Skip to main content Comprehensive Microsoft 365 tenant administration skill for setup, configuration, user management, security policies, and organizational structure optimization for Global Administrators
npx skills add alirezarezvani/claude-code-skill-factory --skill ms365-tenant-manager ai-agents ai-tools claude-ai claude-code claude-skills claude-skills-creator
Microsoft 365 Tenant Manager
This skill provides expert guidance and automation for Microsoft 365 Global Administrators managing tenant setup, configuration, user lifecycle, security policies, and organizational optimization.
Capabilities
Tenant Setup & Configuration : Initial tenant setup, domain configuration, DNS records, service provisioningUser & Group Management : User lifecycle (create, modify, disable, delete), group creation, license assignmentSecurity & Compliance : Conditional Access policies, MFA setup, DLP policies, retention policies, security baselinesSharePoint & OneDrive : Site provisioning, permissions management, storage quotas, sharing policiesTeams Administration : Team creation, policy management, guest access, compliance settingsExchange Online : Mailbox management, distribution groups, mail flow rules, anti-spam/malware policiesLicense Management : License allocation, optimization, cost analysis, usage reportingReporting & Auditing : Activity reports, audit logs, compliance reporting, usage analyticsAutomation Scripts : PowerShell script generation for bulk operations and recurring tasksBest Practices : Microsoft recommended configurations, security hardening, governance frameworks
Input Requirements
Tenant management tasks require:
Action type : setup, configure, create, modify, delete, report, auditResource details : User info, group names, policy settings, service configurationsOrganizational context : Company size, industry, compliance requirements (GDPR, HIPAA, etc.)Current state : Existing configurations, licenses, user count
Desired outcome
Text descriptions of administrative tasks
JSON with structured configuration data
CSV for bulk user/group operations
Existing PowerShell scripts to review or modify
Output Formats
Step-by-step instructions : Detailed guidance for manual configuration via Admin CenterPowerShell scripts : Ready-to-use scripts for automation (with safety checks)Configuration recommendations : Security and governance best practicesValidation checklists : Pre/post-implementation verification stepsDocumentation : Markdown documentation of changes and configurationsRollback procedures : Instructions to undo changes if neededCompliance reports : Security posture and compliance status
How to Use "Set up a new Microsoft 365 tenant for a 50-person company with security best practices"
"Create a PowerShell script to provision 100 users from a CSV file with appropriate licenses"
"Configure Conditional Access policy requiring MFA for all admin accounts"
"Generate a report of all inactive users in the past 90 days"
"Set up Teams policies for external collaboration with security controls"
Scripts
tenant_setup.py: Initial tenant configuration and service provisioning automationuser_management.py: User lifecycle operations and bulk provisioningsecurity_policies.py: Security policy configuration and compliance checksreporting.py: Analytics, audit logs, and compliance reportingpowershell_generator.py: Generates PowerShell scripts for Microsoft Graph API and admin modules
Best Practices
Tenant Setup
Enable MFA first - Before adding users, enforce multi-factor authenticationConfigure named locations - Define trusted IP ranges for Conditional AccessSet up privileged access - Use separate admin accounts, enable PIM (Privileged Identity Management)Domain verification - Add and verify custom domains before bulk user creationBaseline security - Apply Microsoft Secure Score recommendations immediately
User Management
License assignment - Use group-based licensing for scalabilityNaming conventions - Establish consistent user principal names (UPNs) and display namesLifecycle management - Implement automated onboarding/offboarding workflowsGuest access - Enable only when necessary, set expiration policiesShared mailboxes - Use for department emails instead of assigning licenses
Security & Compliance
Zero Trust approach - Verify explicitly, use least privilege access, assume breachConditional Access - Start with report-only mode, then enforce graduallyData Loss Prevention - Define sensitive information types, test policies before enforcementRetention policies - Balance compliance requirements with storage costsRegular audits - Review permissions, licenses, and security settings quarterly
