AB-900 lesson 1: tenant and licences
A Microsoft 365 tenant is the dedicated space an organisation receives when it signs up: one directory of identities in Microsoft Entra ID, one set of subscriptions and licences, and one instance of each service such as Exchange, SharePoint, Teams and OneDrive. Everything an admin does starts from two questions: who is this person in the directory, and which licence do they hold. A user without a licence for a service cannot use it, whatever the admin centers say.
What lives inside a tenant
The figure above shows the layers. Microsoft Entra ID holds the identities: users and groups. Licences are bought as subscriptions and then assigned to those identities. The workloads (Exchange for mail, SharePoint for sites, Teams for chat and meetings, OneDrive for personal files) are the services that licences switch on. The Microsoft 365 admin center sits on top as the general management console.
Two tenants never share data by default. A company that acquires another company has two tenants until a deliberate migration merges them.
Domains and organisation settings
Each tenant starts with an initial domain ending in onmicrosoft.com. Most organisations add their own domain name, for example a company website name, so that people sign in and receive mail at addresses that match the brand. Adding a domain means proving ownership by creating a DNS record, then choosing which services use it. Domain names and organisation-wide options live in the Microsoft 365 admin center, under Settings, in the domains page and in Org settings.
Org settings are tenant-wide switches: the organisation profile, release preferences, and per-service options for several Microsoft 365 services. They are different from per-user settings, which are changed on the user’s own page in Users.
How licences decide what a person can do
A licence is a bundle of service plans. Assigning a Microsoft 365 plan to a user turns on a set of services; the admin can switch individual services off inside the bundle. A few consequences matter for the exam:
- No Exchange Online service plan means no mailbox for that user.
- No Copilot licence means the Microsoft 365 Copilot experiences do not appear for that user, even if Copilot is available in the tenant.
- Removing a licence does not delete the account. Exchange Online data tied to the account is held for 30 days after a licence is removed, then deleted, while OneDrive files are not deleted just because the licence went away.
- A licence assigned wrongly is a common cause of a feature that is “missing” for one person only.
Licences can be assigned directly to a user, or to a group. With group-based licensing, membership drives the licence: add someone to the group and they receive it, remove them and it is taken back. Admins need at least the License Administrator or User Administrator role to assign licences.
Worked example: a 200-person company onboarding a sales team
A 200-person company hires 30 sales staff over the year. The admin wants them to have the standard Microsoft 365 plan and Teams, but not the premium add-on that only managers need. The admin creates a security group for sales staff and assigns the standard licence to that group in the Microsoft 365 admin center. New hires join the group as part of onboarding and the licence arrives automatically. Managers receive the add-on directly, because they are few. When a salesperson changes departments, group membership changes and the licence follows.
A hire reports that Teams works but they cannot open the mailbox. The admin opens the user in Users, Active users, and checks Licenses and apps: the mail service was switched off inside the licence. Switching it on fixes the issue. The reasoning chain is identity, licence, service plan, workload.
Easy to confuse
| Often mixed up | The difference |
|---|---|
| Security group vs distribution group | A security group can be used for permissions and licensing; a distribution group only delivers email |
| Org setting vs user setting | Org settings apply to the whole tenant; user settings apply to one account |
| Microsoft 365 admin center vs specialist admin centers | The first is the general console; Exchange, SharePoint, Teams, Entra and Purview have their own for deep settings |
| Admin role vs licence | A role gives rights to manage; a licence gives rights to use a service |
The admin centers at a glance
From the Microsoft 365 admin center, the navigation pane links to the specialist admin centers. Mailboxes and mail flow belong to Exchange. Sites and sharing belong to SharePoint. Teams policies belong to Teams. Identity, sign-in and application settings belong to Microsoft Entra. Labels, DLP, retention and audit belong to Microsoft Purview, and threat protection to Microsoft Defender. The centers visible to an admin depend on the plan and on that admin’s roles.
Key points
- A tenant is one organisation’s directory, subscriptions and service instances.
- Licences are assigned to users or groups and switch on specific service plans.
- Group-based licensing makes licences follow membership; only security-type groups can carry them.
- Domains and org settings are managed in the Microsoft 365 admin center under Settings.
- A feature missing for one user is usually a licence or service-plan question, not a tenant question.
Check yourself
Question 1. A 60-person company wants every new member of the finance team to receive the same Microsoft 365 licence automatically, without an admin visiting each account. What is the most suitable approach?
- A. Assign the licence to each new user on the Active users page
- B. Create a distribution group in the Exchange admin center and license it
- C. Assign the licence to a security group that contains the finance team
- D. Change an org setting so all users receive the licence
Show answer
Answer: C
Assigning the licence to a security group makes membership drive the licence, so new members receive it and leavers lose it. Assigning per user is the manual work to avoid. Distribution groups cannot carry licences. Org settings are tenant-wide switches and do not assign licences.
Want more questions like this? Full AB-900 practice tests →
Question 2. A user can chat in Teams but gets no mailbox, although colleagues on the same plan do. What should the admin check first?
- A. The user’s licence details, to see whether the Exchange Online service is enabled
- B. The domain verification record in DNS
- C. The user’s Teams meeting policy
- D. The organisation profile page
Show answer
Answer: A
The licence may have the Exchange Online service plan switched off for that user, which removes the mailbox while leaving other services working. Domain verification affects the whole tenant, not one user. A Teams policy cannot create or remove a mailbox. Org profile settings do not control per-user services.
Want more questions like this? Full AB-900 practice tests →
Question 3. Which statement best describes a Microsoft 365 tenant?
- A. A single SharePoint site collection used by one department
- B. A shared directory used by every customer of a region
- C. The mailbox that belongs to the first administrator
- D. An organisation’s own directory, subscriptions and service instances
Show answer
Answer: D
A tenant is one organisation’s dedicated space: its Entra directory, subscriptions and licences, and its instance of the workloads. It is not a single mailbox, a SharePoint site, or a shared pool with other companies, which by default never share data.
Want more questions like this? Full AB-900 practice tests →
This lesson opens domain one of the course, which carries 30 to 35% of the exam. The recap page Microsoft 365 core features explained condenses the whole domain, and the cheat sheet lists the admin centers side by side.