Ms365 Tenant Manager

Microsoft 365 Tenant Manager

The agent generates production-ready PowerShell scripts for M365 tenant setup, bulk user provisioning, Conditional Access policies, security audits, and license management. It automates user lifecycle operations (onboarding, offboarding), recommends license SKUs by role, and produces 7-category security audit reports via Microsoft Graph.

---

Quick Start

Generate Security Audit Script

python scripts/powershell_generator.py --action audit --output audit_script.ps1

Create Bulk User Provisioning Script

python scripts/user_management.py --action provision --csv users.csv --license E3

Configure Conditional Access Policy

python scripts/powershell_generator.py --action conditional-access --require-mfa --include-admins

---

Tools

powershell_generator.py

Generates ready-to-use PowerShell scripts for Microsoft 365 administration.

Usage:

# Generate security audit script
python scripts/powershell_generator.py --action audit

# Generate Conditional Access policy script
python scripts/powershell_generator.py --action conditional-access \
  --policy-name "Require MFA for Admins" \
  --require-mfa \
  --include-users "All"

# Generate bulk license assignment script
python scripts/powershell_generator.py --action license \
  --csv users.csv \
  --sku "ENTERPRISEPACK"

Parameters:

Output: Complete PowerShell scripts with error handling, logging, and best practices.

user_management.py

Automates user lifecycle operations and bulk provisioning.

Usage:

# Provision users from CSV
python scripts/user_management.py --action provision --csv new_users.csv

# Offboard user securely
python scripts/user_management.py --action offboard --user john.doe@company.com

# Generate inactive users report
python scripts/user_management.py --action report-inactive --days 90

Parameters:

tenant_setup.py

Initial tenant configuration and service provisioning automation.

Usage:

# Generate tenant setup checklist
python scripts/tenant_setup.py --action checklist --company "Acme Inc" --users 50

# Generate DNS records configuration
python scripts/tenant_setup.py --action dns --domain acme.com

# Generate security baseline script
python scripts/tenant_setup.py --action security-baseline

---

Workflows

Workflow 1: New Tenant Setup

Step 1: Generate Setup Checklist

python scripts/tenant_setup.py --action checklist --company "Company Name" --users 100

Step 2: Configure DNS Records

python scripts/tenant_setup.py --action dns --domain company.com

Step 3: Apply Security Baseline

python scripts/powershell_generator.py --action audit > initial_audit.ps1

Step 4: Provision Users

python scripts/user_management.py --action provision --csv employees.csv --license E3

Workflow 2: Security Hardening

Step 1: Run Security Audit

python scripts/powershell_generator.py --action audit --output security_audit.ps1

Step 2: Create MFA Policy

python scripts/powershell_generator.py --action conditional-access \
  --policy-name "Require MFA All Users" \
  --require-mfa \
  --include-users "All"

Step 3: Review Results

Execute generated scripts and review CSV reports in output directory.

Workflow 3: User Offboarding

Step 1: Generate Offboarding Script

python scripts/user_management.py --action offboard --user departing.user@company.com

Step 2: Execute Script with -WhatIf

.\offboard_user.ps1 -WhatIf

Step 3: Execute for Real

.\offboard_user.ps1 -Confirm:$false

---

Best Practices

Tenant Setup

1. Enable MFA before adding users 2. Configure named locations for Conditional Access 3. Use separate admin accounts with PIM 4. Verify custom domains before bulk user creation 5. Apply Microsoft Secure Score recommendations

Security Operations

1. Start Conditional Access policies in report-only mode 2. Use -WhatIf parameter before executing scripts 3. Never hardcode credentials in scripts 4. Enable audit logging for all operations 5. Regular quarterly security reviews

PowerShell Automation

1. Prefer Microsoft Graph over legacy MSOnline modules 2. Include try/catch blocks for error handling 3. Implement logging for audit trails 4. Use Azure Key Vault for credential management 5. Test in non-production tenant first

---

Reference Guides

When to Use Each Reference

references/powershell-templates.md

• Ready-to-use script templates
• Conditional Access policy examples
• Bulk user provisioning scripts
• Security audit scripts

references/security-policies.md

• Conditional Access configuration
• MFA enforcement strategies
• DLP and retention policies
• Security baseline settings

references/troubleshooting.md

• Common error resolutions
• PowerShell module issues
• Permission troubleshooting
• DNS propagation problems

---

Limitations

Required PowerShell Modules

Install-Module Microsoft.Graph -Scope CurrentUser
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Install-Module MicrosoftTeams -Scope CurrentUser

Required Permissions

• Global Administrator - Full tenant setup
• User Administrator - User management
• Security Administrator - Security policies
• Exchange Administrator - Mailbox management

---

Anti-Patterns

• Using admin accounts for daily work -- Global Admin accounts should use PIM (Privileged Identity Management) with JIT activation; use separate accounts for daily tasks
• Skipping report-only mode -- deploying Conditional Access policies directly to enforcement blocks legitimate users; always validate in report-only mode first
• Hardcoding credentials in scripts -- PowerShell scripts with embedded passwords are security incidents waiting to happen; use Azure Key Vault or environment variables
• Using legacy MSOnline module -- MSOnline is deprecated; all new scripts should use Microsoft Graph (Connect-MgGraph)
• No break-glass account -- excluding zero accounts from CA policies means a misconfiguration can lock out all admins; maintain at least one excluded emergency access account
• Bulk operations without -WhatIf -- running bulk user creation or license assignment without dry-run risks mass misconfiguration; always test with -WhatIf first

---

Troubleshooting

---

Success Criteria

• 100% of provisioned users have correct license SKU assigned matching their role and department
• Zero orphaned accounts: every disabled user has licenses removed, mailbox converted to shared, and sessions revoked within 24 hours of offboarding
• MFA enforcement covers 100% of enabled user accounts, verified by security audit script output showing zero users without MFA
• DNS records pass validation for all five service types (MX, SPF, DKIM, autodiscover, device registration) with zero propagation errors
• Conditional Access policies achieve report-only validation with less than 1% false-positive block rate before enforcement
• License utilization stays above 90% across all SKUs, with unused licenses identified and reclaimed quarterly
• Security audit generates complete CSV reports for all 7 audit categories (MFA, admin roles, inactive users, guests, licenses, mailbox delegations, Conditional Access) with zero script errors

---

Scope & Limitations

What This Skill Covers

• Tenant lifecycle management -- initial setup, domain verification, DNS configuration, security baseline, and service provisioning for Exchange Online, SharePoint, Teams, and OneDrive
• User lifecycle automation -- bulk provisioning from CSV, license assignment by role/department, group membership recommendations, secure offboarding with mailbox preservation
• Security and compliance -- Conditional Access policy generation, MFA enforcement, comprehensive 7-category security audits, and audit log enablement
• PowerShell script generation -- production-ready scripts with error handling, logging, -WhatIf support, and Microsoft Graph best practices

What This Skill Does NOT Cover

• Hybrid identity (AD Connect) -- on-premises Active Directory synchronization and pass-through authentication require the senior-devops skill and Microsoft AD Connect tooling
• Intune device management -- endpoint compliance policies, app deployment, and mobile device management are outside scope; see senior-secops for device security posture
• Power Platform administration -- Power Apps, Power Automate, and Power BI tenant-level governance fall under separate platform administration
• Third-party SSO and SCIM provisioning -- integration with non-Microsoft identity providers (Okta, Ping, Auth0) requires dedicated identity engineering

---

Integration Points

---

Tool Reference

powershell_generator.py

Purpose: Generates production-ready PowerShell scripts for Microsoft 365 administration including security audits, Conditional Access policies, and bulk license assignment.

