Acquiring a domain name

If your organization wants to use a new domain name with its Microsoft 365 tenancy, it can procure one with a registrar. When you do this, you can choose to have the registrar host the name server records for the domain, or select your own name server records. The vast majority of organizations will have already procured a domain name and have it hosted either with a specific domain registrar, their ISP, or even on their own DNS servers. To use a domain with Microsoft 365, the DNS servers used as name servers for the domain need to support the following record types:

• CNAME records To fully support Skype for Business online, the name server DNS servers need to be able to support multiple CNAME records in a DNS zone.

• SPF/TXT records These records allow you to configure sender protection framework records, which can be used to combat unsolicited commercial email. TXT records are also one method of verifying domain ownership.

• SRV records SRV records are used for Skype for Business Online IM and presence integration using the Outlook Web App as well as federation with Skype for Business Online users in different organizations including public Internet connectivity with Microsoft accounts.

• MX records These records are used to route mail to Exchange Online mail servers.

Purchasing a domain through Microsoft 365

In some regions, you’re able to purchase a custom domain name from within Microsoft 365. When you do this, you’re limited to the following top level domains:

• .biz

• .com

• .info

• .me

• .mobi

• .net

• .org

• .tv

• .co.uk

• .org.uk

Purchasing a domain through Microsoft 365 has the advantage of meaning that the vast majority of DNS related operations will be performed automatically for you. You shouldn’t choose this option if your organization will continue to use email services outside Microsoft 365 because you won’t be able to modify the appropriate MX records.

Configuring a custom domain name

To configure Microsoft 365 to use a custom domain name, you need to add the name of the custom domain name to Microsoft 365. The account used to perform this action must be an Global Administrator of a business or enterprise plan.

To add a custom domain to Microsoft 365, perform the following steps:

1. In the Microsoft 365 Admin Center, click Domains under Setup as shown in Figure 1-1.

   

2. If your organization already has a domain, click Add A Domain. The alternative is that the console provides the option to buy a domain through Office 365 and GoDaddy. The advantage of buying through GoDaddy is that you can have the entire process of assigning a custom domain to Microsoft 365 occur automatically. If your organization’s domain is already hosted elsewhere, you’ll instead have to confirm ownership of that domain by configuring special TXT or MX records that can be checked by the setup process.

3. When you click Add A Domain, you are presented with the New Domain page. Enter the name of the existing domain you want to configure as shown in Figure 1-2 and click Next.

   

4. This will begin the process of adding the domain, but you’ll need to confirm ownership before you can use the domain.

Exchange Online related DNS records

When you provision Microsoft 365 for your organization, Microsoft takes care of ensuring that the DNS records for your organization’s tenant domain, which is the onmicrosoft.com domain, are configured properly so that email addresses that use the tenant domain as an email domain suffix have mail routed properly.

For example, if you provision a Microsoft 365 tenant, and the tenant domain is contoso.onmicrosoft.com, then email sent to users at this email domain, such as an email sent to [email protected], will arrive at the correct location because Microsoft 365 will provision the appropriate DNS records automatically when the tenancy is provisioned.

When you add a custom domain to Microsoft 365, you need to configure an appropriate set of DNS records to ensure that mail flows properly to Exchange Online mailboxes that use the custom domain. For example, if your custom domain is tailspintoys.com, you need to configure DNS so that email will function properly for Exchange Online mailboxes that are configured to use the tailspintoys.com email domain. When properly configured, the user associated with the Exchange Online mailbox [email protected] will receive email sent from other hosts on the Internet.

If your custom DNS zone is hosted by GoDaddy, Microsoft 365 can configure the appropriate DNS records for you automatically. If your custom DNS zone is hosted by another DNS hosting provider, you’ll have to manually configure DNS records.

You need to configure the following DNS records:

• Autodiscover CNAME record for Autodiscover service

• MX record for mail routing

• SPF (Sender Policy Framework) record to verify identity of mail server

• TXT record for Exchange federation

• CNAME record for Exchange federation

These records are listed in Table 1-1. The specifics of records will be provided for you by the Microsoft DNS setup wizard. The MX record takes the form <customdnsname>.mail.protection.outlook.com, and will vary depending on the custom domain name being registered.

Table 1-1 Microsoft 365 Exchange DNS records

MX Record

You need to configure an MX record in your custom domain to point to an Office 365 target mail server. The address of this target mail server will depend on the name of the custom domain and is described in the documentation as being in the form <mx token>.mail. protection.outlook.com. You can determine the value for MX token by performing the following steps:

1. In the Microsoft 365 Admin Center, navigate to the Domains node under Settings.

2. Select the Custom Domain; this will open the Domain Properties page.

3. Locate the MX record as shown in Figure 1-6.

   

To ensure that mail routes properly, you need to configure the MX priority for the record to be a lower value than any other MX records configured for the custom domain. When mail is being routed, a check is performed to determine which MX record has the lowest value for the priority field. For example, an MX record with a priority of 10 will be chosen as a destination for mail routing over an MX record with a priority of 20.

Figure 1-7 shows the MX record for the epistemicus.com domain configuration when the DNS zone is hosted in Azure DNS.

SPF Record

The Sender Protection Framework (SPF) record is a special TXT record that reduces the possibility of malicious third parties using the custom domain to send spam or malicious email. An SPF record is used to validate which email servers are authorized to send messages on behalf of the custom domain. The SPF record must be a TXT record where the TXT value must include v=spf1 include:spf.protection.outlook.com –all. The record should also be set with a TTL value of 3600. Only one TXT record for SPF should exist within a specific zone. If an SPF record is already present, append the Microsoft 365 values to the existing record rather than creating a new one. Figure 1-8 shows an SPF record for Exchange Online hosted in Azure DNS for the epistemicus.com domain.

Autodiscover CNAME Record

You need to create a CNAME record that uses the Autodiscover alias to point to the hostname Autodiscover.outlook.com, so that Outlook clients have their settings automatically provisioned for Exchange Online. For example, if the custom domain you assigned to Microsoft 365 was tailspintoys.com, you would need to create the CNAME record Autodiscover. tailspintoys.com and have it point to Autodiscover.outlook.com. Figure 1-9 shows this type of record configured for the epistemicus.com domain using Azure DNS.

Skype for Business related DNS records

Skype for Business requires you to configure two types of DNS records if you have a custom domain. You need to configure two SRV records and two CNAME records to get Skype for Business working properly with a custom domain, as shown for the epistemicus.com domain in Figure 1-10.

