Skip to content
IT Atlas

Platforms · Microsoft 365

Microsoft 365

An integrated productivity, collaboration, identity, security and management suite delivered as a single tenant scoped cloud service.

IntermediateMicrosoftUpdated 2026-09-01

Overview

Microsoft 365 is best understood as several services sharing one identity and one governance surface. Entra ID authenticates and authorises; Exchange Online, SharePoint Online, OneDrive and Teams hold data; Intune manages devices; Defender protects; Purview governs and retains.

Almost every operational surprise in Microsoft 365 comes from those dependencies. Teams files live in SharePoint, Teams chat lives in a hidden mailbox folder, group membership drives site access, and licensing determines which controls are available at all.

How it works

  1. 01A tenant is the top level boundary: one Entra ID directory, one set of domains, one licensing pool, one compliance boundary.
  2. 02Groups (Microsoft 365 groups, security groups, dynamic groups) drive membership for Teams, sites, licensing and policy targeting.
  3. 03Licensing determines feature availability; several security controls are only present in specific plans or add ons, which must be verified before designing around them.
  4. 04Administrative access is delegated through Entra roles and service specific roles, and should be governed with PIM rather than permanent assignment.

Layer model

Identity & access
Microsoft Entra IDConditional AccessPrivileged Identity ManagementEntra Connect / Cloud Sync
Productivity & data
Exchange OnlineSharePoint OnlineOneDriveTeamsMicrosoft 365 AppsPower Platform
Device management
Microsoft IntuneWindows AutopilotSecurity baselinesApp protection policies
Security
Defender for Office 365Defender for EndpointDefender for IdentityDefender for Cloud Apps
Governance & compliance
Purview retention and labelsData loss preventioneDiscovery and auditInsider risk management

Design considerations

  • Decide tenant strategy early; multi tenant estates after acquisitions are expensive to consolidate and to govern.
  • Define external sharing, guest access and Team creation policy before adoption spreads.
  • Plan hybrid identity and mail coexistence explicitly, including the eventual decommissioning of on premises servers.
  • Set audit log retention and eDiscovery expectations against your investigative and regulatory needs.

Security considerations

  • Enforce phishing resistant MFA for administrators and block legacy authentication tenant wide.
  • Restrict user consent to applications and review existing OAuth grants regularly.
  • Enable unified audit logging and confirm its retention period; investigations depend on it.
  • Alert on mailbox rule creation, external forwarding, mass file access and privileged role changes.
  • Do not assume the platform backs up your data against malicious deletion, confirm retention and recovery capability explicitly.

Common misconfigurations

  • Anonymous sharing links enabled by default with no expiry.
  • Global Administrator assigned permanently to service accounts and to more people than necessary.
  • Security defaults or Conditional Access left partially configured after a migration.
  • Purview retention policies configured without understanding their interaction with deletion and legal hold.

Primary sources