Module: PowerShellScriptGenerator class (import and instantiate, not a CLI tool)

Initialization:

from powershell_generator import PowerShellScriptGenerator

generator = PowerShellScriptGenerator(tenant_domain="company.com")

Methods:

generate_security_audit_script()

Generates a comprehensive 7-category security audit PowerShell script that checks MFA status, admin role assignments, inactive users, guest users, license usage, mailbox delegations, and Conditional Access policies.

Example:

generator = PowerShellScriptGenerator("company.com")
script = generator.generate_security_audit_script()
print(script)  # Complete PowerShell script with Connect-MgGraph, 7 audit checks, CSV export

Output: PowerShell script string that produces CSV reports in a timestamped SecurityAudit_ directory: MFA_Status.csv, Admin_Roles.csv, Inactive_Users.csv, Guest_Users.csv, License_Usage.csv, Mailbox_Delegations.csv, ConditionalAccess_Policies.csv.

generate_conditional_access_policy_script(policy_config)

Generates a PowerShell script to create a Conditional Access policy in report-only mode.

Example:

script = generator.generate_conditional_access_policy_script({
    "name": "Require MFA for Admins",
    "require_mfa": True,
    "include_users": "All",
    "exclude_users": ["breakglass@company.com"]
})

Output: PowerShell script string that creates a Conditional Access policy via New-MgIdentityConditionalAccessPolicy in enabledForReportingButNotEnforced state.

generate_bulk_license_assignment_script(users_csv_path, license_sku)

Generates a PowerShell script for assigning a license SKU to users listed in a CSV file.

Example:

script = generator.generate_bulk_license_assignment_script("users.csv", "ENTERPRISEPACK")

Output: PowerShell script string that imports the CSV, checks for existing licenses, assigns the specified SKU, and exports results to LicenseAssignment_Results_<timestamp>.csv with Status and Message columns.

---

user_management.py

Purpose: Manages user lifecycle operations including bulk provisioning, secure offboarding, license recommendations, group membership, and data validation.

Module: UserLifecycleManager class (import and instantiate, not a CLI tool)

Initialization:

from user_management import UserLifecycleManager

manager = UserLifecycleManager(domain="company.com")

Methods:

generate_user_creation_script(users)

Generates a PowerShell script for bulk user provisioning with license assignment.

Example:

script = manager.generate_user_creation_script([
    {"username": "jdoe", "display_name": "Jane Doe", "first_name": "Jane",
     "last_name": "Doe", "job_title": "Engineer", "department": "Engineering",
     "license_sku": "ENTERPRISEPACK"}
])

Output: PowerShell script string that creates users via New-MgUser, assigns licenses, and exports results to UserCreation_Results_<timestamp>.csv.

generate_user_offboarding_script(user_email)

Generates a comprehensive 11-step secure offboarding PowerShell script.

Example:

script = manager.generate_user_offboarding_script("john.doe@company.com")

Output: PowerShell script string that disables sign-in, revokes sessions, removes group memberships, removes devices, converts mailbox to shared, sets auto-reply, removes licenses, hides from GAL, and exports an offboarding report CSV.

generate_license_assignment_recommendations(user_role, department)

Returns license recommendation based on role and department matching.

Example:

rec = manager.generate_license_assignment_recommendations("Security Analyst", "IT")
# Returns: {"recommended_license": "Microsoft 365 E5", "justification": "...", "features_needed": [...], "monthly_cost": 57.00}

Output: Dictionary with recommended_license, justification, features_needed (list), and monthly_cost (float).

generate_group_membership_recommendations(user)

Recommends security and distribution groups based on user attributes.

Example:

groups = manager.generate_group_membership_recommendations({
    "department": "Engineering", "location": "NYC", "job_title": "Director of Engineering"
})
# Returns: ["DL-Engineering", "SG-Engineering", "SG-Location-Nyc", "SG-Management"]

Output: List of recommended group name strings using naming conventions DL- (distribution list), SG- (security group).

validate_user_data(user_data)

Validates user data before provisioning, checking required fields, username format, and email format.

Example:

result = manager.validate_user_data({"first_name": "Jane", "last_name": "Doe", "username": "jdoe"})
# Returns: {"is_valid": True, "errors": [], "warnings": ["Display name not provided, will use: Jane Doe", ...]}

Output: Dictionary with is_valid (bool), errors (list of strings), and warnings (list of strings).

---

tenant_setup.py

Purpose: Manages initial Microsoft 365 tenant configuration including setup checklists, DNS record generation, PowerShell setup scripts, and license distribution recommendations.

Module: TenantSetupManager class (import and instantiate, not a CLI tool)

Initialization:

from tenant_setup import TenantSetupManager

manager = TenantSetupManager(tenant_config={
    "company_name": "Acme Inc",
    "domain_name": "acme.com",
    "user_count": 50,
    "industry": "technology",
    "compliance_requirements": ["GDPR"],  # optional: "GDPR", "HIPAA"
    "licenses": {}
})

Methods:

generate_setup_checklist()

Generates a phased tenant setup checklist (4-5 phases depending on compliance requirements).

Example:

checklist = manager.generate_setup_checklist()
# Returns list of phase dicts, each with "phase", "name", "priority", "tasks"

Output: List of dictionaries. Each phase contains phase (int), name (str), priority ("critical" or "high"), and tasks (list of dicts with task, details, estimated_time). Phases: Initial Configuration, Custom Domain, Security Baseline, Service Configuration, and optionally Compliance Configuration.

generate_dns_records()

Generates all required DNS records for Microsoft 365 services.

Example:

records = manager.generate_dns_records()
# Keys: "mx_records", "txt_records", "cname_records", "srv_records"

Output: Dictionary with four keys, each containing a list of record dictionaries with type, name, value, ttl, purpose, and record-type-specific fields (priority for MX/SRV, port/weight for SRV).

generate_powershell_setup_script()

Generates a complete PowerShell script for initial tenant configuration covering Graph, Exchange Online, SharePoint, and Teams.

