Before we start: whose course this is
This course is independent of Microsoft. Microsoft does not write, endorse or review it, and it does not copy Microsoft's documentation. You will see Microsoft product names because they are the tools you support every day.
That independence brings a duty. Microsoft changes Microsoft 365 all the time: admin screens move, roles get new permissions, licence bundles get repackaged, and features ship as preview before they are generally available. So the rule for every lesson is this: check each screen, role and limit against Microsoft's current documentation (learn.microsoft.com), write down the date you checked it, and mark anything in preview or unconfirmed. A support note that says "Settings > X > Y" with no date can go out of date without anyone noticing.
Here is a real example from the licensing world. In 2024 Microsoft started selling some Enterprise suites both with and without Teams. A support engineer who assumed "E3 always includes Teams" would have chased the wrong fault for weeks. The fix is to look at what the licence actually contains, which you'll do below.
The analogy: an office building
When a user rings and says "Outlook is broken", they're describing the front door. Behind it there are four layers, and you can picture them as an office building:
- Tenant: the building itself. It is your organisation's own dedicated instance of Microsoft 365, with its data stored in a default region. When an organisation signs up, it gets a starter domain like
contoso.onmicrosoft.com. - Entra ID identity (user account): the staff pass. Microsoft Entra ID is the directory that was called Azure Active Directory until Microsoft renamed it in 2023. It proves who the person is when they sign in. No pass, no entry.
- Licence: the pass's access rights. A licence (for example Office 365 E3, system name
ENTERPRISEPACK) is a bundle of service plans, and each service plan switches on one service for that user. - Workload services: the rooms. These are Exchange Online, SharePoint Online, OneDrive, Teams and Microsoft 365 Apps, each run by Microsoft.
A user needs all three of the last layers lined up: a working identity, a licence whose service plan is switched on, and a healthy workload.
Walkthrough: the one-page map
Sketch this on paper or in a ticket template. This is the map you'll use for the rest of the course.
WHAT THE USER SEES WORKLOAD SERVICE BEHIND IT SERVICE PLAN (example name)
----------------------- ------------------------------ ---------------------------
Outlook (mail/calendar) → Exchange Online (the mailbox) → EXCHANGE_S_ENTERPRISE
Teams chat & meetings → Microsoft Teams → TEAMS1 (only if the SKU has it)
Teams channel files → SharePoint Online (team site) → SHAREPOINTENTERPRISE
Files sent in a chat → the sender's OneDrive → (OneDrive rides on SharePoint)
OneDrive → OneDrive (built on SharePoint) → SHAREPOINTENTERPRISE
SharePoint sites → SharePoint Online → SHAREPOINTENTERPRISE
Word/Excel/PowerPoint → Microsoft 365 Apps (activation) → OFFICESUBSCRIPTION
EVERY ROW SITS ON: Entra ID sign-in → inside ONE tenant
Two rows catch people out. Teams is a front end over other services: a file shared in a channel lives in SharePoint, and a file shared in a one-to-one chat lives in the sender's OneDrive. A "Teams can't open my file" ticket is often really a SharePoint or OneDrive permissions problem.
Gotcha: names in the console ("Exchange Online (Plan 2)") and system names (
EXCHANGE_S_ENTERPRISE) are not the same thing. Microsoft publishes a "Product names and service plan identifiers for licensing" reference that maps one to the other. Check it there and don't rely on memory.
Walkthrough: seeing the layers for one user, read-only
You can see the licence layer without changing anything. This uses the Microsoft Graph PowerShell SDK. The old MSOnline and AzureAD modules were retired in 2025, so ignore any older guide that uses Get-MsolUser.
# Read-only scope. LicenseAssignment.Read.All is the least-privileged
# delegated permission Microsoft lists for reading a user's licence details.
Connect-MgGraph -Scopes "LicenseAssignment.Read.All"
# Which licences does this user have, and which service plans are switched on?
# Covers licences assigned directly AND through a licensed group.
Get-MgUserLicenseDetail -UserId "sam.patel@contoso.com" |
Select-Object -ExpandProperty ServicePlans |
Select-Object ServicePlanName, ProvisioningStatus
A realistic output:
ServicePlanName ProvisioningStatus
--------------- ------------------
EXCHANGE_S_ENTERPRISE Success # mailbox should exist
SHAREPOINTENTERPRISE Success # SharePoint + OneDrive available
OFFICESUBSCRIPTION Success # desktop apps can activate
TEAMS1 Disabled # <- why Teams says "no licence"
Read it layer by layer. The identity works, because the user exists and has a licence. The licence covers mail, files and apps. But the Teams plan is Disabled, so the Teams workload won't serve this user. PendingProvisioning would mean the plan is still being set up, which is common for a few minutes after a licence is assigned. Only Success means the plan is ready to use.
Best practice: always start with read-only checks like this. You learn what's wrong before you touch anything, and your ticket note gets real evidence.
Walkthrough: your verification log
Keep a small log, in a wiki page or the top of your runbook, and add an entry every time you rely on a screen or role:
ITEM CHECKED SOURCE (Microsoft doc URL) CHECKED STATUS
----------------------------------- ---------------------------------- ----------- -------------
Admin centre URL admin.microsoft.com learn.microsoft.com/... 2026-11-02 GA
Get-MgUserLicenseDetail scope learn.microsoft.com/graph/api/... 2026-11-02 GA
"New" users page layout (screen seen in tenant only) 2026-11-02 PREVIEW
Teams included in our E3 SKU? our tenant's service plans 2026-11-02 CONFIRMED-TENANT
Some setting from a blog post none found on Microsoft docs 2026-11-02 UNCONFIRMED
Use plain status words: GA (generally available), PREVIEW (Microsoft labels it preview, so it may change or disappear), UNCONFIRMED (you couldn't find it in current documentation). Recheck anything older than a few months before you put it in a customer-facing note.
Trade-off: logging takes about a minute per item. Skipping it costs you an afternoon the first time a menu moves and nobody knows which instructions are stale.
Key takeaways
- Every app a user sees sits on a workload service, which is reached through an Entra ID identity, switched on by a licence's service plans, all inside one tenant.
- Teams is a front end: channel files live in SharePoint, chat files in the sender's OneDrive.
- A licence is a bundle of service plans. Check which plans are actually switched on rather than assuming what a SKU name includes.
- Use read-only checks first, with Microsoft Graph PowerShell (not the retired MSOnline/AzureAD modules).
- This course is independent of Microsoft. Date every screen and role you check against Microsoft's current documentation, and label it GA, PREVIEW or UNCONFIRMED.