# Complete your tenant configuration in Microsoft 365

## 1\. **What is Tenant Configuration?**

* A **tenant** = your organization’s dedicated Microsoft 365 environment.
    
* **Configuring the tenant** ensures that:
    
    * Users can access services properly.
        
    * Security & compliance are enforced.
        
    * Mail flow, domains, and devices are fully functional.
        

---

## 2\. **Common Tasks for Tenant Setup**

### 🔹 User & Mailbox Migration

* Ensure all users and mailboxes are migrated from on-premises or another provider.
    
* Verify **mailbox functionality** (send/receive, calendar, contacts).
    
* Check data integrity post-migration.
    

---

### 🔹 System Resources & Permissions

* Configure access to resources (SharePoint sites, Teams, OneDrive).
    
* Assign permissions following the **least privilege principle** (only give users what they need).
    

---

### 🔹 Domain Configuration

* Add & verify **custom domains (vanity domains)**.
    
* Update DNS to point to Microsoft 365.
    
* Helps with email branding (`@`[`yourcompany.com`](http://yourcompany.com) instead of `@`[`onmicrosoft.com`](http://onmicrosoft.com)).
    

---

### 🔹 Device Management

* Enroll Windows 10/11 devices into **Intune** for MDM (mobile device management).
    
* If using Microsoft Endpoint Configuration Manager → configure **co-management** for hybrid management.
    

---

### 🔹 Mobile Device Governance

* Apply policies for BYOD (Bring Your Own Device).
    
* Require PINs, encryption, app protection, and remote wipe capabilities.
    

---

### 🔹 DNS Records & Mail Flow

* Update global DNS records (MX, SPF, DKIM, DMARC).
    
* Ensure proper email routing and phishing protection.
    
* Validate via **Microsoft Remote Connectivity Analyzer**.
    

---

### 🔹 Identity Synchronization

* If hybrid → use **Microsoft Entra Connect** (formerly Azure AD Connect).
    
* Ensures on-premises AD accounts sync with Microsoft 365.
    
* Validate sync status and password policies.
    

---

### 🔹 Multifactor Authentication (MFA)

* Strongly recommended for **all users**.
    
* Adds an extra layer of security beyond passwords.
    
* Can be enforced via **Conditional Access policies**.
    

---

### 🔹 Security & Compliance Enhancements

* Implement **Conditional Access** (e.g., block logins from risky locations).
    
* Disable **legacy authentication protocols** (POP/IMAP/SMTP basic auth).
    
* Ensure **audit logging** is enabled (ties into Unified Audit Logging).
    

---

### 🔹 Data Protection

* **Data Loss Prevention (DLP)** → prevents sharing of sensitive info (e.g., credit card numbers).
    
* **Azure Information Protection (AIP)** → classifies and labels data for confidentiality.
    
* Helps with regulatory compliance (GDPR, HIPAA, etc.).
    

---

### 🔹 Monitoring & Reporting

* Use **Microsoft Secure Score**:
    
    * A security dashboard that gives you a percentage score.
        
    * Provides **recommendations** (e.g., enable MFA, configure Safe Links).
        
* Helps track security posture improvements.
    

---

### 🔹 Regular Security Reviews

* Periodically review settings (Conditional Access, sharing policies, DLP rules).
    
* Adjust policies as business needs evolve.
    
* Stay aligned with **best practices** and compliance requirements.
    

---

## 3\. **Verifying Tenant Readiness**

* **Microsoft Remote Connectivity Analyzer** → checks DNS, mail flow.
    
* **SARA (Support and Recovery Assistant)** → diagnoses sign-in, Outlook, Teams, and connectivity issues.
    

---

## 4\. **Other Consideration: Tenant-to-Tenant Migration**

* Used for **mergers, acquisitions, or restructurings**.
    
* Moves mailboxes, SharePoint data, Teams, and users between tenants.
    
* Complex and requires specialized planning (out of scope for this training).
    

---

# 🎯 Study Summary (What to Remember)

* Tenant configuration = making sure **users, devices, domains, mail, and security** are fully set up.
    
* **Critical items**: Domain verification, DNS setup, MFA, Conditional Access, DLP, and Secure Score monitoring.
    
* Use tools like **Remote Connectivity Analyzer** and **SARA** to verify readiness.
    
* Regular reviews = long-term **security & compliance health**.