Example:

script = manager.generate_powershell_setup_script()
print(script)  # PowerShell script connecting to Graph, Exchange, Teams with 7 setup steps

Output: PowerShell script string that connects to Microsoft Graph, Exchange Online, and Teams; configures organization settings, security defaults, audit logging, Exchange policies, and Teams messaging policies.

get_license_recommendations()

Calculates license distribution recommendations and cost estimates based on user count and compliance requirements.

Example:

recs = manager.get_license_recommendations()
# Returns: {"recommendations": {...}, "suggested_distribution": {"E5": 5, "E3": 10, ...},
#           "estimated_monthly_cost": 1234.50, "estimated_annual_cost": 14814.00}

Output: Dictionary with recommendations (license tier details), suggested_distribution (dict mapping SKU tier to user count), estimated_monthly_cost (float), and estimated_annual_cost (float). Distribution adjusts automatically when compliance requirements are specified.

PowerShell Script Templates

Ready-to-use PowerShell scripts for Microsoft 365 administration with error handling and best practices.

---

Table of Contents

• Prerequisites
• Security Audit Script
• Conditional Access Policy
• Bulk User Provisioning
• User Offboarding
• License Management
• DNS Records Configuration

---

Prerequisites

Install required modules before running scripts:

# Install Microsoft Graph module (recommended)
Install-Module Microsoft.Graph -Scope CurrentUser -Force

# Install Exchange Online module
Install-Module ExchangeOnlineManagement -Scope CurrentUser -Force

# Install Teams module
Install-Module MicrosoftTeams -Scope CurrentUser -Force

# Verify installations
Get-InstalledModule Microsoft.Graph, ExchangeOnlineManagement, MicrosoftTeams

---

Security Audit Script

Comprehensive security audit for MFA status, admin accounts, inactive users, and permissions.

<#
.SYNOPSIS
    Microsoft 365 Security Audit Report

.DESCRIPTION
    Performs comprehensive security audit and generates CSV reports.
    Checks: MFA status, admin accounts, inactive users, guest access, licenses

.OUTPUTS
    CSV reports in SecurityAudit_[timestamp] directory
#>

#Requires -Modules Microsoft.Graph, ExchangeOnlineManagement

param(
    [int]$InactiveDays = 90,
    [string]$OutputPath = "."
)

# Connect to services
Connect-MgGraph -Scopes "Directory.Read.All", "User.Read.All", "AuditLog.Read.All"
Connect-ExchangeOnline

$timestamp = Get-Date -Format "yyyyMMdd_HHmmss"
$reportPath = Join-Path $OutputPath "SecurityAudit_$timestamp"
New-Item -ItemType Directory -Path $reportPath -Force | Out-Null

Write-Host "Starting Security Audit..." -ForegroundColor Cyan

# 1. MFA Status Check
Write-Host "[1/5] Checking MFA status..." -ForegroundColor Yellow

$users = Get-MgUser -All -Property Id,DisplayName,UserPrincipalName,AccountEnabled
$mfaReport = @()

foreach ($user in $users) {
    $authMethods = Get-MgUserAuthenticationMethod -UserId $user.Id -ErrorAction SilentlyContinue
    $hasMFA = ($authMethods | Where-Object { $_.AdditionalProperties.'@odata.type' -ne '#microsoft.graph.passwordAuthenticationMethod' }).Count -gt 0

    $mfaReport += [PSCustomObject]@{
        UserPrincipalName = $user.UserPrincipalName
        DisplayName       = $user.DisplayName
        AccountEnabled    = $user.AccountEnabled
        MFAEnabled        = $hasMFA
        AuthMethodsCount  = $authMethods.Count
    }
}

$mfaReport | Export-Csv -Path "$reportPath/MFA_Status.csv" -NoTypeInformation
$usersWithoutMFA = ($mfaReport | Where-Object { -not $_.MFAEnabled -and $_.AccountEnabled }).Count
Write-Host "  Users without MFA: $usersWithoutMFA" -ForegroundColor $(if($usersWithoutMFA -gt 0){'Red'}else{'Green'})

# 2. Admin Roles Audit
Write-Host "[2/5] Auditing admin roles..." -ForegroundColor Yellow

$adminRoles = Get-MgDirectoryRole -All
$adminReport = @()

foreach ($role in $adminRoles) {
    $members = Get-MgDirectoryRoleMember -DirectoryRoleId $role.Id -All
    foreach ($member in $members) {
        $memberUser = Get-MgUser -UserId $member.Id -ErrorAction SilentlyContinue
        if ($memberUser) {
            $adminReport += [PSCustomObject]@{
                UserPrincipalName = $memberUser.UserPrincipalName
                DisplayName       = $memberUser.DisplayName
                Role              = $role.DisplayName
                AccountEnabled    = $memberUser.AccountEnabled
            }
        }
    }
}

$adminReport | Export-Csv -Path "$reportPath/Admin_Roles.csv" -NoTypeInformation
Write-Host "  Admin assignments: $($adminReport.Count)" -ForegroundColor Cyan

# 3. Inactive Users
Write-Host "[3/5] Finding inactive users ($InactiveDays+ days)..." -ForegroundColor Yellow

$inactiveDate = (Get-Date).AddDays(-$InactiveDays)
$inactiveUsers = Get-MgUser -All -Property Id,DisplayName,UserPrincipalName,SignInActivity,AccountEnabled |
    Where-Object {
        $_.AccountEnabled -and
        $_.SignInActivity.LastSignInDateTime -and
        $_.SignInActivity.LastSignInDateTime -lt $inactiveDate
    } |
    Select-Object UserPrincipalName, DisplayName,
        @{N='LastSignIn';E={$_.SignInActivity.LastSignInDateTime}},
        @{N='DaysSinceSignIn';E={((Get-Date) - $_.SignInActivity.LastSignInDateTime).Days}}

$inactiveUsers | Export-Csv -Path "$reportPath/Inactive_Users.csv" -NoTypeInformation
Write-Host "  Inactive users: $($inactiveUsers.Count)" -ForegroundColor $(if($inactiveUsers.Count -gt 0){'Yellow'}else{'Green'})

# 4. Guest Users
Write-Host "[4/5] Reviewing guest access..." -ForegroundColor Yellow

$guestUsers = Get-MgUser -Filter "userType eq 'Guest'" -All -Property UserPrincipalName,DisplayName,AccountEnabled,CreatedDateTime
$guestUsers | Select-Object UserPrincipalName, DisplayName, AccountEnabled, CreatedDateTime |
    Export-Csv -Path "$reportPath/Guest_Users.csv" -NoTypeInformation
Write-Host "  Guest users: $($guestUsers.Count)" -ForegroundColor Cyan