Mobile Device Management for Microsoft 365 DNS records

If you are using Mobile Device Management for Microsoft 365, you need to create two CNAME records, also known as Alias, so that devices can find the appropriate location to register with. These two records are listed in Table 1-4.

Table 1-4 Microsoft 365 Mobile Device Management DNS records

Verifying DNS settings

You can check DNS settings at any time by selecting the domain in the Microsoft 365 Admin Center, and clicking Check DNS, as shown in Figure 1-11. When you do this, Microsoft 365 will perform a query against the records required for the services you have chosen and validate that the results returned by the query match those that are required by Microsoft 365.

Manage email address

The default address, also known as the primary address and as the reply-to address, is the address that users use to sign in to Microsoft 365 resources, including Office 365, and which recipients reply to when they receive an email message from a user. You can view the primary email address for a user in the Microsoft 365 Admin Center on the user’s properties page, as shown in Figure 1-15.

It’s possible to change the primary email address once you have added an additional email address to an Office 365 user. It is important to note that changing the primary email address also changes the user name. For example, the warning in Figure 1-16 indicates that by changing the primary email address associated with the Adele Vance user account, the user name will also be changed. The email suffix for the primary address must be configured as an accepted domain for the Office 365 tenancy.

You can perform a bulk email address update using PowerShell. You might choose to do this in the event that the organization renames itself. This step should be taken with extreme care because supporting a small number of users through a transition to a new email and logon address is relatively simple, whereas supporting every user in the organization through a transition to a new email and logon address is what might politely be termed “logistically complex.”

To update the email and logon domains of multiple users, perform the following steps:

1. In the Active Users node of the Microsoft 365 Admin Center, select all of the users whose email and logon domains you want to update, as shown in Figure 1-17.

   

2. Once the users are selected, on the More drop down menu, click Edit Domains.

3. On the Edit Domains drop down, select one of the domains that has been added to Microsoft 365, as shown in Figure 1-18, and click Save. You will be presented with a warning that email addresses and usernames in apps associated with Microsoft 365 will need to be updated.

   

4. When the operation is complete, a confirmation dialog will be displayed as shown in Figure 1-19. Click Close to dismiss the dialog.

   

Additional email addresses

Additional email addresses allow mailboxes to receive messages from more than a single address. Also known as proxy or secondary addresses, they can take any format and can use any domain name associated with the organization’s Microsoft 365 tenancy. For example, Adele Vance’s user account could have the primary username and address as [email protected], but could also have the following addresses also associated with the same Exchange mailbox:

• [email protected]

• [email protected]

• [email protected]

• [email protected]

• [email protected]

You can add additional email addresses to an Office 365 account’s Exchange Online mailbox using a variety of methods. To add an additional email address to an Exchange Online mailbox using Exchange Admin Center, perform the following steps:

1. Sign in to the Microsoft 365 Admin Center with a user account that has Tenant Administrator permissions.

2. In the Microsoft 365 Admin Center, click Exchange under Admin Centers, as shown in Figure 1-20.

   

3. In Exchange Admin Center, click Recipients and then click Mailboxes. Select the recipient to which you wish to add an additional email address. Figure 1-21 shows the Adele Vance mailbox selected.

   

4. Click the Edit (Pencil) icon.

5. On the User Mailbox properties page, click Email Address, as shown in Figure 1-22.

   

6. Click the Plus (+) icon.

7. On the New Email Address page, ensure that SMTP is selected, as shown in Figure 1-23, and then enter the new email address. You can also specify the new email address as the default reply-to address.

   

8. Click OK to save changes

To add an additional email address to an Exchange Online mailbox using the Microsoft 365 Admin Center, perform the following steps:

1. In the Office Admin Center, select Active Users under Users.

2. Select the user for which you want to configure the primary email address. Figure 1-24 shows Debra Berger selected.

   

3. On the More menu, click Edit Email Addresses And Username.

4. In the Alias box, shown in Figure 1-25, type the new email address and click Add.

   

5. To set the new email address as the new primary email address, as shown in Figure 1-26, click Set As Primary.

   

You can use the Set-Mailbox cmdlet to add additional email addresses. For example, to add the email address [email protected] to Debra Berger’s Exchange Online mailbox, issue the following command using PowerShell as a global admin:

Click here to view code image

Set-Mailbox "Debra Berger" –EmailAddresses @{[email protected]}

Networking

Traditional networks have provided users with access to data and applications hosted on datacenters owned and operated by the organization, and protected by strong perimeter defenses such as firewalls. In this traditional model, users primarily access resources from protected internal networks, over WAN links from branch locations, or remotely via VPN connections.

The M365 and O365 model shifts some, if not all, applications and data from locations on protected internal networks to locations hosted beyond the network perimeter in the public cloud. When moving from an environment where all resources are hosted on-premises, to where a substantial amount of infrastructure is hosted in the cloud, it is necessary to ensure that the on-premises networking environment is configured in such a way that M365 can function effectively and efficiently. Unless steps are taken to optimize the flow of traffic between users and M365 and O365 services, this traffic will be subject to increased latency caused by packet inspection, network hairpins, and possible inadvertent connections to geographically distant M365 and O365 service endpoints.

Understanding the networking requirements for M365 also allows you to make an assessment as to whether M365 is appropriate for a particular organization. For example, there are challenges around deploying M365 effectively at a scientific base in Antarctica where there is limited low bandwidth connectivity to the Internet.

Windows 10 Enterprise

A Microsoft 365 Enterprise license includes a license for the Windows 10 Enterprise edition operating system. Part of the process of adopting M365 will involve ensuring that all Windows client computers are running this edition of the Windows 10 operating system.

Organizations that have an existing Windows 7 or Windows 8.1 deployment should perform an in-place upgrade using System Center Configuration Manager or Microsoft Deployment Toolkit. System Center Configuration Manger (Current Branch) provides organizations with the most automated method of upgrading and migrating existing computers from previous versions of the Windows client operating system to Windows 10.

Organizations that are deploying new computers that have Windows 10 Enterprise edition version 1703 or later can use Windows Autopilot to trigger the deployment and configuration process by signing in using their school or work credentials. Organizations running the Pro edition can also have those computers automatically updated to the Enterprise edition through Windows Autopilot.

