ms365-tenant-manager

# Microsoft 365 Tenant Manager

This skill provides expert guidance and automation for Microsoft 365 Global Administrators managing tenant setup, configuration, user lifecycle, security policies, and organizational optimization.

## Capabilities

- **Tenant Setup & Configuration**: Initial tenant setup, domain configuration, DNS records, service provisioning
- **User & Group Management**: User lifecycle (create, modify, disable, delete), group creation, license assignment
- **Security & Compliance**: Conditional Access policies, MFA setup, DLP policies, retention policies, security baselines
- **SharePoint & OneDrive**: Site provisioning, permissions management, storage quotas, sharing policies
- **Teams Administration**: Team creation, policy management, guest access, compliance settings
- **Exchange Online**: Mailbox management, distribution groups, mail flow rules, anti-spam/malware policies
- **License Management**: License allocation, optimization, cost analysis, usage reporting
- **Reporting & Auditing**: Activity reports, audit logs, compliance reporting, usage analytics
- **Automation Scripts**: PowerShell script generation for bulk operations and recurring tasks
- **Best Practices**: Microsoft recommended configurations, security hardening, governance frameworks

## Input Requirements

Tenant management tasks require:
- **Action type**: setup, configure, create, modify, delete, report, audit
- **Resource details**: User info, group names, policy settings, service configurations
- **Organizational context**: Company size, industry, compliance requirements (GDPR, HIPAA, etc.)
- **Current state**: Existing configurations, licenses, user count
- **Desired outcome**: Specific goals, requirements, or changes needed

Formats accepted:
- Text descriptions of administrative tasks
- JSON with structured configuration data
- CSV for bulk user/group operations
- Existing PowerShell scripts to review or modify

## Output Formats

Results include:
- **Step-by-step instructions**: Detailed guidance for manual configuration via Admin Center
- **PowerShell scripts**: Ready-to-use scripts for automation (with safety checks)
- **Configuration recommendations**: Security and governance best practices
- **Validation checklists**: Pre/post-implementation verification steps
- **Documentation**: Markdown documentation of changes and configurations
- **Rollback procedures**: Instructions to undo changes if needed
- **Compliance reports**: Security posture and compliance status

## How to Use

"Set up a new Microsoft 365 tenant for a 50-person company with security best practices"
"Create a PowerShell script to provision 100 users from a CSV file with appropriate licenses"
"Configure Conditional Access policy requiring MFA for all admin accounts"
"Generate a report of all inactive users in the past 90 days"
"Set up Teams policies for external collaboration with security controls"

## Scripts

- `tenant_setup.py`: Initial tenant configuration and service provisioning automation
- `user_management.py`: User lifecycle operations and bulk provisioning
- `security_policies.py`: Security policy configuration and compliance checks
- `reporting.py`: Analytics, audit logs, and compliance reporting
- `powershell_generator.py`: Generates PowerShell scripts for Microsoft Graph API and admin modules

## Best Practices

### Tenant Setup
1. **Enable MFA first** - Before adding users, enforce multi-factor authentication
2. **Configure named locations** - Define trusted IP ranges for Conditional Access
3. **Set up privileged access** - Use separate admin accounts, enable PIM (Privileged Identity Management)
4. **Domain verification** - Add and verify custom domains before bulk user creation
5. **Baseline security** - Apply Microsoft Secure Score recommendations immediately

### User Management
1. **License assignment** - Use group-based licensing for scalability
2. **Naming conventions** - Establish consistent user principal names (UPNs) and display names
3. **Lifecycle management** - Implement automated onboarding/offboarding workflows
4. **Guest access** - Enable only when necessary, set expiration policies
5. **Shared mailboxes** - Use for department emails instead of assigning licenses

### Security & Compliance
1. **Zero Trust approach** - Verify explicitly, use least privilege access, assume breach
2. **Conditional Access** - Start with report-only mode, then enforce gradually
3. **Data Loss Prevention** - Define sensitive information types, test policies before enforcement
4. **Retention policies** - Balance compliance requirements with storage costs
5. **Regular audits** - Review permissions, licenses, and security settings quarterly