# 5. License Usage
Write-Host "[5/5] Analyzing licenses..." -ForegroundColor Yellow

$licenses = Get-MgSubscribedSku -All
$licenseReport = foreach ($lic in $licenses) {
    [PSCustomObject]@{
        ProductName       = $lic.SkuPartNumber
        TotalLicenses     = $lic.PrepaidUnits.Enabled
        AssignedLicenses  = $lic.ConsumedUnits
        AvailableLicenses = $lic.PrepaidUnits.Enabled - $lic.ConsumedUnits
        Utilization       = [math]::Round(($lic.ConsumedUnits / [math]::Max($lic.PrepaidUnits.Enabled, 1)) * 100, 1)
    }
}

$licenseReport | Export-Csv -Path "$reportPath/License_Usage.csv" -NoTypeInformation
Write-Host "  License SKUs: $($licenses.Count)" -ForegroundColor Cyan

# Summary
Write-Host "`n=== Security Audit Summary ===" -ForegroundColor Green
Write-Host "Total Users: $($users.Count)"
Write-Host "Users without MFA: $usersWithoutMFA $(if($usersWithoutMFA -gt 0){'[ACTION REQUIRED]'})"
Write-Host "Inactive Users: $($inactiveUsers.Count)"
Write-Host "Guest Users: $($guestUsers.Count)"
Write-Host "Admin Assignments: $($adminReport.Count)"
Write-Host "`nReports saved to: $reportPath" -ForegroundColor Green

# Disconnect
Disconnect-MgGraph
Disconnect-ExchangeOnline -Confirm:$false

---

Conditional Access Policy

Create Conditional Access policy requiring MFA for administrators.

<#
.SYNOPSIS
    Create Conditional Access Policy for MFA

.DESCRIPTION
    Creates a Conditional Access policy requiring MFA.
    Policy is created in report-only mode for safe testing.

.PARAMETER PolicyName
    Name for the policy

.PARAMETER IncludeAllUsers
    Apply to all users (default: false, admins only)
#>

#Requires -Modules Microsoft.Graph

param(
    [string]$PolicyName = "Require MFA for Administrators",
    [switch]$IncludeAllUsers,
    [switch]$Enforce
)

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess", "Directory.Read.All"

# Get admin role IDs
$adminRoles = @(
    "62e90394-69f5-4237-9190-012177145e10"  # Global Administrator
    "194ae4cb-b126-40b2-bd5b-6091b380977d"  # Security Administrator
    "f28a1f50-f6e7-4571-818b-6a12f2af6b6c"  # SharePoint Administrator
    "29232cdf-9323-42fd-ade2-1d097af3e4de"  # Exchange Administrator
    "fe930be7-5e62-47db-91af-98c3a49a38b1"  # User Administrator
)

# Build conditions
$conditions = @{
    Users = @{
        IncludeRoles = if ($IncludeAllUsers) { $null } else { $adminRoles }
        IncludeUsers = if ($IncludeAllUsers) { @("All") } else { $null }
        ExcludeUsers = @("GuestsOrExternalUsers")
    }
    Applications = @{
        IncludeApplications = @("All")
    }
    ClientAppTypes = @("browser", "mobileAppsAndDesktopClients")
}

# Remove null entries
if ($IncludeAllUsers) {
    $conditions.Users.Remove("IncludeRoles")
} else {
    $conditions.Users.Remove("IncludeUsers")
}

$grantControls = @{
    BuiltInControls = @("mfa")
    Operator = "OR"
}

$state = if ($Enforce) { "enabled" } else { "enabledForReportingButNotEnforced" }

$policyParams = @{
    DisplayName   = $PolicyName
    State         = $state
    Conditions    = $conditions
    GrantControls = $grantControls
}

try {
    $policy = New-MgIdentityConditionalAccessPolicy -BodyParameter $policyParams
    Write-Host "Policy created successfully" -ForegroundColor Green
    Write-Host "  Name: $($policy.DisplayName)"
    Write-Host "  ID: $($policy.Id)"
    Write-Host "  State: $state"

    if (-not $Enforce) {
        Write-Host "`nPolicy is in REPORT-ONLY mode." -ForegroundColor Yellow
        Write-Host "Monitor sign-in logs before enforcing."
        Write-Host "To enforce: Update policy state to 'enabled' in Azure AD portal"
    }
} catch {
    Write-Host "Error creating policy: $_" -ForegroundColor Red
}

Disconnect-MgGraph

---

Bulk User Provisioning

Create users from CSV with license assignment.

<#
.SYNOPSIS
    Bulk User Provisioning from CSV

.DESCRIPTION
    Creates users from CSV file with automatic license assignment.

.PARAMETER CsvPath
    Path to CSV file with columns: DisplayName, UserPrincipalName, Department, JobTitle

.PARAMETER LicenseSku
    License SKU to assign (e.g., ENTERPRISEPACK for E3)

.PARAMETER Password
    Initial password (auto-generated if not provided)
#>

#Requires -Modules Microsoft.Graph

param(
    [Parameter(Mandatory)]
    [string]$CsvPath,

    [string]$LicenseSku = "ENTERPRISEPACK",

    [string]$Password,

    [switch]$WhatIf
)

Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All"

# Validate CSV
if (-not (Test-Path $CsvPath)) {
    Write-Host "CSV file not found: $CsvPath" -ForegroundColor Red
    exit 1
}

$users = Import-Csv $CsvPath
Write-Host "Found $($users.Count) users in CSV" -ForegroundColor Cyan

# Get license SKU ID
$license = Get-MgSubscribedSku -All | Where-Object { $_.SkuPartNumber -eq $LicenseSku }
if (-not $license) {
    Write-Host "License SKU not found: $LicenseSku" -ForegroundColor Red
    Write-Host "Available SKUs:"
    Get-MgSubscribedSku -All | ForEach-Object { Write-Host "  $($_.SkuPartNumber)" }
    exit 1
}

$results = @()
$successCount = 0
$errorCount = 0

foreach ($user in $users) {
    $upn = $user.UserPrincipalName

    if ($WhatIf) {
        Write-Host "[WhatIf] Would create: $upn" -ForegroundColor Yellow
        continue
    }

    # Generate password if not provided
    $userPassword = if ($Password) { $Password } else {
        -join ((65..90) + (97..122) + (48..57) + (33,35,36,37) | Get-Random -Count 16 | ForEach-Object { [char]$_ })
    }

    $userParams = @{
        DisplayName       = $user.DisplayName
        UserPrincipalName = $upn
        MailNickname      = $upn.Split("@")[0]
        AccountEnabled    = $true
        Department        = $user.Department
        JobTitle          = $user.JobTitle
        UsageLocation     = "US"  # Required for license assignment
        PasswordProfile   = @{
            Password                             = $userPassword
            ForceChangePasswordNextSignIn        = $true
            ForceChangePasswordNextSignInWithMfa = $true
        }
    }

    try {
        # Create user
        $newUser = New-MgUser -BodyParameter $userParams
        Write-Host "Created: $upn" -ForegroundColor Green

