SOP — Subscribe to and Manage Microsoft 365

Throughout, replace the example values (mptwork.com, sample users) with your own. Always copy the exact domain-verification and MX values from the admin center — the ones below follow Microsoft's standard pattern but the verification token is unique to your tenant.

Part 1 — Subscribe (create the tenant)

1. In a browser, go to https://www.microsoft.com/microsoft-365 and choose a plan (this example uses Microsoft 365 Business Premium). Select Try free or Buy now.
2. On the sign-up form enter your business email and details. When prompted for an initial sign-in, create the tenant identity:
   • Initial admin: admin@mptwork.onmicrosoft.com
   • This creates the tenant mptwork.onmicrosoft.com with a Global Administrator.
3. Complete identity verification (phone code) and payment, then choose the number of seats.
4. Sign in to the Microsoft 365 admin center at https://admin.microsoft.com.
5. Go to Billing → Your products and confirm the subscription and seat count.
6. Go to Settings → Org settings → Organization profile and set the data location, and under Release preferences set a pilot group to Targeted release if you want to preview changes.

Part 2 — Add and verify the domain mptwork.com

1. In the admin center, go to Settings → Domains → Add domain, and enter mptwork.com.
2. Return to the wizard and click Verify. (DNS can take up to ~30 minutes to propagate.)
3. Set the default domain: Settings → Domains → select mptwork.com → Set as default, so new users default to name@mptwork.com.
4. Harden mail authentication:
   • DKIM: in the Defender portal (https://security.microsoft.com) → Email & collaboration → Policies & rules → Threat policies → DKIM, enable signing for mptwork.com. Publish the two CNAMEs it provides:
     • selector1._domainkey → selector1-mptwork-com._domainkey.mptwork.onmicrosoft.com
     • selector2._domainkey → selector2-mptwork-com._domainkey.mptwork.onmicrosoft.com

DMARC: add a TXT record:

Add the service records below at your DNS host. If Microsoft is your DNS provider or you choose "let Microsoft set up records," most are added automatically; otherwise add them manually:

Microsoft shows a TXT verification record. At your DNS host (where mptwork.com is registered), add it:

Part 3 — Administrative roles and emergency access

1. In the Microsoft Entra admin center (https://entra.microsoft.com) → Roles & admins, assign least-privilege roles (e.g., Exchange Administrator, Helpdesk Administrator) rather than Global Administrator.
2. Create two break-glass Global Admin accounts and keep them on the initial domain so they survive any mptwork.com DNS issue:
   • bg-admin1@mptwork.onmicrosoft.com
   • bg-admin2@mptwork.onmicrosoft.com Use long unique passwords, store them offline, and exclude them from Conditional Access (Part 7).
3. Keep standing Global Admins under five; with Entra ID P2 enable Privileged Identity Management for just-in-time elevation.

Part 4 — Users, groups, and licenses

1. Create a user: admin center → Users → Active users → Add a user:
   • Display name: Jane Smith
   • Username: jsmith@mptwork.com
   • Assign a license (or leave to group-based licensing below).
   • For bulk creation, use Add multiple users with a CSV.
2. Create groups: admin center → Teams & groups → Active teams & groups → Add a group:
   • Security group Licensing-BizPremium (for license assignment)
   • Microsoft 365 group All-Staff@mptwork.com (for collaboration/distribution)
3. Group-based licensing: Entra admin center → Billing/Licenses → select Microsoft 365 Business Premium → Assign → add the Licensing-BizPremium group. Membership now grants/revokes licenses automatically.

Joiner / mover / leaver procedure:

Part 5 — Configure email (Exchange Online)

1. Open the Exchange admin center (https://admin.exchange.microsoft.com).
2. Confirm mptwork.com is an accepted domain and that mail flows (send a test to/from an external address).
3. Create a shared mailbox for general contact: Recipients → Mailboxes → Add a shared mailbox → info@mptwork.com, then grant team members access. Shared mailboxes don't need a license under 50 GB.
4. Create distribution lists / room mailboxes as needed and verify SPF/DKIM/DMARC are passing (use a mail-tester or message header analysis).

Part 6 — SharePoint, OneDrive, and Teams

1. SharePoint admin center (linked from the M365 admin center): set organization external sharing to the least-permissive level your business needs (e.g., "New and existing guests" with an allow-list, or "Existing guests only"), and set default OneDrive storage.
2. Teams admin center (https://admin.teams.microsoft.com): set org-wide messaging, meeting, and guest/external access policies consistent with the SharePoint sharing posture; decide who may create teams (governance).
3. Provision the initial sites/teams (e.g., a Company communication site and per-department teams).

Part 7 — Security baseline

1. Enforce MFA: Entra admin center → Protection → Conditional Access → create a policy requiring MFA for all users (exclude the two bg-admin* accounts). For the smallest tenants, security defaults is the simpler option.
2. Add a policy to block legacy authentication.
3. After devices are enrolled (companion SOP), add a Conditional Access policy to require a compliant device for access to Microsoft 365.
4. Enable self-service password reset (Entra → Protection → Password reset).
5. Open the Defender portal (https://security.microsoft.com) and work the Microsoft Secure Score recommendations; track it as your security KPI.
6. Logging: use Entra audit and sign-in logs plus Defender XDR; forward to Microsoft Sentinel or a third-party SIEM for retention.
7. Backup: Microsoft 365 has retention but no full backup by default — adopt Microsoft 365 Backup (native, consumption-based) or a third-party backup (Veeam, Druva, AvePoint) for Exchange/SharePoint/OneDrive/Teams.
8. Device management (Intune enrollment, compliance, Defender endpoint protection) is in the companion SOP.

Part 8 — Ongoing management

Admin centers

Appendix — Complete DNS record set for mptwork.com

Caveat: the domain-verification token and the exact MX host are shown in your admin center — copy them from there. Microsoft re-packages plans, features, and pricing frequently, so verify current details before committing.