Information protection

When planning your organization’s M365 information protection strategy, the first and perhaps most important step is to liaise with the organization’s legal and compliance teams to determine which compliance standards, such as the General Data Protection Regulation (GDPR) or Health Insurance Portability and Accountability Act (HIPAA) that the organization is subject to. Once you’ve determined the specific compliance standards, or regulation to which your organization must adhere, you will need to make determinations for the following questions:

• What are the appropriate security and information protection levels for our organization?

• What is an appropriate document classification schema for our organization?

• What steps must be taken to ensure the appropriate security level is configured within M365 and O365?

• Is it necessary to configure privileged access management for M365 and O365?

Cloud authentication

When you select cloud authentication, authentication occurs against Azure Active Directory. How you implement cloud authentication depends on whether or not your organization has an existing on-premises Active Directory Domain Services deployment and what your plans are for that deployment in the future.

Cloud-Only

The cloud-only authentication model addresses management of user and group accounts that exist only from within M365. You can create and manage users in the M365 admin center shown in Figure 1-27, in the Azure Active Directory portal or blade, or by using the appropriate PowerShell cmdlets.

A cloud only identity and authentication solution is appropriate if:

• Your organization has not deployed an on-premises Active Directory Domain Services environment.

• Your organization has a very complex on-premises directory solution and wants to avoid attempting to integrate it.

• Your organization has an on-premises Active Directory Domain Services environment, but wants to run a pilot or trial of M365 and will worry about integrating with the existing environment if the pilot or trial proves successful.

Federated authentication

Federated authentication is an alternative to cloud authentication, although it’s often substantially more complicated to configure and maintain. Most organizations use Azure AD Connect to synchronize identity information between on-premises Active Directory Domain Services and Azure AD. Organizations that want to allow additional authentication options, such as smart-card based authentication, or third-party multi-factor authentication such as an RSA token device.

Global administrator

Global administrators have the most permissions over a Microsoft 365 tenancy. A global administrator has the following permissions:

• View organization and user information

• Manage support tickets

• Reset user passwords

• Perform billing and purchasing operations

• Create and manage user views

• Create, edit, and delete users

• Create, edit, and delete groups

• Manage user licenses

• Manage domains

• Manage organization information

• Delegate administrative roles to others

• User directory synchronization

Users that have the global administrator role in the Microsoft 365 tenancy have the following roles in Exchange Online:

• Exchange Online admin

• Company admin

• SharePoint Online admin

• Skype for Business Online admin

Billing administrator

Members of the billing administrator role are responsible for making purchases, managing Microsoft 365 subscriptions, managing support tickets, and monitoring the health of Office 365 services. Members of the billing administrator role have the following permissions:

• View organization and user information

• Manage support tickets

• Perform billing and purchasing operations

Members of this role do not have any equivalent roles in Exchange Online, SharePoint Online, or Skype for Business Online.

Dynamics 365 service administrator

Users that hold the Dynamics 365 service administrator role can manage Dynamics 365 instances, including performing backup and recovery operations. Users that hold this role can also perform Dynamics 365 copy and reset actions. They can open support tickets with Microsoft and are able to view the service dashboard and message center.

Customer Lockbox access approver

Members of the Customer Lockbox access approver role manage customer lockbox requests for the tenancy. They will receive email notifications for Customer Lockbox requests. Users that hold this role can approve or deny requests using the Microsoft 365 Admin center. Users that hold this role are also able to enable and disable the Customer Lockbox feature. Only users that hold the Global Administrator role are able to reset the password of users that hold the Customer Lockbox access approver role.

Exchange administrator

The Exchange administrator role is also known as the Exchange Online Administrator role. Users who have delegated the Exchange Online administrator role are able to manage mailboxes and anti-spam policies for their tenancy. This includes being able to:

• Recover deleted items from mailboxes

• Configure how long deleted items will be retained before permanent deletion

• Configure mailbox sharing policies

• Configure Send As and Send on Behalf of delegates for a mailbox

• Configure anti-spam and malware filters

• Create shared mailboxes

Helpdesk (Password) administrator

Members of the Helpdesk (password) administrator role are responsible for resetting passwords for non-privileged users and other members of the password administrator role. Members of this role are also able to manage service requests and monitor service health. Members of this role have the following permissions:

• View organization and user information.

• Manage support tickets.

• Reset non-privileged user passwords as well as passwords of other password administrators. Cannot reset passwords of global administrators, user management administrators, or billing administrators.

• Manage the Exchange Online Help Desk admin role.

• Manage the Skype for Business Online admin role.

License administrator

Users assigned the License administrator role are able to add, remove, and update license assignments for users. They can also manage group based licensing, as well as configure the usage location for users. Users assigned this role are unable to purchase or manage subscriptions, create or manage groups, or modify users beyond configuring usage location.

Skype for Business administrator

Users delegated the Skype for Business administrator role are able to perform the following tasks:

• Set up dial-in conferencing

• Set up PSTN calling

• Transfer phone numbers to Skype for Business Online

• Enable Skype Meeting Broadcast

• Allow users to contact external Skype for Business users

• Allow users to add external contacts from Skype

• Determine who is able to view online presence

• Enable and disable mobile notifications

• Create customized meeting invitations

• View Skype for Business Online online activity reports

Message center reader

Users assigned the message center reader role are able to view all posts made to the Microsoft 365 message center. Users assigned this role are also able to share these message with other users by forwarding those messages through email. Users assigned this role also have read access to a subset of admin center resources including users, groups, domains, and subscriptions.

Power BI service administrator

Users assigned the Power BI admin role have access to Microsoft 365 and Office 365 Power BI usage metrics. Users assigned this role are able to manage the organization’s usage of PowerBI.

Reports reader

Users that hold the reports reader role are able to view all Microsoft 365 activity reports, as well as any reports that are published through the reporting APIs.

Service administrator

Members of the service administrator role are able to manage service requests and monitor the health of services. Before a global administrator can assign the service administrator role to a user, the user must be assigned administrative permissions to one of the Office 365 services, such as SharePoint Online or Exchange Online. Service administrators have the following permissions over the assigned service:

• View organization and user information

• Manage support tickets

SharePoint administrator

Also known as the SharePoint Online administrator. Users delegated the SharePoint Online administrator role are able to use the SharePoint Online admin center. They are able to perform the following tasks:

• Create and manage site collections

• Manage site collections and global settings

• Designate site collection administrators

• Manage site collection storage limits

• Manage SharePoint online user profiles

Teams Communications administrator

Users that hold this role are able to manage the calling and meeting features of Teams. This includes the assignment of phone numbers as well as meeting policies. Users that hold this role are also able to use call analytics tools and troubleshooting tools.