### SharePoint & Teams
1. **Site provisioning** - Use templates and governance policies
2. **External sharing** - Restrict to specific domains, require authentication
3. **Storage management** - Set quotas, enable auto-cleanup of old content
4. **Teams templates** - Create standardized team structures for consistency
5. **Guest lifecycle** - Set expiration and regular recertification

### PowerShell Automation
1. **Use Microsoft Graph** - Prefer Graph API over legacy MSOnline modules
2. **Error handling** - Include try/catch blocks and validation checks
3. **Dry-run mode** - Test scripts with -WhatIf before executing
4. **Logging** - Capture all operations for audit trails
5. **Credential management** - Use Azure Key Vault or managed identities, never hardcode

## Common Tasks

### Initial Tenant Setup
- Configure company branding
- Add and verify custom domains
- Set up DNS records (MX, SPF, DKIM, DMARC)
- Enable required services (Teams, SharePoint, Exchange)
- Create organizational structure (departments, locations)
- Set default user settings and policies

### User Onboarding
- Create user accounts (single or bulk)
- Assign appropriate licenses
- Add to security and distribution groups
- Configure mailbox and OneDrive
- Set up multi-factor authentication
- Provision Teams access

### Security Hardening
- Enable Security Defaults or Conditional Access
- Configure MFA enforcement
- Set up admin role assignments
- Enable audit logging
- Configure anti-phishing policies
- Set up DLP and retention policies

### Reporting & Monitoring
- Active users and license utilization
- Security incidents and alerts
- Mailbox usage and storage
- SharePoint site activity
- Teams usage and adoption
- Compliance and audit logs

## Limitations

- **Permissions required**: Global Administrator or specific role-based permissions
- **API rate limits**: Microsoft Graph API has throttling limits for bulk operations
- **License dependencies**: Some features require specific license tiers (E3, E5)
- **Delegation constraints**: Some tasks cannot be delegated to service principals
- **Regional variations**: Compliance features may vary by geographic region
- **Hybrid scenarios**: On-premises Active Directory integration requires additional configuration
- **Third-party integrations**: External apps may require separate authentication and permissions
- **PowerShell prerequisites**: Requires appropriate modules installed (Microsoft.Graph, ExchangeOnlineManagement, etc.)

## Security Considerations

### Authentication
- Never store credentials in scripts or configuration files
- Use Azure Key Vault for credential management
- Implement certificate-based authentication for automation
- Enable Conditional Access for admin accounts
- Use Privileged Identity Management (PIM) for JIT access

### Authorization
- Follow principle of least privilege
- Use custom admin roles instead of Global Admin when possible
- Regularly review and audit admin role assignments
- Enable PIM for temporary elevated access
- Separate user accounts from admin accounts

### Compliance
- Enable audit logging for all activities
- Retain logs according to compliance requirements
- Configure data residency for regulated industries
- Implement information barriers where needed
- Regular compliance assessments and reporting

## PowerShell Modules Required

To execute generated scripts, ensure these modules are installed:
- `Microsoft.Graph` (recommended, modern Graph API)
- `ExchangeOnlineManagement` (Exchange Online management)
- `MicrosoftTeams` (Teams administration)
- `SharePointPnPPowerShellOnline` (SharePoint management)
- `AzureAD` or `AzureADPreview` (Azure AD management - being deprecated)
- `MSOnline` (Legacy, being deprecated - avoid when possible)

## Updates & Maintenance

- Microsoft 365 features and APIs evolve rapidly
- Review Microsoft 365 Roadmap regularly for upcoming changes
- Test scripts in non-production tenant before production deployment
- Subscribe to Microsoft 365 Admin Center message center for updates
- Keep PowerShell modules updated to latest versions
- Regular security baseline reviews (quarterly recommended)

## Helpful Resources

- **Microsoft 365 Admin Center**: https://admin.microsoft.com
- **Microsoft Graph Explorer**: https://developer.microsoft.com/graph/graph-explorer
- **PowerShell Gallery**: https://www.powershellgallery.com
- **Microsoft Secure Score**: Security posture assessment in Admin Center
- **Microsoft 365 Compliance Center**: https://compliance.microsoft.com
- **Azure AD Conditional Access**: Identity and access management policies