        # Assign license
        $licenseParams = @{
            AddLicenses = @(@{ SkuId = $license.SkuId })
            RemoveLicenses = @()
        }
        Set-MgUserLicense -UserId $newUser.Id -BodyParameter $licenseParams
        Write-Host "  License assigned: $LicenseSku" -ForegroundColor Cyan

        $successCount++
        $results += [PSCustomObject]@{
            UserPrincipalName = $upn
            Status            = "Success"
            Password          = $userPassword
            Message           = "Created and licensed"
        }
    } catch {
        Write-Host "Error for $upn : $_" -ForegroundColor Red
        $errorCount++
        $results += [PSCustomObject]@{
            UserPrincipalName = $upn
            Status            = "Failed"
            Password          = ""
            Message           = $_.Exception.Message
        }
    }
}

# Export results
if (-not $WhatIf) {
    $resultsPath = "UserProvisioning_$(Get-Date -Format 'yyyyMMdd_HHmmss').csv"
    $results | Export-Csv -Path $resultsPath -NoTypeInformation
    Write-Host "`nResults saved to: $resultsPath" -ForegroundColor Green
    Write-Host "Success: $successCount | Errors: $errorCount"
}

Disconnect-MgGraph

CSV Format:

DisplayName,UserPrincipalName,Department,JobTitle
John Smith,john.smith@contoso.com,Engineering,Developer
Jane Doe,jane.doe@contoso.com,Marketing,Manager

---

User Offboarding

Secure user offboarding with mailbox conversion and access removal.

<#
.SYNOPSIS
    Secure User Offboarding

.DESCRIPTION
    Performs secure offboarding: disables account, revokes sessions,
    converts mailbox to shared, removes licenses, sets forwarding.

.PARAMETER UserPrincipalName
    UPN of user to offboard

.PARAMETER ForwardTo
    Email to forward messages to (optional)

.PARAMETER RetainMailbox
    Keep mailbox as shared (default: true)
#>

#Requires -Modules Microsoft.Graph, ExchangeOnlineManagement

param(
    [Parameter(Mandatory)]
    [string]$UserPrincipalName,

    [string]$ForwardTo,

    [switch]$RetainMailbox = $true,

    [switch]$WhatIf
)

Connect-MgGraph -Scopes "User.ReadWrite.All", "Directory.ReadWrite.All"
Connect-ExchangeOnline

Write-Host "Starting offboarding for: $UserPrincipalName" -ForegroundColor Cyan

$user = Get-MgUser -UserId $UserPrincipalName -ErrorAction SilentlyContinue
if (-not $user) {
    Write-Host "User not found: $UserPrincipalName" -ForegroundColor Red
    exit 1
}

$actions = @()

# 1. Disable account
if (-not $WhatIf) {
    Update-MgUser -UserId $user.Id -AccountEnabled:$false
}
$actions += "Disabled account"
Write-Host "[1/6] Account disabled" -ForegroundColor Green

# 2. Revoke all sessions
if (-not $WhatIf) {
    Revoke-MgUserSignInSession -UserId $user.Id
}
$actions += "Revoked all sessions"
Write-Host "[2/6] Sessions revoked" -ForegroundColor Green

# 3. Reset password
$newPassword = -join ((65..90) + (97..122) + (48..57) | Get-Random -Count 32 | ForEach-Object { [char]$_ })
if (-not $WhatIf) {
    $passwordProfile = @{
        Password                      = $newPassword
        ForceChangePasswordNextSignIn = $true
    }
    Update-MgUser -UserId $user.Id -PasswordProfile $passwordProfile
}
$actions += "Reset password"
Write-Host "[3/6] Password reset" -ForegroundColor Green

# 4. Remove from groups
$groups = Get-MgUserMemberOf -UserId $user.Id -All
$groupCount = 0
foreach ($group in $groups) {
    if ($group.AdditionalProperties.'@odata.type' -eq '#microsoft.graph.group') {
        if (-not $WhatIf) {
            Remove-MgGroupMemberByRef -GroupId $group.Id -DirectoryObjectId $user.Id -ErrorAction SilentlyContinue
        }
        $groupCount++
    }
}
$actions += "Removed from $groupCount groups"
Write-Host "[4/6] Removed from $groupCount groups" -ForegroundColor Green

# 5. Convert mailbox to shared (if retaining)
if ($RetainMailbox) {
    if (-not $WhatIf) {
        Set-Mailbox -Identity $UserPrincipalName -Type Shared
    }
    $actions += "Converted mailbox to shared"
    Write-Host "[5/6] Mailbox converted to shared" -ForegroundColor Green

    # Set forwarding if specified
    if ($ForwardTo) {
        if (-not $WhatIf) {
            Set-Mailbox -Identity $UserPrincipalName -ForwardingAddress $ForwardTo
        }
        $actions += "Mail forwarding set to $ForwardTo"
        Write-Host "  Forwarding to: $ForwardTo" -ForegroundColor Cyan
    }
} else {
    Write-Host "[5/6] Mailbox retention skipped" -ForegroundColor Yellow
}

# 6. Remove licenses
$licenses = Get-MgUserLicenseDetail -UserId $user.Id
if ($licenses -and -not $WhatIf) {
    $licenseParams = @{
        AddLicenses    = @()
        RemoveLicenses = $licenses.SkuId
    }
    Set-MgUserLicense -UserId $user.Id -BodyParameter $licenseParams
}
$actions += "Removed $($licenses.Count) licenses"
Write-Host "[6/6] Removed $($licenses.Count) licenses" -ForegroundColor Green

# Summary
Write-Host "`n=== Offboarding Complete ===" -ForegroundColor Green
Write-Host "User: $UserPrincipalName"
Write-Host "Actions taken:"
$actions | ForEach-Object { Write-Host "  - $_" }

if ($WhatIf) {
    Write-Host "`n[WhatIf] No changes were made" -ForegroundColor Yellow
}

Disconnect-MgGraph
Disconnect-ExchangeOnline -Confirm:$false

---

License Management

Analyze license usage and optimize allocation.