Teams Communications support engineer

Users that hold this role are able to troubleshoot communications issues in Teams. They can access call analytics tools as well as view call record information for all call participants.

Teams Communications support specialist

Users that hold this role are able to troubleshoot communications issues in Teams. This role differs from the support engineer role in that the specialist can only view call record information for a specific user rather than all call participants.

Teams service administrator

Users that hold this role are able to administer all aspects of Microsoft Teams, except the assignment of licenses. Users that hold this role are able to:

• Manage calling policies

• Manage messaging policies

• Manage meetings policies

• Use call analytics tools

• Manage users and their telephone settings

• Manage M365 groups

User management administrator

Members of the user management administrator role are able to reset some user passwords, monitor service health, manage some user accounts and groups, and service requests. Members of this role have the following permissions:

• View organization and user information

• Manage support tickets

• Reset the passwords of all user accounts except those assigned the global administrator, billing administrator, or service administrator roles

• Create and manage user views

• Can create, edit, and delete users and groups except users that are assigned global administrator privileges

• Can manage user licenses

• Have the Skype for Business Online admin role

Delegated administrator

Delegated administrators are people outside the organization that perform administrative duties within the Office 365 tenancy. Administrators of the tenancy control who is delegated administrator permissions. You can only assign delegated administrator permissions to users that have Office 365 accounts in their own tenancy.

When you configure delegated administration, you can choose one of the following permission levels:

• Full administration When you assign the full administration role to a delegated administrator, that administrator has the same privileges as a member of the global admin role.

• Limited administration When you assign the limited administration role to a delegated administrator, that administrator has the same privileges as a member of the password admin role.

Manage role membership

You can assign an administrative role on the Edit user roles page of a Microsoft 365 user’s properties as shown in Figure 1-28. When you assign an administrative role, you specify the role that you want to assign, and an alternate email address. This allows you to perform password recovery if necessary. You can only add Microsoft 365 users to a role. You cannot add a Microsoft 365 group to a role.

You can use this page of a user’s account to remove an assigned role. To do this, deselect the role that you want to remove and select the No Option and then click Save. You can view a list of users assigned a particular role by using the Active Users node in the M365 Admin Center and selecting the role whose membership you wish to view. Figure 1-29 shows the members of the Password Admins role.

Assigning licenses

Microsoft 365 users require licenses to use Outlook, SharePoint Online, Skype for Business, and other services. Users who have been assigned the global administrator or user management administrator roles can assign licenses to users when creating new Microsoft 365 user accounts or can assign licenses to accounts that are created through directory synchronization or federation.

When a license is assigned to a user, the following occurs:

• An Exchange Online mailbox is created for the user.

• Edit permissions for the default SharePoint Online team site are assigned to the user.

• The user will have access to Skype for Business features associated with the license.

• For Office 365 ProPlus, the user will be able to download and install Microsoft Office on up to five computers running Windows or macOS.

You can view the number of valid licenses and the number of those licenses that have been assigned on the Licenses node, which is underneath the Billing node in the Microsoft 365 Admin Center.

History

Service health history displays the status history of services over the past 30 days. Figure 1-33 shows history over the last 7 days. This may allow you to diagnose issues that may have occurred previously that you were not aware of, such as if you needed to provide an explanation to a user as to why they were unable to access specific functionality over the weekend. Clicking on each item provides further details.

Auditing reports

The following security and compliance reports are available through the Security and Compliance Center:

• Office 365 Audit Log report View user and admin activity for the M365 organization including viewing changes made to administrator role groups.

• Azure AD reports This option allows you to view Azure Active Directory reports including reports for unusual or suspicious sign-in activity. It requires a paid Azure Active Directory subscription.

• Exchange Audit reports Use this report to search for mailboxes accessed by people other than their owners. Requires mailbox audit logging to be enabled.

Data Loss Prevention reports

The following Data Loss Prevention (DLP) reports are available through the Office 365 Admin Center:

• Top DLP policy matches for mail Allows you to view the top DLP policy matches for sent and received email.

• Top DLP rule matches for mail Allows you to view the top DLP rule matches for sent and received email.

• DLP policy matches by severity for mail Allows you to track DLP policy matches by severity.

• DLP policy matches, overrides, and false positives for mail Allows you to view DLP matches, overrides, and false positives for incoming and outgoing messages.

Protection reports

The following protection reports are available through the Office 365 Admin Center:

• Top senders and recipients This report allows you to view the top mail senders, the top mail recipients, the top spam recipients, and the top malware recipients across the Office 365 subscription.

• Top malware for mail This report shows the amount of malware received through e-mail for the reporting period.

• Malware detections This report shows the amount of malware sent and received through the Office 365 subscription for the reporting period.

• Spam detections This report shows the amount of spam on the basis of the content being filtered or the original sending host being blocked.

• Sent and received mail This report shows the amount of sent and received mail categorized by good mail, malware, spam, and messages dealt with by rules.

Rules reports

The following rules reports are available through the Office 365 Admin Center:

• Top rule matches for mail This report allows you to view the number of messages based on sent and received transport rule matches.

• Rule matches for mail This report shows all rule matches for received and sent email.

Email Activity

The Email Activity report, shown in Figure 1-40, shows the number of send, receive, and read actions across the organization, with a per user breakdown. You can use this report to get high level information about email traffic at your organization, including the last activity date, the number of send actions, receive actions, and read actions. You can use this report to view email activity over the last 7 days, 30 days, 90 days and 180 days.

Mailbox Usage

The Mailbox Usage report, shown in Figure 1-41, shows the total number of mailboxes, the total number of active user mailboxes, the amount of storage used across all mailboxes, and the mailboxes by quota status (good, warning issued, send prohibited, and send/receive prohibited). You can also view the number of deleted items, the last activity date, and the number of items in each user’s mailbox. The report allows you to view data from the last 7 days, 30 days, 90 days and 180 days.

Office Activations

The Office Activation report provides data on the users who have activated their Office 365 subscription on one or more devices. You can use it to determine activations for Office 365 ProPlus, Project, and Visio Pro for Office 365. You can also view activation information including whether the product was activated on a computer running Windows, macOS, or devices running the iOS or Android mobile operating systems. This report is displayed in Figure 1-42.

