Microsoft 365 Admin Guide: What 8 Years of Managing M365 at a Global Enterprise Taught Me

M365 Is Not a Product — It's an Ecosystem

Most IT professionals think of Microsoft 365 as "Office + email + Teams." After 8 years administering it at a global enterprise with a few hundred users across multiple offices, I can tell you it's far more than that — and most organisations use maybe 30% of what they're paying for.

Photo: Unsplash

The M365 Admin Landscape

The 10 Most Common M365 Issues (And How to Actually Fix Them)

1. "I Can't Access My Email From Outside the Office"

Cause 90% of the time: Conditional Access policy blocking non-compliant devices or non-trusted locations.

Fix: Check the Sign-in Logs in Entra ID. Filter by user, look for the failed sign-in, expand the Conditional Access section. It will tell you exactly which policy blocked them and why.

2. Email Keeps Going to Spam

Check in this order:

1. Exchange Quarantine — is it being held there?
2. Mail flow rules — has someone created an overly aggressive rule?
3. Anti-spam policy — sender domain reputation score
4. Check if the domain is on a blocklist: use MXToolbox

3. Teams Meeting Room Not Working

The most common MTR issues and their fixes:

4. SharePoint "Access Denied"

SharePoint permissions are the source of 40% of all M365 support tickets in a typical enterprise. The hierarchy:

Tenant → Site Collection → Site → Library → Folder → File

Permissions cascade down, but broken inheritance breaks this. Always check:

1. Does the user have a Site Collection license?
2. Was the sharing link expired?
3. Is there a sensitive label blocking external access?
4. Is the user in the correct Azure AD group?

5. OneDrive Sync Issues

The most reliable fix:

Stop sync → Sign out of OneDrive → Delete the local sync folder content → Re-link

But first: check the sync client version. Outdated OneDrive clients cause 60% of sync issues.

Teams Governance: The Problem Nobody Addresses

Without governance, Teams sprawl becomes an audit nightmare. After 6 months of no governance at one organisation, there were 47 active Teams channels — many abandoned, with sensitive files shared publicly.

The governance framework I implemented:

1. Teams creation policy — only IT admins and approved owners can create new Teams
2. Guest access policy — external guests require IT manager approval
3. Retention policy — Teams messages retained for 2 years, then archived
4. Naming convention — all Teams prefixed with department code: IT-, HR-
5. Inactive Teams review — quarterly audit, archive if no activity for 90 days

This reduced the Teams count from 47 to 22 active channels within one quarter.

M365 Adoption Rate by Feature

M365 Copilot: What I've Learned in the First 6 Months

Enterprise deployments of M365 Copilot have been rolling out to select users. My observations:

Where it delivers immediate value:

• Summarising long email threads (10 min → 30 sec)
• Transcribing and summarising Teams meeting recordings
• Drafting first versions of routine communications
• "Catch me up" on channels you missed

Where it struggles:

• Anything requiring deep domain knowledge without context
• Generating accurate data — always verify numbers it produces
• Following complex multi-step instructions reliably

The honest ROI number: Based on a pilot deployment, users with Copilot access saved an average of 45 minutes per day on communication tasks. That's meaningful — but it requires training users on how to use it, not just providing access.

The M365 Admin Superpower: PowerShell

Every M365 admin who relies only on the GUI is leaving 70% of their power unused. The tasks that take 10 minutes in the portal take 30 seconds in PowerShell:

# Export all users with last sign-in date (identify inactive accounts)
Connect-MgGraph -Scopes "User.Read.All", "AuditLog.Read.All"
Get-MgUser -All -Property "DisplayName,UserPrincipalName,SignInActivity" |
    Select DisplayName, UserPrincipalName, 
           @{N="LastSignIn";E={$_.SignInActivity.LastSignInDateTime}} |
    Where-Object { $_.LastSignIn -lt (Get-Date).AddDays(-90) } |
    Export-Csv "inactive_users.csv" -NoTypeInformation

Run this monthly. Any account with no sign-in in 90 days gets flagged for review — a key security hygiene step that prevents stale account risks.

The Metric That Proves Your M365 Administration Quality

Microsoft Secure Score. Available in the Microsoft 365 Defender portal. A typical journey:

• Day 1: 41% (inherited, no active management)
• Month 3: 58% (MFA deployed, legacy auth blocked)
• Month 6: 71% (Intune compliance, Conditional Access)
• Month 12: 78% (Defender policies, data loss prevention, sensitivity labels)

Every 10 points of Secure Score represents real risk reduction. It's not just a vanity metric.