Microsoft 365 Administrator

Most daily admin work is about people and what they may use. You create and manage users, groups and licenses at scale, with dynamic membership and group-based licensing so changes follow people automatically.

• Creating and managing users and guest accounts
• Microsoft 365 groups, security groups and distribution lists
• Dynamic groups and membership rules
• Group-based licensing and license conflicts
• Bulk operations with PowerShell
• Offboarding: deletion, recovery and retention

You build A user, group and license model that assigns access by rule, with a scripted bulk import.

Not every administrator needs every right. You assign built-in and custom roles, scope them with administrative units, and use Privileged Identity Management so admin access is granted when needed and recorded.

• Built-in admin roles and what they allow
• Least-privilege role assignment
• Administrative units for scoped delegation
• Privileged Identity Management and just-in-time access
• Access reviews for admin roles
• Emergency access accounts

You build A delegation plan with scoped roles, administrative units and just-in-time elevation.

Hybrid organizations keep identities both on premises and in the cloud. You choose between Entra Connect and Cloud Sync, set up synchronization and sign-in methods, and troubleshoot objects that fail to sync.

• Hybrid identity models and their trade-offs
• Planning and installing Entra Connect
• Cloud Sync and when it fits
• Password hash sync, pass-through authentication and federation
• Filtering and attribute mapping
• Troubleshooting synchronization errors

You build A hybrid identity design with a tested synchronization and sign-in method.

Stronger sign-in is the cheapest security gain. You configure authentication methods, multifactor authentication and self-service password reset, and plan the rollout so users adopt them without a flood of support requests.

• Authentication methods and their strengths
• Multifactor authentication rollout
• Self-service password reset and registration
• Passwordless options
• Password protection and lockout
• Communicating change to users

You build An authentication rollout plan with configured methods, reset and registration campaigns.

Access decisions should use context. You write Conditional Access policies from signals such as user, device, location and risk, test them safely, and use Identity Protection to respond to risky sign-ins.

• Conditional Access signals, conditions and controls
• Common policy sets and baselines
• Report-only mode and the What If tool
• Device compliance and app protection
• Risk-based policies with Identity Protection
• Avoiding lockouts

You build A Conditional Access policy set tested in report-only mode, with a rollout order.

Defender XDR gathers signals from across Microsoft 365 into incidents. You use Secure Score to prioritize improvements, work incidents and alerts from triage to closure, and tune what reaches you.

• The Microsoft Defender portal and its parts
• Reading and improving Secure Score
• Alerts, incidents and correlation
• Triage, investigation and automated investigation
• Advanced hunting basics
• Closing incidents and recording outcomes

You build A worked incident, from alert to closure, with the Secure Score actions it produced.

Email and chat are still where most attacks arrive. You configure anti-phishing, Safe Links and Safe Attachments policies, tune them against false positives, and respond to a message that got through.

• Anti-phishing and anti-spam policies
• Safe Links and Safe Attachments
• Preset security policies
• Attack simulation training
• Investigating and remediating delivered threats
• Protecting Teams, SharePoint and OneDrive

You build A set of Defender for Office 365 policies, with a test phishing scenario.

Compromise often starts on a device or in an unsanctioned app. You onboard devices to Defender for Endpoint, set protection policies, and use Defender for Cloud Apps to discover and control the apps people use.

• Onboarding devices to Defender for Endpoint
• Attack surface reduction and protection policies
• Device investigation and response actions
• Cloud app discovery and risk scoring
• App connectors and session controls
• Governing OAuth app permissions

You build Onboarded test devices with protection policies and a cloud app discovery report.

You protect only what you can identify. You define sensitive information types, apply sensitivity labels, and set retention so the right content is kept, protected or deleted on a schedule.

• Sensitive information types and classifiers
• Sensitivity labels and label policies
• Auto-labeling
• Retention policies and retention labels
• Records management and disposition
• Searching and exporting content with eDiscovery basics

You build A labeling and retention scheme with custom sensitive information types.

Labels and retention need enforcement. You configure data loss prevention for Exchange, SharePoint, Teams and endpoints, handle alerts and false positives, and extend controls to cover Microsoft 365 Copilot interactions.

• DLP policy design and conditions
• DLP for email, files, chat and endpoints
• Policy tips, overrides and user education
• Investigating DLP alerts
• Insider risk management basics
• Protecting data used by Copilot

You build A DLP policy set that spans three workloads, with an alert triage procedure.

Take a blank tenant to a defended one. You configure identity, roles, threat protection and data controls in a sensible order, check the result against Secure Score and a threat scenario, and write the runbook.

• Sequencing tenant configuration
• Applying identity and access baselines
• Enabling threat protection and data controls
• Testing with a simulated incident
• Writing the admin runbook

You build A secured tenant and its runbook, tested against one simulated attack.