Active Users

The Active Users report, shown in Figure 1-43, provides information on the number of licenses that are being used across your organization. It also provides you with information about the products licensed by specific users. You can use this report to determine which products are not fully being used.

Email App Usage

The Email App Usage report provides information on the email app used by each user to access Exchange Online. Each app used to interact with Exchange Online is tracked, so you can determine the app usage profile of each user. This report tracks usage through Outlook on Windows, Outlook on Mac OSX, Outlook on the web, as well as mobile clients.

OneDrive for Business User Activity

The OneDrive Activity report, also known as the OneDrive for Business Activity Report, allows you to view the activity of all Office 365 OneDrive for Business users. This report, shown in Figure 1-44, provides information on the following:

• Last OneDrive for Business Activity

• Files viewed or edited

• Files synced

• Files shared internally

• Files shared externally

  

OneDrive for Business usage

The OneDrive for Business usage report, provides a high-level overview of how files are used in your organization’s OneDrive for Business subscription. The report, shown in Figure 1-45, provides details of the following:

• URL This is the file’s location within OneDrive for Business

• Owner Office 365 account associated with the file

• Last activity date (UTC) Last date that the file was accessed

• Files Number of files associated with the user

• Active files Number of user’s files being actively used

• Storage used (MB) Storage consumed by the user’s files

  

SharePoint Activity

The SharePoint Activity report allows you to track how Microsoft 365 users in your organization interact with SharePoint Online. This report provides the following information on a per-user basis:

• Last activity date The last time the user interacted with SharePoint Online.

• Files viewed or edited This is the number of files that the user interacted with that were hosted on the organization’s SharePoint Online instance.

• Files synced This is the number of files that have synchronized between the devices used by the user and SharePoint Online.

• Files shared internally The number of files shared with other Office 365 users through SharePoint Online.

• Files shared externally The number of files shared through Office 365 with external users.

SharePoint Site Usage

The SharePoint Site Usage report, shown in Figure 1-46, provides information on how SharePoint sites in your organization’s SharePoint Online deployment, are used. This report provides you with the following information:

• Site URL The address of the site within your SharePoint deployment

• Site owner Microsoft 365 user assigned ownership of the site

• Last Activity date Last time activity was recorded against the site

• Files Number of files stored on the SharePoint online site

• Files viewed or edited Files that have recently been viewed or modified

• Storage used The amount of storage consumed by files on the site

  

Skype for Business Activity

The Skype for Business Activity report provides you with information on Skype for Business activity on a per-user basis across your Office 365 organization. This includes information on the following:

• Last activity date

• Peer-to-peer

• Organized conferences

• Participated in conferences

Skype for Business Peer-To-Peer Activity

The Skype for Business Online Peer-To-Peer Activity report provides information about communication that occurs between individual Skype for Business users outside of Skype for Business conferences. This report tracks the following activity on a per-user basis:

• Last activity date

• Number of peer-to-peer Instant Messaging sessions

• Number of peer-to-peer audio conferences

• Number of peer-to-peer video conferences

• Number of peer-to-peer application sharing sessions

• Number of peer-to-peer file transfers

• Number of minutes spent in peer-to-peer audio conferences

• Number of minutes spent in peer-to-peer video conferences

Skype for Business Conference Organizer Activity

The Skype for Business Conference Organizer Activity Report provides information about conferences initiated by your organization’s Skype for Business users. This report presents the following information over a 7 day, 30 day, 90 day, and 180 day time frame by username:

• Last activity

• IM sessions organized

• Audio and Video sessions organized

• Application sharing conferences organized

• Web conferences organized

• Dial-in/out – 3rd party conferences organized

• Total audio/video minutes of conferences organized by this user

• Total number of minutes where Microsoft functioned as the dial-in audio conferencing provider

• Total number of minutes where Microsoft functioned as the dial-out audio conferencing provider

Skype for Business Conference Participant Activity

The Skype for Business Conference Participant Activity report provides information about Skype for Business from a participant, rather than an organizer perspective. This report includes the following information on a per-user basis:

• Last activity date

• Number of IM conferences the user participated in

• Number of audio and video conferences the user participated in

• Number of application sharing conferences that the user participated in

• Number of web conferences that the user participated in

• Number of Dial-in/out – 3rd party conferences that the user participated in using a 3rd party audio conferencing provider where Skype for Business was used for audio

• Total audio and video minutes

Yammer Activity

The Yammer Activity report provides information about how much users in your organization are interacting with Yammer. It provides information about the number of unique users posting to Yammer, how many read a specific message, how many like a specific message and the general level of interaction across the organization.

Yammer Device Usage

The Yammer Device Usage report provides you with data about the specific types of devices that are used to interact with the organization’s Yammer instance. The report provides information on:

• Number of daily users by device type

• Number of users by device type

• Per user device usage

Yammer groups activity report

The Yammer Groups activity report provides information about how users in your organization interact with Yammer groups. The report will provide you with information on the number and identity of groups that are created as well as how much utilization those groups are receiving. Activity tracked includes:

• Group name

• Group administrator

• Group type

• Connection to Office 365

• Last Activity Date

• Members

• Messages posted

• Messages read

• Messages liked

Microsoft Teams User Activity

The Microsoft Teams User Activity report provides you with information about how users in your organization interact with the tenancy’s Microsoft Teams instance. Activities that are tracked by the report include:

• Channel messages

• Chat messages

• Calls

• Meetings

• Other activities

Microsoft Teams Device Usage

The Microsoft Teams Device Usage report provides information about the specific devices that M365 users are using to interact with the tenancy’s Microsoft Teams instance. The report will track the following operating systems and devices:

• Windows

• Mac

• Web

• iOS

• Android Phone

• Windows Phone

Schedule Reports

You can use the Security & Compliance center to regularly generate reports according to a schedule. To complete this task, perform the following steps:

1. In the M365 Security & Compliance center, navigate to Dashboard under Reports.

2. Select the report that you wish to schedule.

3. Click the Create Schedule button. Figure 1-47 shows this button on the Sent and Received email report.

   

4. On the Create Schedule page, shown in Figure 1-48, you can configure the report to be generated according to the default frequency by clicking Create Schedule. You can also click Customize Schedule to create a customized schedule for the report.

