Every user is an Entra ID object
In Level 1 you saw that Microsoft 365 is a set of services sitting on one shared directory. That directory is Microsoft Entra ID, and your organisation's copy of it is the tenant. When someone calls in with "Sarah can't get into Teams", there is no separate "Teams user" to look at. Sarah is a single user object in Entra ID, and Exchange, Teams, SharePoint and the rest all read that object.
Think of the tenant as a building with one reception desk. Each user object is the visitor badge. It carries:
| Attribute | What it is | Why support cares |
|---|---|---|
| User principal name (UPN) | The sign-in name, e.g. sarah.khan@contoso.co.uk |
It's what the user types. It can be changed, so it's a poor fixed reference. |
| Object ID | A GUID such as 3f2a9c1e-… |
It never changes for that object. Put it in tickets and escalations. |
| Domain | The part of the UPN after @ |
It must be a verified domain in the tenant. |
| Usage location | A two-letter country code, e.g. GB |
Many licences can't be assigned until it is set. |
| On-premises sync enabled | Shows whether the account comes from on-premises Active Directory | Tells you where any change has to be made. |
The tenant ID is also a GUID. It identifies the whole organisation, not one user, and vendors often ask for it when you escalate.
Walkthrough 1: read a user in the Entra admin centre
Everything in this lesson only reads data. A read-only role such as Global Reader is enough. Level 5 covers roles properly.
- Go to
https://entra.microsoft.comand browse to Entra ID > Users. - Add the On-premises sync enabled column if it isn't showing. You can now scan the whole list and see which accounts are synced.
- Open the user. The Overview shows the UPN and the Object ID. On the Properties tab, the Settings section holds the usage location and the On-premises section holds the sync details.
Gotcha: if every identity field on the user is greyed out, you haven't hit a permissions problem. The account is synced, and its source of authority is Windows Server Active Directory.
Walkthrough 2: the same facts from PowerShell
This uses the Microsoft Graph PowerShell SDK. The older MSOnline and AzureAD modules are retired, so don't build habits on them.
# Read-only scopes: you can look but not change anything
Connect-MgGraph -Scopes "User.Read.All","Organization.Read.All","Domain.Read.All"
# Get-MgUser returns only a few properties by default, so ask for the ones you need
Get-MgUser -UserId "sarah.khan@contoso.co.uk" `
-Property Id,UserPrincipalName,UsageLocation,OnPremisesSyncEnabled,OnPremisesDistinguishedName,OnPremisesLastSyncDateTime |
Format-List Id,UserPrincipalName,UsageLocation,OnPremisesSyncEnabled,OnPremisesDistinguishedName,OnPremisesLastSyncDateTime
Realistic output for a synced user:
Id : 3f2a9c1e-7b4d-4e0a-9a51-2c8d6f1e0b77
UserPrincipalName : sarah.khan@contoso.co.uk
UsageLocation : GB
OnPremisesSyncEnabled : True
OnPremisesDistinguishedName : CN=Sarah Khan,OU=Sales,DC=contoso,DC=local
OnPremisesLastSyncDateTime : 02/11/2026 08:41:12
How to read OnPremisesSyncEnabled:
- True means the account is synced from on-premises AD right now.
- Empty (null) means a cloud-only account. Either it was created in the cloud or it was converted to cloud management.
- False means it was synced once but no longer is. Treat that as a question to ask third line, not as a normal state.
To sweep for accounts that will block licensing:
# Users with no usage location set
Get-MgUser -All -Property DisplayName,UserPrincipalName,UsageLocation |
Where-Object { -not $_.UsageLocation } | Select-Object DisplayName,UserPrincipalName
Cloud-only vs synced: where the change must happen
This is the most useful thing in the lesson. With a synced account, on-premises AD owns the identity. Edit the name, job title, department or contact details in the cloud and either the edit is refused or the next sync cycle overwrites it. Make the change in Active Directory Users and Computers (or whatever your team uses for AD), then wait for the next sync cycle before checking Entra.
The exceptions are attributes that exist only in the cloud. Usage location, licences and membership of cloud-created groups can all be set in the cloud for a synced user. Microsoft documents a few synced attributes, such as UPN and Account Enabled, as editable in Entra ID for emergencies only. Don't do that as routine first line work. Change them on-premises.
For a cloud-only account, the Entra and Microsoft 365 admin centres are the source of truth, and you make changes there.
Trade-off seen in production: in a hybrid firm, "rename this user" can be a ten-second cloud edit or an AD change plus a wait. Check the sync flag before you promise the user a timescale.
Microsoft now also supports moving a synced user's source of authority to the cloud. After the move, OnPremisesSyncEnabled reads empty and the user can be edited in the cloud. That is an architecture decision for third line, not something to do from a ticket.
Walkthrough 3: the tenant ID and verified domains
Tenant ID: in the Entra admin centre, open Entra ID > Overview. The tenant ID and the primary domain are on the overview, and also under Properties.
Domains: in the Microsoft 365 admin centre (https://admin.microsoft.com), go to Settings > Domains. Every tenant has an initial *.onmicrosoft.com domain. Microsoft creates it, and it can't be removed. Custom domains like contoso.co.uk show up here once they are verified.
# Tenant ID and display name
Get-MgOrganization | Select-Object Id,DisplayName
# All domains, flagging the default and the initial onmicrosoft.com one
Get-MgDomain | Select-Object Id,IsVerified,IsDefault,IsInitial,AuthenticationType
Id IsVerified IsDefault IsInitial AuthenticationType
-- ---------- --------- --------- ------------------
contoso.co.uk True True False Managed
contosoltd.onmicrosoft.com True False True Managed
Best practice: start every escalation note with the tenant ID, the user's object ID and the sync status. Third line will ask for all three.
Screens and paths checked against Microsoft's documentation in November 2026. Admin portals change often, so recheck if a menu has moved.
Key takeaways
- A Microsoft 365 user is one Entra ID object. Identify it by its object ID, not its UPN.
- The UPN's domain must be a verified domain. Every tenant also keeps its initial
onmicrosoft.comdomain. - Usage location must be set before many licences can be assigned, and you can set it in the cloud even for synced users.
- On-premises sync enabled = Yes/True means you change identity details in on-premises AD and then wait for the next sync cycle.
- The tenant ID is on Entra ID > Overview. Domains are under Settings > Domains in the Microsoft 365 admin centre.