Microsoft 365 and AI Services Administrator

Licensing controls who can use what, and backup controls what you can recover. You assign licenses by group, track usage and cost, and configure Microsoft 365 Backup for the content that matters.

• Subscriptions, plans and add-ons
• Group-based license assignment
• Reclaiming unused licenses
• Microsoft 365 Backup: scope and policies
• Restoring mailboxes, sites and files
• Retention compared with backup

You build A licensing model by group, and a backup policy with a restore carried out.

Mail is the workload people notice first when it breaks. You manage mailboxes, shared mailboxes and groups, set up mail flow, and configure sharing and archiving options.

• User, shared and resource mailboxes
• Distribution lists and Microsoft 365 groups
• Mail flow rules and connectors
• Mailbox permissions and delegation
• Archiving and mailbox recovery
• Message trace for troubleshooting

You build A mail setup with shared mailboxes, a mail flow rule and a traced test message.

Teams is where much of the work now happens. You manage teams and channels, set policies for messaging and meetings, and control guests, apps and the way Copilot and agents appear.

• Teams and channel structure
• Teams policies and policy packages
• Meetings, calling and messaging settings
• Guest access and external collaboration
• App permission and setup policies
• Lifecycle: expiration, archiving and naming

You build A set of Teams policies for two user groups, with a guest access configuration.

SharePoint and OneDrive hold the content Copilot will read. You manage sites, storage and sharing settings, and learn how permissions in these workloads shape what users and AI can find.

• Site types, hubs and site lifecycle
• Sharing settings and external sharing
• Site permissions and inheritance
• Storage limits and OneDrive retention
• Finding and fixing oversharing
• Sensitivity labels on sites

You build A site and sharing configuration with an oversharing report and the fixes applied.

Identity underlies every other control. You manage users, guest identities and groups in Microsoft Entra, automate their lifecycle, and handle the routine requests that make up daily administration.

• Creating and managing users
• Guest users and B2B collaboration
• Groups: security, Microsoft 365 and dynamic
• Lifecycle: joiners, movers and leavers
• Bulk changes with PowerShell
• Reading the audit and sign-in logs

You build A user and group lifecycle process, with a scripted bulk change and an audit check.

Delegating administration safely is a design task. You assign Entra roles with the least privilege that works, scope them with administrative units, and keep elevated access temporary and reviewed.

• Entra built-in roles for Microsoft 365
• Role assignment with least privilege
• Administrative units
• Just-in-time elevation
• Access reviews
• Break-glass accounts

You build A role and administrative unit plan for a multi-region organization.

Sign-in policy protects every workload at once. You set authentication methods, require multifactor authentication, and write Conditional Access policies that you test before they apply to anyone.

• Authentication methods and registration
• Multifactor authentication and passkeys
• Conditional Access conditions and controls
• Testing with report-only mode
• Device and session controls
• Avoiding lockouts

You build A tested Conditional Access policy set for staff, admins and guests.

Email and collaboration need active protection. You configure anti-phishing, Safe Links and Safe Attachments, review threat reports, and investigate and remediate a message that reached users.

• Preset and custom security policies
• Anti-phishing and impersonation protection
• Safe Links and Safe Attachments
• Threat Explorer and reports
• Investigating and remediating messages
• Protecting Teams and SharePoint content

You build Protection policies for one tenant, with an investigation record for a message that reached users.

Purview controls decide what data may go where. You define data loss prevention, labels and retention, and extend them to cover content that Copilot and agents create or use.

• Sensitivity labels and label policies
• Data loss prevention policies
• Retention policies and labels
• Protecting Copilot and AI interactions
• Audit and search
• Investigating a data protection alert

You build A Purview setup with labels, a DLP policy and retention, including a rule for AI activity.

Copilot shows people whatever they can already reach, so readiness is mostly about data and access. You assess permissions, labels and content quality, and plan the rollout and how it will be measured.

• How Copilot uses identity and permissions
• A readiness assessment of data and access
• Cleaning up oversharing before launch
• Licensing and assigning Copilot
• Pilot groups and rollout waves
• Measuring adoption

You build A Copilot readiness assessment with findings, fixes and a rollout plan.

Copilot and agents are configured, not just switched on. You manage Copilot settings, control which agents people may use and build, and keep an agent registry that records what exists and who owns it.

• Copilot settings in the admin center
• Controlling who can create and use agents
• The agent registry and ownership
• Agent identities and permissions
• Approving, blocking and retiring agents
• Connectors and plugins that agents rely on

You build An agent policy and a registry entry for each agent in a sample tenant.

Agents need oversight like any other worker. You use Agent 365 to see what agents do, apply controls, and monitor usage, cost and compliance, then act on what the data shows.

• What Agent 365 governs
• Observing agent activity
• Applying security and compliance controls to agents
• Usage and adoption reporting
• Cost monitoring and budgets for AI
• Responding when an agent misbehaves

You build A monitoring view of AI usage and cost, with a written response procedure for a misbehaving agent.

Bring configuration, security and AI governance into one tenant. You set up workloads, protect identities and data, prepare for Copilot, govern agents, and document how it is run.

• Configuring the tenant and its workloads
• Applying identity and data protection
• Preparing and rolling out Copilot
• Governing agents and watching cost
• Writing the administration runbook

You build A documented tenant configuration with security baselines, a Copilot rollout and an agent governance plan.