4.2Microsoft 365 administration (users, licences)
The essentials in 30 seconds
- Microsoft 365 is administered from a web admin centre: users, licences, groups and service settings, all centralised, with no on-site server.
- With no licence assigned, there is no access to the applications; on departure, you block and archive rather than delete in a hurry.
- Each licence costs every month: tracking licences (inactive accounts, reassigning leavers, plan by profile) is both a security AND a budget issue.
Running mini-case — Sofiane handles a joiner and a leaver at M365
Sofiane, a systems administrator in a distribution SME in Algiers, opens the Microsoft 365 admin centre: a salesperson joins and an assistant leaves the company. For the joiner, he creates the user, assigns a licence suited to the profile (not the most expensive plan by default), adds them to the right groups and grants access. For the leaver, he does not delete the account: he blocks sign-in, converts the mailbox into a shared mailbox so nothing is lost, then recovers the licence — which costs money every month — to reassign it. He notes the reflex: every lifecycle step protects access and keeps the budget under control.
Standalone case for this section: it returns in the course, the diagram, the script and the 48h challenge of section 4.2.
1. The admin centre
Microsoft 365 is administered from a web portal, the admin centre. There you manage users, licences (who is entitled to which applications), groups and service settings (Exchange, SharePoint, Teams). Everything is centralised and accessible with no on-site server: for Sofiane, it is a career shift, you administer services, not machines.
2. The lifecycle of a user
An account follows a lifecycle: create the user, assign a licence (otherwise no access to the applications), add them to groups and grant the right access. On departure, you do not delete in a hurry: you block sign-in, convert or archive the mailbox, recover the licence (it costs money) and manage the data.
3. Licences, a budget issue
Each licence has a monthly cost. Good administration tracks licences: no unused active accounts, reassigning leavers' licences, choosing the plan suited to each profile (a full licence for a manager, a lighter one for a field role). Poorly managed, licences become a silent budget leak.
🔎 Concrete example — 🔎 Concrete example — An employee leaves the company
Bad and good handling of a departure, as Sofiane compares them:
X Delete the account straight away
-> emails and files lost, licence sometimes not recovered
OK Block sign-in -> archive/convert the mailbox
-> recover the licence -> transfer the data
Reading : blocking rather than deleting preserves the data.
Lesson : recovering the licence avoids paying for an unused account.Reading: blocking rather than deleting preserves the data and cuts access immediately.
Lesson: recovering the licence avoids paying every month for an account that has become useless.
Section vocabulary
- M365 admin centre
- Web portal for managing users, licences, groups and services.
Simple example: Sofiane creates an account there and assigns a licence.
What it is not: a local console on a server at the SME.
Reflex: administer M365 → the admin centre.
- Licence
- Paid right to access a set of M365 applications.
Simple example: Sofiane assigns a licence suited to the new joiner's profile.
What it is not: an account created but with no right to access the applications.
Reflex: access to the apps → licence assigned.
- Lifecycle
- The stages of an account: creation, use, changes, departure.
Simple example: Sofiane follows every step, from creation to blocking.
What it is not: a one-off creation with the account never reviewed again.
Reflex: from creation to departure → lifecycle.
- Sign-in block
- Disabling an account's access without deleting it.
Simple example: Sofiane blocks the leaver's account before archiving their mailbox.
What it is not: an immediate permanent deletion.
Reflex: cut access without destroying → block.
- Licence reassignment
- Taking a leaver's licence for another user.
Simple example: Sofiane recovers the licence and gives it to the new joiner.
What it is not: a licence still being paid on an inactive account.
Reflex: spare licence → reassign.
In practice — In practice — Write a joiner/leaver procedure
- Write the joiner steps: create, assign a licence, groups, access, like Sofiane.
- Write the leaver steps: block, archive the mailbox, recover the licence, manage the data.
- State who checks unused licences, and how often.
- Add a control: no active account without a real user.
Step-by-step script — handling a joiner and a leaver like Sofiane (5 min)
1) Open the M365 admin centre. 2) Joiner: create the user, assign a suitable licence, add them to the groups and grant access. 3) Leaver: block sign-in (do not delete), convert or archive the mailbox, recover the licence. 4) Reassign the leaver's licence to the new joiner if possible. 5) Note the date of a regular check of unused licences.
Remember the golden rule for departures: block and archive first, recover the licence next, delete only as a last resort.
Copy-paste template — my M365 joiner / leaver procedure
JOINER : create the user -> assign a suitable licence
-> add to groups -> grant access
LEAVER : block sign-in (do not delete)
-> archive/convert the mailbox -> recover the licence
CONTROL: no active account without a real user
-> audit unused licences regularly
Budget : a plan suited to each profile (not the most expensive by default).A new joiner
Sofiane creates the account, assigns a licence for the right profile and adds them to the groups.
A well-handled departure
Sofiane blocks the account, archives the mailbox and recovers the licence instead of deleting.
A licence to reassign
The leaver's licence goes back to a new user: no euro wasted.
A licence audit
Sofiane spots inactive accounts paying for a licence while producing nothing.
✓ Best practices
- Always assign a licence suited to the profile.
- On departure: block, archive, recover the licence.
- Regularly audit unused licences.
✗ Common pitfalls
- Deleting an account in a hurry (data loss).
- Leaving paid licences on inactive accounts.
- Giving everyone the most expensive plan "by default".
Key takeaways
- M365 is managed from a centralised admin centre.
- With no licence assigned, there is no access to the applications.
- On departure, you block and archive before deleting.
- Tracking licences is both a security AND a budget issue.
48h challenge — apply it tomorrow
Like Sofiane, write the joiner and leaver procedure for a Microsoft 365 user: creation, licence, groups, access on one side; blocking, archiving, licence recovery on the other. Add a check for unused licences and its frequency.
- I can administer users and licences from the admin centre.
- I know the right move on departure: block, archive, recover the licence.
- I link licence management to a budget issue.
Frequently asked questions
Why block an account rather than delete it when an employee leaves?
Because deleting destroys emails and files and can complicate recovering the licence. Blocking cuts access immediately while leaving time to archive the mailbox and transfer the data cleanly.
How do you stop licences becoming a budget leak?
By auditing regularly: spotting inactive accounts, recovering leavers' licences, adjusting the plan to each profile. A forgotten licence is paid every month for nothing.
When an employee leaves, what is the right first move on their Microsoft 365 account?