Microsoft 365 Tenant Manager

The agent generates production-ready PowerShell scripts for M365 tenant setup, bulk user provisioning, Conditional Access policies, security audits, and license management. It automates user lifecycle operations (onboarding, offboarding), recommends license SKUs by role, and produces 7-category security audit reports via Microsoft Graph.

Quick Start

Generate Security Audit Script

python scripts/powershell_generator.py --action audit --output audit_script.ps1

Create Bulk User Provisioning Script

python scripts/user_management.py --action provision --csv users.csv --license E3

Configure Conditional Access Policy

python scripts/powershell_generator.py --action conditional-access --require-mfa --include-admins

Tools

powershell_generator.py

Generates ready-to-use PowerShell scripts for Microsoft 365 administration.

Usage:

# Generate security audit script
python scripts/powershell_generator.py --action audit

# Generate Conditional Access policy script
python scripts/powershell_generator.py --action conditional-access \
  --policy-name "Require MFA for Admins" \
  --require-mfa \
  --include-users "All"

# Generate bulk license assignment script
python scripts/powershell_generator.py --action license \
  --csv users.csv \
  --sku "ENTERPRISEPACK"

Parameters:

--action

audit

conditional-access

license

users

--policy-name

--require-mfa

--include-users

All

--csv

--sku

--output

Output: Complete PowerShell scripts with error handling, logging, and best practices.

user_management.py

Automates user lifecycle operations and bulk provisioning.

Usage:

# Provision users from CSV
python scripts/user_management.py --action provision --csv new_users.csv

# Offboard user securely
python scripts/user_management.py --action offboard --user john.doe@company.com

# Generate inactive users report
python scripts/user_management.py --action report-inactive --days 90

Parameters:

--action

provision

offboard

report-inactive

sync

--csv

--user

--days

--license

tenant_setup.py

Initial tenant configuration and service provisioning automation.

Usage:

# Generate tenant setup checklist
python scripts/tenant_setup.py --action checklist --company "Acme Inc" --users 50

# Generate DNS records configuration
python scripts/tenant_setup.py --action dns --domain acme.com

# Generate security baseline script
python scripts/tenant_setup.py --action security-baseline

Workflows

Workflow 1: New Tenant Setup

Step 1: Generate Setup Checklist

python scripts/tenant_setup.py --action checklist --company "Company Name" --users 100

Step 2: Configure DNS Records

python scripts/tenant_setup.py --action dns --domain company.com

Step 3: Apply Security Baseline

python scripts/powershell_generator.py --action audit > initial_audit.ps1

Step 4: Provision Users

python scripts/user_management.py --action provision --csv employees.csv --license E3

Workflow 2: Security Hardening

Step 1: Run Security Audit

python scripts/powershell_generator.py --action audit --output security_audit.ps1

Step 2: Create MFA Policy

python scripts/powershell_generator.py --action conditional-access \
  --policy-name "Require MFA All Users" \
  --require-mfa \
  --include-users "All"

Step 3: Review Results

Execute generated scripts and review CSV reports in output directory.

Workflow 3: User Offboarding

Step 1: Generate Offboarding Script

python scripts/user_management.py --action offboard --user departing.user@company.com

Step 2: Execute Script with -WhatIf

.\offboard_user.ps1 -WhatIf

Step 3: Execute for Real

.\offboard_user.ps1 -Confirm:$false

Best Practices

Tenant Setup

1. Enable MFA before adding users
2. Configure named locations for Conditional Access
3. Use separate admin accounts with PIM
4. Verify custom domains before bulk user creation
5. Apply Microsoft Secure Score recommendations

Security Operations

1. Start Conditional Access policies in report-only mode
2. Use

   -WhatIf

   parameter before executing scripts
3. Never hardcode credentials in scripts
4. Enable audit logging for all operations
5. Regular quarterly security reviews

PowerShell Automation

1. Prefer Microsoft Graph over legacy MSOnline modules
2. Include try/catch blocks for error handling
3. Implement logging for audit trails
4. Use Azure Key Vault for credential management
5. Test in non-production tenant first

