Lab 05: Microsoft 365 User Admin

Overview

In this lab, I extended the existing Nietz Ltd environment from the on-premises Active Directory and file services foundation into Microsoft 365. The previous labs established DC1, CL1, FS1, the corp.nietz.co.uk Active Directory domain, department users, security groups, file shares, and Group Policy access control.

This lab created the matching Microsoft 365 cloud administration baseline using the public domain nietz.co.uk. The cloud users were created as Microsoft 365 accounts for this stage; hybrid identity synchronisation is intentionally reserved for the later hybrid identity lab.

Objective

The objective was to prepare Nietz Ltd for Microsoft 365 administration by verifying the tenant domain, creating cloud users with @nietz.co.uk sign-in names, assigning licences, confirming Exchange Online mailbox provisioning, creating cloud security groups for later policy targeting, and validating a successful user sign-in through Entra sign-in logs.

Environment

Configuration

1. Microsoft 365 Domain Verification

I added and verified nietz.co.uk in Microsoft 365 so users could be created with the same public sign-in domain used in the Active Directory UPN plan from Lab 03.

Context: Verifying the public domain is a core Microsoft 365 onboarding step. It allows users to sign in as [email protected] instead of using the fallback onmicrosoft.com domain.

2. DNS Verification Record

I confirmed the Microsoft domain verification TXT record in Cloudflare for nietz.co.uk.

Context: The TXT record proves domain ownership to Microsoft 365 without changing mail routing. MX records were deliberately left unchanged until the later Exchange and mail flow labs.

3. Cloud Users and Licence Assignment

I created the Microsoft 365 cloud users for the Nietz Ltd departments and assigned Office 365 E5 licences to the operational users and daily admin account.

Context: User and licence administration is a core Microsoft 365 support task. The unlicensed global admin account remains separated from the licensed daily admin and operational users.

4. Mailbox Provisioning

I confirmed in Exchange admin center that licensed users had Exchange Online user mailboxes provisioned.

Context: A licence alone is not enough evidence of readiness. Mailbox visibility in Exchange admin center confirms that Exchange Online successfully provisioned user mailboxes.

5. Cloud Security Groups

I recreated the department and pilot security group model in Entra ID so cloud services can use the same group-based administration pattern prepared in the on-premises labs.

Context: Group-based targeting prepares the environment for later Conditional Access, Intune, LAPS, Windows Hello for Business, update ring, Teams, SharePoint, and OneDrive labs.

6. User Sign-In Validation

I signed in as Chloe Bennett to confirm that a standard cloud user could access the Microsoft 365 account experience using the @nietz.co.uk sign-in name.

Context: User-facing sign-in validation proves that the account is usable, not just present in the admin center.

7. Entra Sign-In Log Validation

I confirmed the successful Chloe Bennett sign-in in Entra ID sign-in events.

Context: Sign-in logs are important support evidence because they show authentication outcomes, application access, timestamps, and user principal names from the cloud identity platform.

Validation

The lab was validated when nietz.co.uk was verified in Microsoft 365, the Cloudflare TXT record confirmed domain ownership, Microsoft 365 users existed with @nietz.co.uk usernames, Office 365 E5 licences were assigned, Exchange Online mailboxes were provisioned, cloud security groups existed in Entra ID, and Chloe Bennett successfully signed in.

The Entra sign-in events confirmed successful Microsoft 365 sign-ins for [email protected], providing admin-side validation of the user-facing sign-in test.

Key Technical Outcomes

This lab established the Microsoft 365 cloud identity and licensing baseline for Nietz Ltd while keeping the same naming model created in Active Directory.

It also demonstrated the relationship between domain verification, cloud user creation, licence assignment, Exchange Online mailbox provisioning, Entra security groups, and sign-in log validation.