   

Moving Data to SharePoint Online

There are a variety of methods that you can use to migrate data from an on-premises environment to SharePoint Online. These methods are listed in Table 1-8.

Table 1-8 Data migration methods

Migrating known local folders to OneDrive for Business

Many organizations have known folders such as the Documents folders directed to an on-premises file share. As part of a migration strategy to move these files to Office 365, you can redirect these folders from an on-premises file share to OneDrive for Business. This can be done through group policy for organizations where computers are members of Active Directory domains. In organizations where computers aren’t members of a domain, you will have to instead use more manual and intensive methods of moving files into folders used by OneDrive for Business. This process is manual because in non-domain environments where users have more freedom to configure computers as they see fit, rather than being subject to domain policy, users are more likely to store their files in idiosyncratic locations.

When redirection of known folders to OneDrive for Business is implemented, users continue to use folders such as the Documents folder in the normal manner. In the background, the contents of these known folders will automatically be synced with OneDrive for Business. When using this method, Group Policy will determine if the OneDrive for Business folder has been configured on the target computer. If the folder doesn’t exist, known folders, such as the Documents folder, will not be redirected. once the OneDrive for Business folder is present, because the sync client has been deployed.

When you have redirected known folders, shortcuts to those folders will point to the new location linked with OneDrive for Business. The existing folder structure will still be in place, and the contents of those folders will remain in the original location. Similarly, if known folders are currently redirected to network shares, you will need to migrate data from that location to OneDrive for Business after you redirect the known folders to OneDrive for Business. Microsoft recommends scripts that use XCopy or Robocopy to perform this task.

You can only use this strategy if OneDrive files are being stored in the default location, which is %userprofile%OneDrive - <TenantName>. If OneDrive for Business files are being stored in another location, you can’t use the known folder redirection strategy.

As mentioned earlier, the known folder redirection strategy requires that computers be members of an Active Directory Domain Services Domain. The other step to take is to download and install the OneDrive for Business Group Policy objects onto a Domain Controller. The ADML and ADMX files are located in the OneDrive installation directory, %localappdata%MicrosoftOneDriveBuildNumberadm, of a computer with the OneDrive client installed. Redirecting known folders to OneDrive involves the following steps:

1. Open the Group Policy Management Editor and edit the policy that will apply to users whose folders you will redirect to OneDrive for Business.

2. Edit the User ConfigurationPoliciesAdministrative TemplatesOneDrivePrevent users from changing the location of their OneDrive policy, and set it to enabled. This will block users from moving their OneDrive for Business folder.

3. Create a new environment variable using the User ConfigurationPreferencesWindows Settings edit the Environment item and create a new Environment Variable named OneDriveSync that has the value %userprofile%<SyncFolder>, where <SyncFolder> is the name of your default folder. An example is OneDrive – Adatum, as shown in Figure 1-49.

   

4. On the Common tab of the New Environment Properties dialog box, select Item-level targeting, click Targeting, click New Item, and then click File Match. Choose the Folder that exists from the Match type drop down, and in the Path box type %userprofile%<SyncFolder>, where <SyncFolder> is the name of your OneDrive folder, as shown in Figure 1-50.

   

5. Click OK twice to close the Targeting Editor dialog box and the New Environment Properties dialog box.

6. Edit the properties of the User ConfigurationPoliciesWindows SettingsFolder RedirectionDocuments node, and choose Basic – Redirect Everyone’s Folder To The Same Location. Under Target Folder Location, choose Redirect To The Following Location. In the Root Path box, type %OneDriveSync%Documents option, as shown in Figure 1-51.

   

7. In the Settings tab, clear the Move The Contents Of Documents To The New Location check box. The reason you do this is that if there are files in both locations with the same name, you may lose data. If there are no files in the new location, you can leave this setting enabled and files will be migrated without the need for scripts.

8. Use this same process to redirect other known folders such as Pictures, Music, Videos, Downloads, and others.

Remote move migration method

You use a remote move migration when you have an Exchange hybrid deployment. A hybrid deployment is where you have coexistence between an on-premises Exchange deployment and an Exchange Online deployment. You have to use a hybrid deployment and use the remote move migration method when you need to migrate more than 2,000 Exchange Server 2010, Exchange Server 2013, or Exchange Server 2016 mailboxes to Exchange Online.

With a hybrid deployment, you get the following advantages:

• User accounts are managed through your on-premises tools.

• Directory synchronization connects your on-premises Exchange organization with Exchange Online.

• Users are able to use single-sign on to access their mailbox whether the mailbox is hosted in the on-premises Exchange organization or Exchange Online.

• Email is routed securely between the on-premises Exchange deployment and Exchange Online.

• Free/busy calendar sharing between users with mailboxes hosted in the on-premises Exchange organization and mailboxes hosted in Exchange Online.

Prior to performing a remote move migration you need to ensure the following prerequisites are met:

• A hybrid deployment has already been configured between your on-premises Exchange organization and Exchange Online.

• You need to have been assigned the appropriate permissions. For mailbox moves in a hybrid deployment, this means that you need to have an account that is a member of the Organization Management, or the Recipient Management role groups.

• You need to have deployed the Mailbox Replication Proxy Service (MRSProxy) on all on-premises Exchange 2013 or Exchange 2016 Client Access servers.

Once these prerequisites have been met, you can move mailboxes from your on-premises Exchange deployment to Exchange Online by performing the following steps:

1. Create migration endpoint Migration endpoints host connection settings for an on-premises Exchange server running the MRSProxy service.

2. Enable MRSProxy service The MRSProxy service is hosted on on-premises Client Access servers. This service can be enabled using the Exchange Administration Console by selecting the Client Access server, editing the properties of the EWS virtual directory, and ensuring that the MRSProxy Enabled check box is selected.

3. Move mailboxes You can move mailboxes using the Office 365 tab in EAC on the on-premises Exchange server by creating a new migration batch in Exchange Admin Console, or by using Windows PowerShell. When moving mailboxes, you move some, not all mailboxes, at a time in groups that are termed batches.

4. Remove completed migration batches Once the migration of a batch is complete, remove the migration batch using Exchange Administration Center, or Windows PowerShell.

5. Re-enable offline access for Outlook on the Web If users have been migrated from on-premises Exchange Server to Office 365, it is necessary to reset the offline access setting in their browser.

