Article · Microsoft 365
Microsoft 365 administration best practices for growing organizations
Good Microsoft 365 administration is mostly invisible: new staff are productive on day one, departing staff lose access on their last day, licences match headcount and nobody wonders who owns a Team. Here are the routines that make that happen.
- Published
- 7 min read
On this page
Key takeaways
- Standardize joiner, mover and leaver processes with checklists so every account is created and removed the same way.
- Administer with separate, least-privilege admin accounts and delegate routine tasks with narrow roles.
- Review licences monthly to catch unused seats and mismatched plans.
- Govern Teams, groups and SharePoint sites with naming, ownership and lifecycle rules before sprawl sets in.
- Track Message center and Service health, record changes, and keep tenant documentation current.
- Use Microsoft Graph PowerShell for repeatable tasks; older modules have been retired or deprecated.
Onboarding: get new staff productive on day one
Onboarding is where inconsistencies begin. A standard process removes guesswork and makes later offboarding cleaner.
Request with the right details
Require a manager’s request with start date, role, department, manager, location, required applications and shared resources. Use it as the record of approved access.
Create the identity consistently
Follow a naming convention for user principal names and display names, populate department, title, manager and office attributes, and assign licences through group-based licensing where available.
Grant access through groups
Add the user to role-based security and Microsoft 365 groups rather than granting permissions to individual files, mailboxes or sites.
Prepare authentication
Issue a Temporary Access Pass or a supervised first sign-in so the user registers MFA securely, and have their managed device ready.
Confirm and document
Verify sign-in, mailbox, Teams, required apps and shared drive access on day one, and close the request with what was granted.
Offboarding checklist
Offboarding is a security control. Agree the timing with the manager or HR, particularly for involuntary departures, and work through each step.
- Block sign-in and revoke all active sessions at the agreed time, then reset the password.
- Remove registered MFA methods and any app passwords or devices registered to the user.
- Remove the user from groups, Teams, distribution lists and admin roles, and transfer ownership of any groups or Teams they owned.
- Convert the mailbox to a shared mailbox or set up forwarding or delegate access for the manager as agreed, and set an automatic reply if appropriate.
- Transfer or grant manager access to OneDrive content before the retention window for deleted users expires.
- Wipe or retire company devices through Intune and selectively wipe company data from personal phones.
- Remove licences once data has been handled, and record the date and steps taken.
- Review shared credentials, third-party application accounts and external services the person had access to outside Microsoft 365.
Administer with least privilege
Every administrator should use a separate administrative account, not their daily mailbox account. Cloud-only admin accounts without mailboxes reduce the risk that a phishing email or a compromised on-premises directory gives an attacker control of the tenant.
Microsoft 365 offers many built-in roles. A help desk technician who resets passwords needs Helpdesk Administrator or Authentication Administrator, not Global Administrator. Someone managing mailboxes needs Exchange Administrator. Billing staff can have Billing Administrator. Keep Global Administrator for a very small number of people and for tasks that genuinely require it. Review role assignments quarterly and remove any that are no longer needed.
If you work with an IT provider, use granular delegated admin privileges (GDAP) with time-limited, role-specific relationships rather than broad standing access, and review those relationships when your provider arrangements change.
Keep licences aligned with reality
Licence drift is common. Former employees keep paid seats, staff are assigned plans with features they never use, or some users have Business Standard while others have Business Premium for no documented reason, leaving security policies applied unevenly.
Review licence assignments monthly against your staff list. Use group-based licensing so licences follow role membership. Distinguish users who need full desktop apps from those who only need web and mobile access. Check renewal dates and commitment terms before making changes, because annual commitments may limit when seats can be reduced. Shared mailboxes and resource mailboxes do not usually need a licence within Microsoft’s size and feature limits, so avoid licensing them by default.
Governance for Teams, groups and SharePoint
Without a few rules, collaboration spaces multiply quickly and nobody knows which is current or who owns them.
Decide who can create Teams
Either allow everyone with clear guidance, or restrict creation to a group and use a simple request process. Both work; ad hoc decisions do not.
Naming and ownership
Use a naming policy or convention, such as a department or client prefix, and require at least two owners for every Team or group so one departure does not orphan it.
Lifecycle and expiry
Use group expiration policies or periodic reviews so owners confirm a Team is still needed, and archive completed project spaces.
External access
Decide which Teams may include guests, how guest access is reviewed, and whether sensitive sites should block external sharing entirely.
Track changes, service updates and documentation
Microsoft changes Microsoft 365 continuously. The Message center in the admin centre announces upcoming feature changes and retirements, and Service health shows current incidents and advisories. Assign someone to review both weekly, decide which changes affect your users, and communicate ahead of time when something visible is coming.
Keep a simple change log for tenant-level settings: what changed, when, who approved it and why. When a policy causes an unexpected problem months later, that record saves hours of investigation. Combined with the unified audit log, it also makes security reviews far easier.
Maintain tenant documentation covering domains and DNS records, licensing, Conditional Access policies, admin role holders, emergency access accounts and where their credentials are stored, retention policies, third-party applications with tenant access and vendor contacts. Documentation should belong to the organization, not to an individual or a provider.
Automate the repetitive parts
Repeated manual tasks invite inconsistency. Microsoft Graph PowerShell is the current supported module for scripting user, group and licence administration, replacing the older MSOnline and AzureAD modules, which Microsoft has retired or deprecated. Exchange Online PowerShell remains the tool for mailbox and mail flow settings.
Start small: a script that reports users without MFA registration, unlicensed mailboxes, guests who have not signed in for months or groups without owners. Run reports on a schedule and review them. As confidence grows, automate parts of onboarding and offboarding, keeping a human approval step for anything that grants or removes access.
A simple monthly admin routine
Reconcile licences with staff lists, review admin role assignments and guest accounts, check Secure Score and Message center items, confirm backup reports, review sign-in risk and audit alerts, and update documentation for anything that changed.
Frequently asked questions
Should we convert a departed employee’s mailbox to a shared mailbox?
Often, yes. Converting lets a manager access past correspondence without paying for a licence, provided the mailbox stays within Microsoft’s limits for unlicensed shared mailboxes. Remove access once it is no longer needed.
How many Global Administrators should we have?
As few as practical, usually two or three including an emergency access account, with everyone else using narrower roles. Microsoft recommends keeping the number small.
Who should own Microsoft 365 administration in a small business?
Someone accountable, whether an internal IT person, an operations lead with support from a provider, or a managed IT provider under a written scope. What matters is clear ownership and documented processes.
How often should we review guest accounts?
At least quarterly. Remove guests who no longer need access and those who have not signed in for an extended period, and confirm Team owners still want their external members.
Related services
Products and packages
Hand off Microsoft 365 administration with confidence
Our Microsoft 365 administration service covers user lifecycle, licences, mailboxes, Teams and sharing settings under a written scope, with documentation that stays yours.