AB-900 Core Objects: Microsoft 365 Licenses and the Exchange, SharePoint and Teams Admin Centers

A license is what turns a Microsoft 365 account into a working one. Creating a user in the Microsoft 365 admin center gives that person an identity in Microsoft Entra ID, so they can sign in, but no service is provisioned until a license is assigned. Assigning a license such as Microsoft 365 E3 or Business Premium provisions the services it contains: Exchange Online creates a mailbox, Teams becomes available, OneDrive and SharePoint access is enabled, and the Microsoft 365 apps can be activated.

Each license is a bundle of service plans (sometimes shown as "apps"): Exchange Online, Microsoft Teams, SharePoint Online, Microsoft Forms, Microsoft Planner and so on. That structure gives admins three levers:

• Assign or remove the whole license — the user gains or loses every service in it. When a license is removed, the user's Exchange data is kept for a grace period (30 days) and then deleted.
• Turn individual services off inside an assignment — for example, switch off Microsoft Planner for a group of contractors while they keep everything else in their license. Other users with the same license are unaffected, because the change belongs to that assignment.
• Add an add-on license — some capabilities (Microsoft 365 Copilot is one; its licensing is covered later in the course) are separate licenses layered on top of a base subscription.

A license is not an admin role. Roles such as Exchange Administrator or Teams Administrator let someone manage a service; they do not give that person a mailbox or Teams client. An account that authenticates but has no services provisioned points to licensing; an account that has services but cannot manage a workload points to roles.

License types

Microsoft 365 is sold in license families aimed at different organizations and workers. Knowing the family tells you roughly what a user gets:

Many products can also be started as a trial, which provides a set number of licenses for a limited period; when it ends, the admin buys the subscription or the licenses stop working. Whatever the family, licenses are purchased as a subscription in Billing and then assigned to users or groups.

Usage location

Before a license can be assigned directly to a user, the user's usage location must be set, because service availability differs by country or region. It is a different field from the user's office location, which is only a contact detail. With group-based licensing, a member with no usage location inherits the tenant's location.

Licenses can be assigned to individual users (from Active users) or to groups (from Billing > Licenses in the Microsoft 365 admin center, or from Microsoft Entra ID). Group-based licensing is the low-effort option: Microsoft Entra ID applies the license to every member automatically, gives it to people when they join the group and removes it when they leave.

Rules worth knowing:

• Which groups: security groups (including mail-enabled security groups) and security-enabled Microsoft 365 groups. Distribution groups cannot carry licenses.
• Nested groups are not followed. Only the group's direct user members get the license. If group B is a member of licensed group A, the people in B get nothing from A. The fix is to assign the license to group B as well (a license can be assigned to as many groups as needed) or to put the users directly into A.
• Several sources, one license. A user who receives the same product from two groups, or from a group and a direct assignment, consumes only one license; the enabled services are combined.

The Microsoft 365 admin center is where tenant-wide configuration lives: users, groups, licenses, roles, billing, service health and two pages this objective names directly, Domains and Org settings.

Domains

Every tenant starts with an initial domain such as contoso.onmicrosoft.com. To give users addresses and sign-in names on the company's own domain, an admin opens Settings > Domains and adds it. Adding a domain has two stages:

1. Verify ownership — Microsoft 365 generates a unique TXT record value (it looks like MS=ms12345678) and the admin adds it at the domain's DNS host. Once Microsoft 365 finds the record, the domain is verified.
2. Connect services — the admin adds the DNS records each service needs: an MX record and an SPF TXT record for mail flow, an autodiscover CNAME so Outlook configures itself, and optional records such as DKIM CNAMEs for message signing.

The onmicrosoft.com domain stays in the tenant after a custom domain is added; it cannot be removed. Workload settings that refer to a domain, such as Exchange accepted domains, only work once the domain has been added and verified here first. The admin can then set the custom domain as the default for new users.

Org settings

Settings > Org settings holds settings that apply to the whole organization, on three tabs:

Because Org settings apply to everyone, they are the wrong tool for changing one department's experience — that is done through license assignments or service policies scoped to those users.

The Exchange admin center manages recipients: mailboxes, groups and contacts. Picking the right mailbox type is the core skill.

Room and equipment mailboxes are both resource mailboxes; the difference is only whether the resource is a location. A shared mailbox does have an associated account in Microsoft Entra ID, but that account's sign-in is blocked by default and should stay blocked — people open the mailbox with their own accounts.

Shared mailbox permissions

Access to a shared mailbox is granted per person, or through a mail-enabled security group, with three separate permissions (when access comes through a group, Outlook does not add the mailbox automatically — automapping only works for people granted Full Access individually):

• Full Access — open the mailbox and read, manage and delete its items. It does not on its own allow sending as the mailbox.
• Send As — send mail that appears to come from the mailbox address alone (recipients see only the shared address).
• Send on Behalf — send mail that shows "Person on behalf of mailbox", so recipients can see who wrote it.