Staged migration method

In a staged migration, you migrate mailboxes from your on-premises Exchange organization to Office 365 in groups, termed batches. You select a staged migration in the following circumstances:

• Your organization has more than 2,000 on-premises mailboxes hosted in Exchange 2007. You can’t use a staged migration to migrate Exchange 2010 or later mailboxes. It is also important to remember that Exchange 2007 is no longer publicly supported by Microsoft as of mid-2017, and requires a specific support agreement.

• Your organization intends to completely move its messaging infrastructure to Office 365.

• Your available migration period is in the timeframe of several weeks to several months.

• After migration completes, you still manage user accounts using on-premises management tools and have account synchronization performed with Azure Active Directory.

• The primary domain name used for your on-premises Exchange organization must be configured as a domain associated with the tenancy in Office 365.

Staged migration involves the following general steps:

1. You create a CSV file that includes a row for every user who has an on-premises mailbox that you want to migrate. This is not every user in the organization, just those who you will migrate in a particular batch.

2. Create a staged migration batch using Exchange Admin Center, or using Windows PowerShell.

3. Trigger the migration batch. Once the migration batch is triggered, Exchange Online performs the following steps:

   • Verify that directory synchronization is enabled and functioning. Directory synchronization migrates distribution groups, contacts, and mail enabled users.

   • Verify that a mail-enabled user exists in Office 365 for every user listed in the batch CSV file.

   • Convert the Office 365 mail-enabled user to an Exchange Online mailbox for each user in the migration batch.

   • Configure mail forwarding for the on-premises mailbox.

4. Once these steps have been completed, Exchange Online sends you a status report informing you of which mailboxes have migrated successfully and which mailboxes have not migrated successfully. Successfully migrated users can start using Exchange Online mailboxes.

5. Once migration is successful, you convert the mailboxes of successfully migrated on-premises users to mail-enabled users in the on-premises Exchange deployment.

6. You configure a new batch of users to migrate and delete the current migration batch.

7. Once all users have been migrated, the administrator assigns licenses to Office 365 users, configures MX records to point to Exchange Online, and creates an Autodiscover record that points to Office 365.

8. Decommission the on-premises Exchange deployment.

Cutover migration method

In a cutover migration, all mailboxes in an on-premises Exchange deployment are migrated to Office 365 in a single migration batch. Cutover migrations migrate global mail contacts as well as distribution groups. Cutover migrations are suitable when:

• You intend all mailboxes to be hosted in Office 365 when the migration completes.

• You intend to manage user accounts using Office 365 tools.

• You want to perform the migration period in less than a week.

• Your organization has less than 2,000 mailboxes.

• Your on-premises messaging solution is Exchange Server 2010 or later.

• The primary domain name used for your on-premises Exchange organization must be configured as domain associated with the tenancy in Office 365.

You can perform a cutover migration using the Exchange Admin Center or by using Windows PowerShell.

The cutover migration method involves the following general steps:

1. An administrator creates empty mail-enabled security groups in Office 365.

2. An administrator connects Office 365 to the on-premises Exchange deployment. This is also termed creating a migration endpoint.

3. An administrator creates and starts a cutover migration batch using Exchange Admin Center or Windows PowerShell.

4. Once the migration batch is triggered, Exchange Online performs the following steps:

   • The address book of the on-premises Exchange deployment is queried to identify mailboxes, distribution groups, and contacts.

   • New Exchange Online mailboxes are provisioned.

   • Distribution groups and contacts are created within Exchange Online.

   • Mailbox data, including email messages, contacts, and calendar items, are migrated from each on-premises mailbox to the corresponding Exchange Online mailbox.

5. Exchange Online forwards the administrator a report providing statistics including the number of successful and failed migrations. The migration report includes automatically generated passwords for each new Exchange Online mailbox. Users are forced to change passwords the first time they sign in to Office 365.

6. Incremental synchronization occurs every 24 hours, updating Exchange Online with any new items created in the on-premises mailboxes.

7. Once migration issues have been resolved, the administrator changes the MX records to point to Exchange Online.

8. Once mail flow to Exchange Online has been successfully established, the administrator deletes the cutover migration batch. This terminates synchronization between the on-premises mailboxes and Office 365.

9. Administrator performs post migration tasks, including assigning Office 365 licenses, creating an Autodiscover DNS record, and decommissioning on-premises Exchange servers.

Minimal Hybrid or Express Migration

Minimal hybrid or express migration is appropriate for organizations that are running Exchange 2010 or later, have a migration timetable that is shorter than a few weeks, and where your organization does not intend to have an ongoing directory service configuration. For example, this method is appropriate, where your organization intends to retire its on-premises Active Directory Domain Services infrastructure after migration is complete.

Performing a minimal hybrid migration involves performing the following steps:

1. In the Microsoft 365 console, add the domain that you use for your on-premises Exchange organization by configuring a TXT record (or by signing into GoDaddy if your organization uses that registrar) and verify that the TXT record is properly configured.

2. Sign into the Microsoft 365 account using global admin credentials and start the Exchange Hybrid Configuration Wizard from the Data Migration page under Setup in the Microsoft 365 admin console and connect to the on-premises Exchange Server organization. Choose the Minimal Hybrid Configuration.

3. Select the option to synchronize users and passwords one at a time. You will be prompted to install Azure AD Connect with the default options. Synchronization will occur once and then be turned off.

4. Configure Office 365 licenses for migrated users and then begin migrating user mailbox data.

5. Update DNS MX records to point away from the on-premises Exchange deployment to Exchange Online.

IMAP migration

IMAP migrations use the IMAP protocol to move the contents of on-premises user mailboxes to Exchange Online. IMAP migrations are suitable where the on-premises mail server is not running Exchange Server, but is instead running an alternate mail server solution.

IMAP migration is supported for the following on-premises messaging solutions:

• Courier-IMAP

• Cyrus

• Dovecot

• UW-IMAP

IMAP migrations involve the following general steps:

1. A tenant administrator creates Office 365 user accounts and assigns them Exchange Online user licenses. This provisions the user accounts with Exchange Online mailboxes.

2. The tenant administrator creates a CSV file. This CSV file includes a row for each on-premises user who will be migrated to Exchange Online using IMAP. This CSV file needs to include the passwords used by each on-premises IMAP mailbox user. It is recommended that you reset user passwords for on-premises IMAP mailbox users to simplify this process.

3. The administrator creates and then triggers an IMAP migration batch. This can be done using the Migration dashboard, available in the Data Migration blade under setup and shown in Figure 1-52, or through Windows PowerShell.