<#
.SYNOPSIS
    License Usage Analysis and Optimization

.DESCRIPTION
    Analyzes current license usage and identifies optimization opportunities.
#>

#Requires -Modules Microsoft.Graph

Connect-MgGraph -Scopes "Directory.Read.All", "User.Read.All"

Write-Host "Analyzing License Usage..." -ForegroundColor Cyan

$licenses = Get-MgSubscribedSku -All

$report = foreach ($lic in $licenses) {
    $available = $lic.PrepaidUnits.Enabled - $lic.ConsumedUnits
    $utilization = [math]::Round(($lic.ConsumedUnits / [math]::Max($lic.PrepaidUnits.Enabled, 1)) * 100, 1)

    [PSCustomObject]@{
        ProductName   = $lic.SkuPartNumber
        Total         = $lic.PrepaidUnits.Enabled
        Assigned      = $lic.ConsumedUnits
        Available     = $available
        Utilization   = "$utilization%"
        Status        = if ($utilization -gt 90) { "Critical" }
                       elseif ($utilization -gt 75) { "Warning" }
                       elseif ($utilization -lt 50) { "Underutilized" }
                       else { "Healthy" }
    }
}

$report | Format-Table -AutoSize

# Find users with unused licenses
Write-Host "`nChecking for inactive licensed users..." -ForegroundColor Yellow

$inactiveDate = (Get-Date).AddDays(-90)
$inactiveLicensed = Get-MgUser -All -Property Id,DisplayName,UserPrincipalName,SignInActivity,AssignedLicenses |
    Where-Object {
        $_.AssignedLicenses.Count -gt 0 -and
        $_.SignInActivity.LastSignInDateTime -and
        $_.SignInActivity.LastSignInDateTime -lt $inactiveDate
    } |
    Select-Object DisplayName, UserPrincipalName,
        @{N='LastSignIn';E={$_.SignInActivity.LastSignInDateTime}},
        @{N='LicenseCount';E={$_.AssignedLicenses.Count}}

if ($inactiveLicensed) {
    Write-Host "Found $($inactiveLicensed.Count) inactive users with licenses:" -ForegroundColor Yellow
    $inactiveLicensed | Format-Table -AutoSize
} else {
    Write-Host "No inactive licensed users found" -ForegroundColor Green
}

# Export
$report | Export-Csv -Path "LicenseAnalysis_$(Get-Date -Format 'yyyyMMdd').csv" -NoTypeInformation

Disconnect-MgGraph

---

DNS Records Configuration

Generate DNS records for custom domain setup.

<#
.SYNOPSIS
    Generate DNS Records for Microsoft 365

.DESCRIPTION
    Outputs required DNS records for custom domain verification and services.

.PARAMETER Domain
    Custom domain name
#>

param(
    [Parameter(Mandatory)]
    [string]$Domain
)

Write-Host "DNS Records for: $Domain" -ForegroundColor Cyan
Write-Host "=" * 60

Write-Host "`n### MX Record (Email)" -ForegroundColor Yellow
Write-Host "Type: MX"
Write-Host "Host: @"
Write-Host "Points to: $Domain.mail.protection.outlook.com"
Write-Host "Priority: 0"

Write-Host "`n### SPF Record (Email Authentication)" -ForegroundColor Yellow
Write-Host "Type: TXT"
Write-Host "Host: @"
Write-Host "Value: v=spf1 include:spf.protection.outlook.com -all"

Write-Host "`n### Autodiscover (Outlook Configuration)" -ForegroundColor Yellow
Write-Host "Type: CNAME"
Write-Host "Host: autodiscover"
Write-Host "Points to: autodiscover.outlook.com"

Write-Host "`n### DKIM Records (Email Signing)" -ForegroundColor Yellow
$domainKey = $Domain.Replace(".", "-")
Write-Host "Type: CNAME"
Write-Host "Host: selector1._domainkey"
Write-Host "Points to: selector1-$domainKey._domainkey.{tenant}.onmicrosoft.com"
Write-Host ""
Write-Host "Type: CNAME"
Write-Host "Host: selector2._domainkey"
Write-Host "Points to: selector2-$domainKey._domainkey.{tenant}.onmicrosoft.com"

Write-Host "`n### DMARC Record (Email Policy)" -ForegroundColor Yellow
Write-Host "Type: TXT"
Write-Host "Host: _dmarc"
Write-Host "Value: v=DMARC1; p=quarantine; rua=mailto:dmarc@$Domain"

Write-Host "`n### Teams/Skype Records" -ForegroundColor Yellow
Write-Host "Type: CNAME"
Write-Host "Host: sip"
Write-Host "Points to: sipdir.online.lync.com"
Write-Host ""
Write-Host "Type: CNAME"
Write-Host "Host: lyncdiscover"
Write-Host "Points to: webdir.online.lync.com"
Write-Host ""
Write-Host "Type: SRV"
Write-Host "Service: _sip._tls"
Write-Host "Port: 443"
Write-Host "Target: sipdir.online.lync.com"
Write-Host ""
Write-Host "Type: SRV"
Write-Host "Service: _sipfederationtls._tcp"
Write-Host "Port: 5061"
Write-Host "Target: sipfed.online.lync.com"

Write-Host "`n### MDM Enrollment (Intune)" -ForegroundColor Yellow
Write-Host "Type: CNAME"
Write-Host "Host: enterpriseregistration"
Write-Host "Points to: enterpriseregistration.windows.net"
Write-Host ""
Write-Host "Type: CNAME"
Write-Host "Host: enterpriseenrollment"
Write-Host "Points to: enterpriseenrollment.manage.microsoft.com"

Write-Host "`n" + "=" * 60 -ForegroundColor Cyan
Write-Host "Verify DNS propagation: nslookup -type=mx $Domain"
Write-Host "Note: DNS changes may take 24-48 hours to propagate"

Security Policies Reference

Comprehensive security configuration guide for Microsoft 365 tenants covering Conditional Access, MFA, DLP, and security baselines.

---

Table of Contents

• Conditional Access Policies
• Multi-Factor Authentication
• Data Loss Prevention
• Security Baselines
• Admin Role Security
• Guest Access Controls

---

Conditional Access Policies

Policy Architecture

Recommended Policies

1. Require MFA for Administrators

Scope: Global Admin, Security Admin, Exchange Admin, SharePoint Admin, User Admin

Settings:

• Include: Directory roles (admin roles)
• Exclude: Emergency access accounts
• Grant: Require MFA
• Session: Sign-in frequency 4 hours

2. Require MFA for All Users

Scope: All users

Settings:

• Include: All users
• Exclude: Emergency access accounts, service accounts
• Conditions: All cloud apps
• Grant: Require MFA
• Session: Persistent browser session disabled

3. Block Legacy Authentication

Scope: All users

Settings:

• Include: All users
• Conditions: Exchange ActiveSync, Other clients
• Grant: Block access

Why: Legacy protocols (POP, IMAP, SMTP AUTH) cannot enforce MFA.