SharePoint & Teams
Site provisioning - Use templates and governance policiesExternal sharing - Restrict to specific domains, require authenticationStorage management - Set quotas, enable auto-cleanup of old contentTeams templates - Create standardized team structures for consistencyGuest lifecycle - Set expiration and regular recertification
PowerShell Automation
Use Microsoft Graph - Prefer Graph API over legacy MSOnline modulesError handling - Include try/catch blocks and validation checksDry-run mode - Test scripts with -WhatIf before executingLogging - Capture all operations for audit trailsCredential management - Use Azure Key Vault or managed identities, never hardcode
Common Tasks
Initial Tenant Setup
Configure company branding
Add and verify custom domains
Set up DNS records (MX, SPF, DKIM, DMARC)
Enable required services (Teams, SharePoint, Exchange)
Create organizational structure (departments, locations)
Set default user settings and policies
User Onboarding
Create user accounts (single or bulk)
Assign appropriate licenses
Add to security and distribution groups
Configure mailbox and OneDrive
Set up multi-factor authentication
Provision Teams access
Security Hardening
Enable Security Defaults or Conditional Access
Configure MFA enforcement
Set up admin role assignments
Enable audit logging
Configure anti-phishing policies
Set up DLP and retention policies
Reporting & Monitoring
Active users and license utilization
Security incidents and alerts
Mailbox usage and storage
SharePoint site activity
Teams usage and adoption
Compliance and audit logs
Limitations
Permissions required : Global Administrator or specific role-based permissionsAPI rate limits : Microsoft Graph API has throttling limits for bulk operationsLicense dependencies : Some features require specific license tiers (E3, E5)Delegation constraints : Some tasks cannot be delegated to service principalsRegional variations : Compliance features may vary by geographic regionHybrid scenarios : On-premises Active Directory integration requires additional configurationThird-party integrations : External apps may require separate authentication and permissionsPowerShell prerequisites : Requires appropriate modules installed (Microsoft.Graph, ExchangeOnlineManagement, etc.)
Security Considerations
Authentication
Never store credentials in scripts or configuration files
Use Azure Key Vault for credential management
Implement certificate-based authentication for automation
Enable Conditional Access for admin accounts
Use Privileged Identity Management (PIM) for JIT access
Authorization
Follow principle of least privilege
Use custom admin roles instead of Global Admin when possible
Regularly review and audit admin role assignments
Enable PIM for temporary elevated access
Separate user accounts from admin accounts
Compliance
Enable audit logging for all activities
Retain logs according to compliance requirements
Configure data residency for regulated industries
Implement information barriers where needed
Regular compliance assessments and reporting
PowerShell Modules Required To execute generated scripts, ensure these modules are installed:
Microsoft.Graph (recommended, modern Graph API)ExchangeOnlineManagement (Exchange Online management)MicrosoftTeams (Teams administration)SharePointPnPPowerShellOnline (SharePoint management)AzureAD or AzureADPreview (Azure AD management - being deprecated)MSOnline (Legacy, being deprecated - avoid when possible)
Updates & Maintenance
Microsoft 365 features and APIs evolve rapidly
Review Microsoft 365 Roadmap regularly for upcoming changes
Test scripts in non-production tenant before production deployment
Subscribe to Microsoft 365 Admin Center message center for updates
Keep PowerShell modules updated to latest versions
Regular security baseline reviews (quarterly recommended)
Helpful Resources Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Create or update AgentSkills. Use when designing, structuring, or packaging skills with scripts, references, and assets.
Set up and use 1Password CLI (op). Use when installing the CLI, enabling desktop app integration, signing in (single or multi-account), or reading/injecting/running secrets via op.
CLI to manage emails via IMAP/SMTP. Use `himalaya` to list, read, write, reply, forward, search, and organize emails from the terminal. Supports multiple accounts and message composition with MML (MIME Meta Language).