Reference Guides

When to Use Each Reference

references/powershell-templates.md

• Ready-to-use script templates
• Conditional Access policy examples
• Bulk user provisioning scripts
• Security audit scripts

references/security-policies.md

• Conditional Access configuration
• MFA enforcement strategies
• DLP and retention policies
• Security baseline settings

references/troubleshooting.md

• Common error resolutions
• PowerShell module issues
• Permission troubleshooting
• DNS propagation problems

Limitations

Required PowerShell Modules

Install-Module Microsoft.Graph -Scope CurrentUser
Install-Module ExchangeOnlineManagement -Scope CurrentUser
Install-Module MicrosoftTeams -Scope CurrentUser

Required Permissions

• Global Administrator - Full tenant setup
• User Administrator - User management
• Security Administrator - Security policies
• Exchange Administrator - Mailbox management

Anti-Patterns

• Using admin accounts for daily work -- Global Admin accounts should use PIM (Privileged Identity Management) with JIT activation; use separate accounts for daily tasks
• Skipping report-only mode -- deploying Conditional Access policies directly to enforcement blocks legitimate users; always validate in report-only mode first
• Hardcoding credentials in scripts -- PowerShell scripts with embedded passwords are security incidents waiting to happen; use Azure Key Vault or environment variables
• Using legacy MSOnline module -- MSOnline is deprecated; all new scripts should use Microsoft Graph (

  Connect-MgGraph

  )
• No break-glass account -- excluding zero accounts from CA policies means a misconfiguration can lock out all admins; maintain at least one excluded emergency access account
• Bulk operations without -WhatIf -- running bulk user creation or license assignment without dry-run risks mass misconfiguration; always test with

  -WhatIf

  first

Troubleshooting

Connect-MgGraph

Directory.ReadWrite.All

User.ReadWrite.All

Policy.ReadWrite.ConditionalAccess

UserPrincipalName

UserPrincipalName

Get-MgSubscribedSku -All

SkuPartNumber

PrepaidUnits.Enabled - ConsumedUnits > 0

enabledForReportingButNotEnforced

enabled

Connect-ExchangeOnline

Get-Mailbox -Identity user@domain.com

-all

nslookup -type=MX domain.com

-all

Set-AdminAuditLogConfig -UnifiedAuditLogIngestionEnabled $true

Connect-MgGraph -Scopes "AuditLog.Read.All"

Success Criteria

• 100% of provisioned users have correct license SKU assigned matching their role and department
• Zero orphaned accounts: every disabled user has licenses removed, mailbox converted to shared, and sessions revoked within 24 hours of offboarding
• MFA enforcement covers 100% of enabled user accounts, verified by security audit script output showing zero users without MFA
• DNS records pass validation for all five service types (MX, SPF, DKIM, autodiscover, device registration) with zero propagation errors
• Conditional Access policies achieve report-only validation with less than 1% false-positive block rate before enforcement
• License utilization stays above 90% across all SKUs, with unused licenses identified and reclaimed quarterly
• Security audit generates complete CSV reports for all 7 audit categories (MFA, admin roles, inactive users, guests, licenses, mailbox delegations, Conditional Access) with zero script errors

Scope & Limitations

What This Skill Covers

• Tenant lifecycle management -- initial setup, domain verification, DNS configuration, security baseline, and service provisioning for Exchange Online, SharePoint, Teams, and OneDrive
• User lifecycle automation -- bulk provisioning from CSV, license assignment by role/department, group membership recommendations, secure offboarding with mailbox preservation
• Security and compliance -- Conditional Access policy generation, MFA enforcement, comprehensive 7-category security audits, and audit log enablement
• PowerShell script generation -- production-ready scripts with error handling, logging,

