based on the plan selected (e.g., Business Premium, E3, E5), licenses are allocated to the tenant. These licenses are managed via the Microsoft 365 admin center or the Microsoft 365 admin center API. 3. Service activation: Exchange Online, SharePoint Online, Teams, and other services are provisioned. For Exchange, a default mailbox is created for the initial global admin. SharePoint Online creates a default site collection at https://tenantname.sharepoint.com. 4. DNS integration: If you add a custom domain, you must verify ownership by adding a TXT record to your public DNS zone. Microsoft periodically checks for this record; once found, the domain is verified and can be set as the default. 5. Initial admin account: The first user created during sign-up becomes the global admin. This account is critical and should be secured with MFA immediately.

- Get-MgOrganization (Microsoft Graph PowerShell): Retrieves tenant details including ID, display name, and verified domains.

Connect-MgGraph -Scopes Organization.Read.All
  Get-MgOrganization | Select-Object Id, DisplayName, VerifiedDomains

- Get-MsolDomain (MSOnline module, legacy): Lists domains and verification status.

Connect-MsolService
  Get-MsolDomain | Where-Object {$_.Status -eq 'Verified'}

- Set-MsolDomain (MSOnline): Sets a domain as the default for new users.

Set-MsolDomain -Name contoso.com -IsDefault $true

- New-MgDomain (Graph): Adds a new custom domain to the tenant.

New-MgDomain -Id contoso.com

- Confirm-MgDomain (Graph): Initiates verification.

Confirm-MgDomain -DomainId contoso.com -VerificationCode 'MS=ms12345678'

For bulk operations, use the Microsoft Graph PowerShell SDK:

# Add multiple users from CSV
Import-Csv -Path users.csv | ForEach-Object {
    New-MgUser -DisplayName $_.DisplayName -UserPrincipalName $_.UserPrincipalName -PasswordProfile @{Password=$_.Password} -MailNickname $_.MailNickname -UsageLocation $_.UsageLocation
}

# Assign license
Set-MgUserLicense -UserId user@contoso.com -AddLicenses @{SkuId='contoso:ENTERPRISEPREMIUM'} -RemoveLicenses @()

Candidates often confuse the TXT record used for verification with the MX record used for mail routing. The exam will test that verification only requires a TXT record. MX, CNAME, and SRV records are for service functionality after verification. Also, verification must be completed within 72 hours, but the exam may say 15 minutes—that's the propagation time, not the verification timeout. The actual timeout is 72 hours.

Tenant setup is the first step in any Microsoft 365 deployment. Understanding the sequence, dependencies, and default behaviors is critical for the MS-102 exam and real-world administration. Focus on domain verification, initial security configuration, and license management. Use PowerShell for efficiency and consistency.

A multinational corporation with 50,000 employees acquires a smaller company. The IT team needs to set up a new Microsoft 365 tenant for the subsidiary while maintaining isolation from the parent tenant. After signing up for an Enterprise E5 subscription, they add the subsidiary's custom domain (subsidiary.com). They verify the domain, then configure DNS records for mail flow. They create 5,000 users via CSV import using PowerShell, assigning licenses and setting UsageLocation based on employee country. They create security groups for departments and configure conditional access policies to require MFA for all external access. They also set up a hybrid identity with Azure AD Connect to sync from the subsidiary's on-premises AD. Performance considerations: DNS propagation for the custom domain took 2 hours due to TTL settings; mail flow started immediately after MX record update. A common issue: the subsidiary's domain was previously used for a trial tenant, causing verification failure. They had to delete the old tenant or use a subdomain.

A 50-person marketing agency migrates from Google Workspace to Microsoft 365 Business Premium. The administrator signs up for a new tenant, adds their custom domain (agency.com), and verifies it. They then configure DNS records: MX to Microsoft 365, CNAME for autodiscover, and SPF to include both Google and Microsoft 365 during migration. They create users manually, assigning licenses. They enable security defaults and set up SSPR. The migration of email is done using Microsoft's cutover migration tool. The biggest challenge was ensuring DNS TTLs were lowered before the cutover to minimize propagation delays. After migration, they set the custom domain as default and removed the onmicrosoft.com domain from user UPNs. A mistake they almost made: forgetting to add the SPF record for Microsoft 365, which would cause email spoofing issues.

A university with 30,000 students and 5,000 staff sets up a Microsoft 365 A3 tenant for education. They sign up using the education verification process (submitting proof of domain ownership). They add the university's domain (university.edu) and verify via TXT record. They configure DNS records, including MX for Exchange Online and CNAME for Teams. They create student and staff users via CSV, assigning appropriate licenses (A3 for students and staff). They configure group-based licensing: students get licenses based on their enrollment group. Security settings include conditional access policies that block access from non-corporate devices for staff but allow student access from any device. They also enable Microsoft 365 Groups for collaboration. A key consideration: the university's domain was already federated with another identity provider; they had to coordinate domain verification with the federation team. The exam often tests that education tenants require domain verification and proof of eligibility.