4. Require Compliant Devices

Scope: All users accessing sensitive data

Settings:

• Include: All users
• Applications: Office 365, SharePoint, Exchange
• Grant: Require device compliance OR Hybrid Azure AD joined
• Platforms: Windows, macOS, iOS, Android

5. Block Access from Untrusted Locations

Scope: High-risk operations

Settings:

• Include: All users
• Applications: Azure Management, Microsoft Graph
• Conditions: Exclude named locations (corporate IPs)
• Grant: Block access

Named Locations Configuration

Policy Deployment Strategy

1. Report-Only Mode (Week 1-2)

• Enable policies in report-only
• Monitor sign-in logs for impact
• Identify false positives

2. Pilot Group (Week 3-4)

• Enable for IT staff first
• Address issues before broad rollout
• Document exceptions needed

3. Gradual Rollout (Week 5-8)

• Enable by department
• Provide user communication
• Monitor help desk tickets

4. Full Enforcement

• Enable for all users
• Maintain exception process
• Quarterly policy review

---

Multi-Factor Authentication

MFA Methods (Strength Ranking)

Recommended Configuration

For Administrators:

• Require phishing-resistant MFA (FIDO2, Windows Hello)
• Disable SMS/Voice as backup
• Enforce re-authentication every 4 hours

For Standard Users:

• Require Microsoft Authenticator
• Allow SMS as backup (temporary)
• Session lifetime: 90 days with risk-based re-auth

For External/Guest Users:

• Require MFA from home tenant
• Fall back to email OTP if needed

MFA Registration Campaign

Phase 1: Communication (Week 1)
- Announce MFA requirement
- Provide registration instructions
- Set deadline for registration

Phase 2: Registration (Week 2-3)
- Open registration portal
- IT support available
- Track registration progress

Phase 3: Enforcement (Week 4)
- Enable MFA requirement
- Grace period for stragglers
- Block unregistered after deadline

---

Data Loss Prevention

Sensitive Information Types

DLP Policy Templates

Financial Data Protection

Scope: Exchange, SharePoint, OneDrive, Teams

Rules: 1. Credit card numbers (Luhn validated) 2. Bank account numbers 3. SWIFT codes

Actions:

• Block external sharing
• Encrypt email to external recipients
• Notify compliance team

PII Protection

Scope: All Microsoft 365 locations

Rules: 1. Social Security Numbers 2. Passport numbers 3. Driver's license numbers

Actions:

• Warn user before sharing
• Require business justification
• Log all incidents

Healthcare (HIPAA)

Scope: Exchange, SharePoint, Teams

Rules: 1. Medical record numbers 2. Health insurance IDs 3. Drug names with patient info

Actions:

• Block external sharing
• Apply encryption
• Retain for 7 years

DLP Deployment

1. Audit Mode First

• Enable policies in test mode
• Review matched content
• Tune false positives

2. User Tips

• Enable policy tips in apps
• Educate before enforcing
• Provide override option with justification

3. Enforcement

• Block high-risk content
• Warn for medium-risk
• Log everything

---

Security Baselines

Microsoft Secure Score Targets

Priority Security Settings

Identity (Do First)

• [ ] Enable Security Defaults OR Conditional Access
• [ ] Require MFA for all admins
• [ ] Block legacy authentication
• [ ] Enable self-service password reset
• [ ] Configure password protection (banned passwords)

Data Protection

• [ ] Enable sensitivity labels
• [ ] Configure DLP policies
• [ ] Enable audit logging
• [ ] Set retention policies
• [ ] Configure information barriers (if needed)

Device Security

• [ ] Require device compliance
• [ ] Enable Microsoft Defender for Endpoint
• [ ] Configure BitLocker requirements
• [ ] Set application protection policies
• [ ] Enable Windows Autopilot

Application Security

• [ ] Review OAuth app permissions
• [ ] Configure admin consent workflow
• [ ] Block risky OAuth apps
• [ ] Enable app governance
• [ ] Configure MCAS policies

---

Admin Role Security

Privileged Identity Management (PIM)

Configuration:

• Require approval for Global Admin activation
• Maximum activation: 8 hours
• Require MFA at activation
• Require justification
• Send notification to security team

Role Assignment Best Practices

Emergency Access Accounts

Configuration:

• 2 cloud-only accounts
• Excluded from ALL Conditional Access
• No MFA (break-glass scenario)
• Monitored via alerts
• Passwords in secure vault
• Test quarterly

Naming: emergency-access-01@tenant.onmicrosoft.com

---

Guest Access Controls

Guest Invitation Settings

Guest Access Review

Frequency: Quarterly

Scope:

• All guest users
• Group memberships
• Application access

Actions:

• Remove inactive guests (90+ days)
• Revoke unnecessary permissions
• Require re-certification

B2B Collaboration Settings

Allowed Domains:

• Partners: partner1.com, partner2.com
• Block all others for sensitive resources

Guest Permissions:

• Limited directory browsing
• Cannot enumerate users
• Cannot invite other guests

Troubleshooting Guide

Common issues and solutions for Microsoft 365 tenant administration.

---

Table of Contents

• Authentication Errors
• PowerShell Module Issues
• Permission Problems
• License Assignment Failures
• DNS and Domain Issues
• Conditional Access Lockouts
• Mailbox Issues

---

Authentication Errors

"AADSTS50076: MFA Required"

Cause: User requires MFA but hasn't completed it.

Solutions: 1. Complete MFA registration at https://aka.ms/mfasetup 2. Use interactive authentication:

   Connect-MgGraph -Scopes "User.Read.All" -UseDeviceAuthentication

3. Check Conditional Access policies excluding the user

"AADSTS65001: User hasn't consented"

Cause: Application requires permissions user hasn't granted.

Solutions: 1. Grant admin consent in Azure AD portal 2. Use admin account for initial consent:

   Connect-MgGraph -Scopes "User.ReadWrite.All" -ContextScope Process

3. Add application to enterprise applications with pre-consent

"AADSTS700016: Application not found"

Cause: App registration missing or incorrect tenant.

Solutions: 1. Verify app ID in Azure AD > App registrations 2. Check multi-tenant setting if cross-tenant 3. Re-register application if needed

"Access Denied" Despite Admin Role

Causes:

• PIM role not activated
• Role assignment pending
• Conditional Access blocking

Solutions: 1. Activate PIM role:

• Go to Azure AD > Privileged Identity Management
• Activate required role

2. Wait 5-10 minutes for role propagation 3. Check Conditional Access policies in report-only mode

---

PowerShell Module Issues

Module Not Found

Error: The term 'Connect-MgGraph' is not recognized

Solutions:

# Install module
Install-Module Microsoft.Graph -Scope CurrentUser -Force

# If already installed, import explicitly
Import-Module Microsoft.Graph

# Check installation
Get-InstalledModule Microsoft.Graph

Module Version Conflicts

Error: Assembly with same name already loaded

Solutions:

# Remove all versions
Get-Module Microsoft.Graph* | Remove-Module -Force

# Clear cache
Remove-Item "$env:USERPROFILE\.local\share\powershell\*" -Recurse -Force

# Reinstall
Install-Module Microsoft.Graph -Force -AllowClobber

Exchange Online Connection Failures

Error: Connecting to remote server failed

Solutions:

# Use modern authentication
Connect-ExchangeOnline -UserPrincipalName admin@tenant.com

# If MFA issues, use device code
Connect-ExchangeOnline -Device

# Check WinRM service
Get-Service WinRM | Start-Service

Graph API Throttling

Error: 429 Too Many Requests

Solutions: 1. Implement retry logic:

   $retryCount = 0
   $maxRetries = 3
   do {
       try {
           $result = Get-MgUser -All
           break
       } catch {
           if ($_.Exception.Response.StatusCode -eq 429) {
               $retryAfter = $_.Exception.Response.Headers['Retry-After']
               Start-Sleep -Seconds ([int]$retryAfter + 5)
               $retryCount++
           } else { throw }
       }
   } while ($retryCount -lt $maxRetries)

2. Reduce batch sizes 3. Use delta queries for incremental updates

---

Permission Problems

Insufficient Privileges for User Creation

Error: Insufficient privileges to complete the operation

Required Permissions:

• User Administrator role
• OR User.ReadWrite.All Graph permission

Solutions: 1. Verify role assignment:

   Get-MgDirectoryRoleMember -DirectoryRoleId (Get-MgDirectoryRole -Filter "displayName eq 'User Administrator'").Id

2. Request role assignment or PIM activation 3. Use service principal with appropriate permissions

Cannot Modify Another Admin

Error: Cannot update privileged user

Cause: Attempting to modify user with equal or higher privileges.

Solutions: 1. Use account with higher privilege level 2. Global Admin required to modify other Global Admins 3. Remove target's admin role first (if appropriate)

Application Permission vs Delegated

Issue: Script works interactively but fails in automation

Solution: Use application permissions for automation:

# Application authentication (daemon/service)
$clientId = "app-id"
$tenantId = "tenant-id"
$clientSecret = ConvertTo-SecureString "secret" -AsPlainText -Force
$credential = New-Object System.Management.Automation.PSCredential($clientId, $clientSecret)

Connect-MgGraph -ClientSecretCredential $credential -TenantId $tenantId

---

License Assignment Failures

"Usage location must be specified"

Error: License assignment failed because UsageLocation is not set

Solution:

# Set usage location before license assignment
Update-MgUser -UserId user@tenant.com -UsageLocation "US"

# Then assign license
$license = @{
    AddLicenses = @(@{SkuId = "sku-id"})
    RemoveLicenses = @()
}
Set-MgUserLicense -UserId user@tenant.com -BodyParameter $license

"No available licenses"

Error: License quota exceeded

Solutions: 1. Check available licenses:

   Get-MgSubscribedSku | Select-Object SkuPartNumber,
       @{N='Available';E={$_.PrepaidUnits.Enabled - $_.ConsumedUnits}}

2. Remove licenses from inactive users 3. Purchase additional licenses

Conflicting Service Plans

Error: Conflicting service plans

Cause: User has license with overlapping services.

Solution:

# Check current licenses
Get-MgUserLicenseDetail -UserId user@tenant.com |
    Select-Object SkuPartNumber, @{N='Plans';E={$_.ServicePlans.ServicePlanName}}

# Remove conflicting license first
$remove = @{
    AddLicenses = @()
    RemoveLicenses = @("conflicting-sku-id")
}
Set-MgUserLicense -UserId user@tenant.com -BodyParameter $remove

# Then add new license

---

DNS and Domain Issues

Domain Verification Failing

Error: Domain verification record not found

Solutions: 1. Verify TXT record:

   nslookup -type=TXT domain.com

2. Check for typos in record value 3. Wait 24-48 hours for propagation 4. Try alternate verification (MX record)

MX Record Not Resolving

Error: Mail flow disrupted

Diagnostic:

nslookup -type=MX domain.com
# Should return: domain.com.mail.protection.outlook.com

Solutions: 1. Verify MX record points to domain.com.mail.protection.outlook.com 2. Priority should be 0 or lowest number 3. Remove conflicting MX records

SPF Record Issues

Error: SPF validation failed

Correct SPF:

v=spf1 include:spf.protection.outlook.com -all

Common Mistakes:

• Multiple SPF records (only one allowed)
• Missing -all or using ~all
• Too many DNS lookups (max 10)

Check:

nslookup -type=TXT domain.com | findstr spf

---

Conditional Access Lockouts

Locked Out by MFA Policy

Symptoms: Cannot sign in, MFA loop

Immediate Actions: 1. Use emergency access account 2. Sign in from trusted location/device 3. Contact admin to temporarily exclude user

Resolution:

# Add user to CA exclusion group
$group = Get-MgGroup -Filter "displayName eq 'CA-Excluded-Users'"
New-MgGroupMember -GroupId $group.Id -DirectoryObjectId (Get-MgUser -UserId user@tenant.com).Id

Policy Conflicts

Symptoms: Unexpected blocks, inconsistent behavior

Diagnostic: 1. Check sign-in logs: Azure AD > Sign-in logs 2. Filter by user, check "Conditional Access" tab 3. Review which policies applied/failed

Resolution: 1. Review all policies in report-only mode 2. Check for conflicting conditions 3. Ensure proper policy ordering

Break-Glass Procedure

When to use: Complete admin lockout

Steps: 1. Sign in with emergency access account 2. Go to Azure AD > Security > Conditional Access 3. Set all policies to "Report-only" 4. Diagnose and fix root cause 5. Re-enable policies gradually

---

Mailbox Issues

Mailbox Not Provisioning

Error: Mailbox doesn't exist

Causes:

• License not assigned
• License assignment pending
• User created without Exchange license

Solutions: 1. Verify license:

   Get-MgUserLicenseDetail -UserId user@tenant.com

2. Wait 5-10 minutes after license assignment 3. Force mailbox provisioning:

   # Reassign license
   Set-MgUserLicense -UserId user@tenant.com -BodyParameter @{
       RemoveLicenses = @("sku-id")
       AddLicenses = @()
   }
   Start-Sleep -Seconds 60
   Set-MgUserLicense -UserId user@tenant.com -BodyParameter @{
       AddLicenses = @(@{SkuId = "sku-id"})
       RemoveLicenses = @()
   }

Mailbox Size Limit

Error: Mailbox quota exceeded

Solutions:

# Check current quota
Get-Mailbox user@tenant.com | Select-Object ProhibitSendQuota, ProhibitSendReceiveQuota

# Increase quota (if license allows)
Set-Mailbox user@tenant.com -ProhibitSendQuota 99GB -ProhibitSendReceiveQuota 100GB

# Or enable archive
Enable-Mailbox user@tenant.com -Archive

Mail Flow Issues

Diagnostic:

# Test mail flow
Test-Mailflow -TargetEmailAddress external@gmail.com

# Check mail flow rules
Get-TransportRule | Where-Object {$_.State -eq 'Enabled'} | Select-Object Name, Priority, Conditions

# Check connectors
Get-InboundConnector
Get-OutboundConnector

Common Fixes: 1. Check transport rules for blocks 2. Verify connector configuration 3. Check ATP/spam policies 4. Review quarantine for false positives