  -WhatIf

  support, and Microsoft Graph best practices

What This Skill Does NOT Cover

• Hybrid identity (AD Connect) -- on-premises Active Directory synchronization and pass-through authentication require the

  senior-devops

  skill and Microsoft AD Connect tooling
• Intune device management -- endpoint compliance policies, app deployment, and mobile device management are outside scope; see

  senior-secops

  for device security posture
• Power Platform administration -- Power Apps, Power Automate, and Power BI tenant-level governance fall under separate platform administration
• Third-party SSO and SCIM provisioning -- integration with non-Microsoft identity providers (Okta, Ping, Auth0) requires dedicated identity engineering

Integration Points

senior-secops

senior-devops

senior-architect

code-reviewer

aws-solution-architect

senior-security

Tool Reference

powershell_generator.py

Purpose: Generates production-ready PowerShell scripts for Microsoft 365 administration including security audits, Conditional Access policies, and bulk license assignment.

Module:

PowerShellScriptGenerator

Initialization:

from powershell_generator import PowerShellScriptGenerator

generator = PowerShellScriptGenerator(tenant_domain="company.com")

Methods:

generate_security_audit_script()

Generates a comprehensive 7-category security audit PowerShell script that checks MFA status, admin role assignments, inactive users, guest users, license usage, mailbox delegations, and Conditional Access policies.

tenant_domain

Example:

generator = PowerShellScriptGenerator("company.com")
script = generator.generate_security_audit_script()
print(script)  # Complete PowerShell script with Connect-MgGraph, 7 audit checks, CSV export

Output: PowerShell script string that produces CSV reports in a timestamped

SecurityAudit_

MFA_Status.csv

Admin_Roles.csv

Inactive_Users.csv

Guest_Users.csv

License_Usage.csv

Mailbox_Delegations.csv

ConditionalAccess_Policies.csv

generate_conditional_access_policy_script(policy_config)

Generates a PowerShell script to create a Conditional Access policy in report-only mode.

policy_config

Dict[str, Any]

policy_config["name"]

str

"MFA Policy"

policy_config["require_mfa"]

bool

True

policy_config["include_users"]

str

"All"

policy_config["exclude_users"]

List[str]

[]

Example:

script = generator.generate_conditional_access_policy_script({
    "name": "Require MFA for Admins",
    "require_mfa": True,
    "include_users": "All",
    "exclude_users": ["breakglass@company.com"]
})

Output: PowerShell script string that creates a Conditional Access policy via

New-MgIdentityConditionalAccessPolicy

enabledForReportingButNotEnforced

generate_bulk_license_assignment_script(users_csv_path, license_sku)

Generates a PowerShell script for assigning a license SKU to users listed in a CSV file.

users_csv_path

str

UserPrincipalName

license_sku

str

"ENTERPRISEPACK"

Example:

script = generator.generate_bulk_license_assignment_script("users.csv", "ENTERPRISEPACK")

Output: PowerShell script string that imports the CSV, checks for existing licenses, assigns the specified SKU, and exports results to

LicenseAssignment_Results_<timestamp>.csv

Status

Message

user_management.py

Purpose: Manages user lifecycle operations including bulk provisioning, secure offboarding, license recommendations, group membership, and data validation.

Module:

UserLifecycleManager

Initialization:

from user_management import UserLifecycleManager

manager = UserLifecycleManager(domain="company.com")

Methods:

generate_user_creation_script(users)

Generates a PowerShell script for bulk user provisioning with license assignment.

users

List[Dict[str, Any]]

users[].username

str

users[].display_name

str

users[].first_name

str

users[].last_name

str

users[].job_title

str

users[].department

str

users[].license_sku

str

"Microsoft_365_Business_Standard"

Example:

script = manager.generate_user_creation_script([
    {"username": "jdoe", "display_name": "Jane Doe", "first_name": "Jane",
     "last_name": "Doe", "job_title": "Engineer", "department": "Engineering",
     "license_sku": "ENTERPRISEPACK"}
])

Output: PowerShell script string that creates users via

New-MgUser

UserCreation_Results_<timestamp>.csv

generate_user_offboarding_script(user_email)

Generates a comprehensive 11-step secure offboarding PowerShell script.

user_email

str

Example:

script = manager.generate_user_offboarding_script("john.doe@company.com")