The permissions combine rather than include each other: working with the items in the inbox is Full Access, and sending from the address is Send As or Send on Behalf, chosen by whether recipients should see which person wrote the message.

Groups are how Exchange delivers one message to many people, and the four group types differ in what they can do beyond email.

A dynamic distribution group fits any audience defined by an attribute, such as all staff in one office location: Exchange Online recalculates its membership from the filter on a schedule (at least once every 24 hours), so people whose attributes change move in or out without anyone editing the group. A static distribution group with join approval still depends on someone adding and removing members.

When a group must both receive email and be added to a SharePoint site or other resource as a permission principal, only a mail-enabled security group or a Microsoft 365 group works. Distribution groups and dynamic distribution groups are mail-only.

SharePoint stores content in a simple hierarchy: a site contains document libraries (and lists), a library contains folders, and folders contain files. The SharePoint admin center manages the site level; libraries and folders are created and managed on the site itself by its owners and members.

Site types

Managing sites

• Active sites — create sites, and for each site manage its site admins, sharing level, storage limit, hub association and Microsoft 365 group connection.
• Deleted sites — a deleted site is kept for 93 days and can be restored from here with all its pages, libraries and content. For a group-connected team site, deleting the Microsoft 365 group deletes the site too, and restoring the group brings the site back.
• Site recycle bins (first and second stage) are different: they restore items deleted inside a site that still exists, not the site itself.

Organization-wide sharing settings and oversharing controls also live in the SharePoint admin center; they are covered in the data-security lessons of this course.

SharePoint permissions are granted by putting people (or security groups) into a site's SharePoint groups, each of which carries a permission level. Every site gets three default groups:

Other built-in permission levels fill the gaps between these:

• Contribute — add, edit and delete items and documents in existing lists and libraries, but not create or delete the lists and libraries themselves. This is the near-twin of Edit: the difference is the Manage Lists permission.
• Design — Edit plus the ability to approve items and customize pages and themes.
• Full Control — normally only for owners.

Grant the narrowest level that meets the need: compare what the person must change (items and documents, or the lists and libraries that hold them) with what each level includes, and give Read through the Visitors group to anyone who only views content. Site admins (site collection administrators), set in the SharePoint admin center, have full control over the whole site regardless of these groups.

On a team site connected to a Microsoft 365 group, the group drives the site's main permissions: group owners are site owners and group members are site members (Edit). Microsoft 365 groups have only owners, members and guests — there is no read-only role, and group membership also brings the group mailbox, calendar and other group services.

So to give people read-only access to a group-connected site without the group's services, don't add them to the group. Add them, or better a security group containing them, to the site's Visitors SharePoint group. People added directly to the site's SharePoint groups get access to the site only; adding them to the site's Members group would avoid the mailbox but would still grant Edit.

Permission inheritance

By default, every library, folder and file inherits the permissions of the site above it, so managing the site's three groups manages everything. When one object needs different access — for example a Contracts library that only the legal team should open — an owner opens that object's permissions, stops inheriting permissions and grants access only to the right people. The rest of the site keeps its existing permissions. Inheritance can be restored later.

Use unique permissions sparingly: each break makes access harder to audit. Hiding a library from navigation is not a security control — anyone with permission can still open it by link or search.

A team in Microsoft Teams is built on a Microsoft 365 group, so every team has a group mailbox, a SharePoint team site for its files and the group's membership of owners, members and guests. In the Teams admin center, Teams > Manage teams lets admins create teams, add or remove members, change privacy (public or private), manage channels, archive and delete.

Channel types

A shared channel lets external partners join one channel without being added as guests to the team or the tenant; cross-organization sharing relies on Microsoft Entra B2B direct connect being allowed by both organizations. Private and standard channels require outsiders to be guests of the team.

Archiving vs deleting a team

Archiving makes a team read-only: conversations and files stay readable, no one can post, and the team can be unarchived later. Admins can optionally make the team's SharePoint site read-only for members too. Deleting a team removes it (and its Microsoft 365 group) for everyone; a deleted group can be restored for a limited time. Removing members or changing privacy changes who has access, not whether the team can still be posted in.

Teams policies control what users can do. Each policy type covers one area, so the first step is picking the right type:

Every type has a Global (Org-wide default) policy. To change behaviour for some users only, an admin creates a custom policy and assigns it to those users or to a group; editing the Global policy changes everyone who has no other assignment.

Which policy wins

A user ends up with exactly one policy of each type, chosen in this order:

1. Direct assignment to the user always wins.
2. Otherwise, group assignments apply, and if the user is in several groups with that policy type, the assignment with the highest ranking (rank 1 is highest) wins.
3. Otherwise, the Global (Org-wide default) policy applies.

Ranking only orders group assignments against each other, so changing a group's rank never overrides a direct assignment. A user's Policies tab shows each effective policy and whether it was assigned directly or came from a group, which is how to explain why a user is not getting the policy you expected.