   

4. Once the migration batch is initiated, the following occurs:

   • Exchange Online creates a migration request for each user in the CSV file.

   • Each migration request includes the credentials for the user in the on-premises IMAP messaging system.

   • Messages from each user’s IMAP mailbox are copied to the corresponding Exchange Online mailbox until all data is migrated.

5. Exchange Online provides a status email to the administrator informing them of the status of the migration. This email contains statistics about the number of mailboxes successfully migrated, how many could not be migrated, and any error reports.

6. Exchange Online and the IMAP messaging system are synchronized every 24 hours to move any new messages from the on-premises environment to Exchange Online.

7. Once all migration issues have been resolved, the administrator updates MX records to point to Exchange Online. Once mail is flowing to Exchange Online, the administrator deletes the migration batches.

Migration comparison

Table 1-9 lists the difference between the different methods you can use to migrate from an on-premises messaging environment to Exchange Online.

Table 1-9 Migration type comparison

Understanding user categories

Not every user account in your organization’s on-premises Active Directory instance is the same. While the vast majority of on-premises user accounts are used to sign on to workstations and access resources, a small number of accounts are used for different purposes, the most straightforward example being service accounts. Prior to performing a migration of accounts you should make the following determination:

• Is the user account still active? Unless your organization has an effective user deprovisioning strategy, it is likely that there will be accounts in Active Directory that are associated with people that are no longer employed by your organization. There is no reason to migrate inactive user accounts from an on-premises Active Directory environment to Microsoft 365.

• Should the account be migrated to Microsoft 365? Some user accounts exist for specific purposes, such as being used as service accounts or as administrative accounts for specific services or workloads that will not be migrated to Microsoft 365. Service accounts and accounts used for specific on-premises workloads are unlikely to be required once your organization migrates to Microsoft 365.

Using the bulk import process

If your organization is planning to completely migrate to Azure AD as the primary identity provider and to decommission Active Directory, you might choose to perform a bulk import of user accounts rather than attempt manual creation. If the organization that you are migrating only has a small number of users, it may be simpler to manually create those users using the Microsoft 365 administration tools. If you need to migrate a larger number where the manual creation process is both laborious and tedious, you may instead choose to perform a bulk import.

The bulk import process allows you to import a list of users from a specially formatted CSV file into Microsoft 365. This CSV file must have the following fields in the first row:

• User Name

• First Name

• Last Name

• Display Name

• Job Title

• Department

• Office Number

• Office Phone

• Mobile Phone

• Fax

• Address

• City

• State or Province

• ZIP or Postal Code

• Country or Region

Each of these fields must be on the first line and each must be separated by a comma. Both a sample and a blank CSV file can be downloaded from the Bulk Add Users page. Once you have populated the CSV file with the account information you want to import, complete this operation by performing the following steps:

1. In the Microsoft 365 Admin Center, click On The Active Users node under the Users node.

2. Click More and then click Import Multiple Users.

3. On the Select a CSV file page, shown in Figure 1-53, select the specially formatted file that has the user account information and click Next.

   

4. On the Import Multiple Users page, specify whether the users are allowed to sign in and access services. You will also need to specify the user location on this page. Choose which licenses are assigned, as shown in Figure 1-54.

   

5. On the Results page, you will see a list of users created and a list of temporary passwords assigned.

Using soft delete

Some accounts that you migrate to Microsoft 365 may not be necessary. Similarly, there may be user accounts created during the trial or pilot Microsoft 365 deployment that are no longer appropriate once existing user accounts are migrated to Office 365. There are several methods that you can use to delete Microsoft 365 user accounts. Whether the user account is permanently deleted, termed a “hard delete,” or is moved to the Azure Active Directory Recycle Bin, termed a “soft delete,” depends on the method used to delete the account.

You can use the following methods to delete a Microsoft 365 user account:

• Delete the user account from the Microsoft 365 admin portal. This involves navigating to the Users node, selecting the Active Users node, selecting the user that you want to delete, and selecting Delete User from the list of tasks associated with the user, as shown in Figure 1-55.

  

• Delete using the Remove-MsolUser cmdlet, located in the Azure Active Directory module for Windows PowerShell.

• User accounts can be deleted through the Exchange Admin Center in Exchange Online.

• If directory synchronization is configured, users can be deleted when removed from the on-premises Active Directory Directory Services instance.

You can view a list of soft deleted users in the Deleted Users section, under the Users area of the Microsoft 365 Admin Center as shown in Figure 1-56. Soft-deleted users remain visible for for 30 days and can be recovered during this period. After this period expires, the user account is deleted and is unrecoverable.

To recover a soft deleted user, select the user account in the Deleted Users node of Microsoft 365 admin console and click Restore. When you restore an account, you’ll be asked whether to auto-generate a new password for the user, assign a password yourself, and whether you want to have the user change their password when they sign on as shown in Figure 1-57.

Migrating Groups to Microsoft 365

On-premises groups come in a variety of types and scopes. For the purposes of migrating to Microsoft 365, group scope, which can include domain local, domain global, and universal, isn’t relevant. This is because if you’ve chosen to migrate users to Azure Active Directory and decommission your organization’s on-premises directory, you’re unlikely to be concerned whether a group is visible in other domains in an Active Directory forest, simply because you are intending to retire that particular security construct.

Office 365 groups allow you to set up a collection of resources that a set of users can share. Resources might include a shared calendar, SharePoint Online document library, or a shared Exchange Online mailbox. Groups can be configured as public or private. Content in a public group is visible to anyone who has an account in the tenancy. Content in a private group is only visible to members of that group.

There are three methods through which Office 365 groups can be provisioned. These are as follows:

• Open The default method of provisioning O365 groups. Allows M365 users to create their own groups as needed.

• IT-led Users are able to request a group from IT.

• Controlled Group creation is limited to users that have been delegated the group creation role.

Each group can have one or more owners. Group owners have the ability to add or remove members as well as to perform basic group curation tasks. O365 groups have the following limits:

• A group can have up to 100 owners.

• A user can create up to 250 groups.

• A tenancy can have up to 500,000 groups.

• 1000 users can access a group conversation concurrently, though it is possible for a group to have more members.

• A user can be a member of 1000 groups.

• A group can store up to 1 terabyte of data with an additional 10 GB per subscribed users. It is possible to purchase additional storage for a group.

• A group mailbox has a size limit of 50 GB.