Output: PowerShell script string that disables sign-in, revokes sessions, removes group memberships, removes devices, converts mailbox to shared, sets auto-reply, removes licenses, hides from GAL, and exports an offboarding report CSV.

generate_license_assignment_recommendations(user_role, department)

Returns license recommendation based on role and department matching.

user_role

str

department

str

Example:

rec = manager.generate_license_assignment_recommendations("Security Analyst", "IT")
# Returns: {"recommended_license": "Microsoft 365 E5", "justification": "...", "features_needed": [...], "monthly_cost": 57.00}

Output: Dictionary with

recommended_license

justification

features_needed

monthly_cost

generate_group_membership_recommendations(user)

Recommends security and distribution groups based on user attributes.

user

Dict[str, Any]

department

location

job_title

needs_sharepoint_access

needs_project_access

Example:

groups = manager.generate_group_membership_recommendations({
    "department": "Engineering", "location": "NYC", "job_title": "Director of Engineering"
})
# Returns: ["DL-Engineering", "SG-Engineering", "SG-Location-Nyc", "SG-Management"]

Output: List of recommended group name strings using naming conventions

DL-

SG-

validate_user_data(user_data)

Validates user data before provisioning, checking required fields, username format, and email format.

user_data

Dict[str, Any]

first_name

last_name

username

email

display_name

license_sku

Example:

result = manager.validate_user_data({"first_name": "Jane", "last_name": "Doe", "username": "jdoe"})
# Returns: {"is_valid": True, "errors": [], "warnings": ["Display name not provided, will use: Jane Doe", ...]}

Output: Dictionary with

is_valid

errors

warnings

tenant_setup.py

Purpose: Manages initial Microsoft 365 tenant configuration including setup checklists, DNS record generation, PowerShell setup scripts, and license distribution recommendations.

Module:

TenantSetupManager

Initialization:

from tenant_setup import TenantSetupManager

manager = TenantSetupManager(tenant_config={
    "company_name": "Acme Inc",
    "domain_name": "acme.com",
    "user_count": 50,
    "industry": "technology",
    "compliance_requirements": ["GDPR"],  # optional: "GDPR", "HIPAA"
    "licenses": {}
})

company_name

str

domain_name

str

user_count

int

industry

str

"general"

compliance_requirements

List[str]

"GDPR"

"HIPAA"

licenses

Dict

Methods:

generate_setup_checklist()

Generates a phased tenant setup checklist (4-5 phases depending on compliance requirements).

Example:

checklist = manager.generate_setup_checklist()
# Returns list of phase dicts, each with "phase", "name", "priority", "tasks"

Output: List of dictionaries. Each phase contains

phase

name

priority

"critical"

"high"

tasks

task

details

estimated_time

generate_dns_records()

Generates all required DNS records for Microsoft 365 services.

domain_name

Example:

records = manager.generate_dns_records()
# Keys: "mx_records", "txt_records", "cname_records", "srv_records"

Output: Dictionary with four keys, each containing a list of record dictionaries with

type

name

value

ttl

purpose

priority

port

weight

generate_powershell_setup_script()

Generates a complete PowerShell script for initial tenant configuration covering Graph, Exchange Online, SharePoint, and Teams.

Example:

script = manager.generate_powershell_setup_script()
print(script)  # PowerShell script connecting to Graph, Exchange, Teams with 7 setup steps

Output: PowerShell script string that connects to Microsoft Graph, Exchange Online, and Teams; configures organization settings, security defaults, audit logging, Exchange policies, and Teams messaging policies.

get_license_recommendations()

Calculates license distribution recommendations and cost estimates based on user count and compliance requirements.

user_count

compliance_requirements

Example:

recs = manager.get_license_recommendations()
# Returns: {"recommendations": {...}, "suggested_distribution": {"E5": 5, "E3": 10, ...},
#           "estimated_monthly_cost": 1234.50, "estimated_annual_cost": 14814.00}

Output: Dictionary with

recommendations

suggested_distribution

estimated_monthly_cost

estimated_annual_cost