5 M365 Admin Tasks You're Probably Doing Without Documentation

Marcus Reid — Sat, 10 Oct 2026 20:52:29 +0000

I inherited an M365 tenant with zero documentation. Here are the five procedures — offboarding order, license audits, contractor guest accounts, Temporary Access Pass, and phishing triage — that made the biggest difference once I wrote them down.

5 M365 Admin Tasks You're Probably Doing Without Documentation

I started my current gig and inherited an M365 tenant with exactly zero documentation. Not "outdated docs." Zero. Every password reset, every onboarding, every offboarding was just in people's heads.

The breaking point was my coworker going on vacation for a week. Two new hires started that Monday. I had a sticky note that said "licenses in the spreadsheet" and there was no spreadsheet.

So I started writing everything down. Not fancy. Just "when X happens, do Y" in the order you actually do it. Here's the stuff that bit us hardest before it was written down.

Offboarding

Everyone thinks it's "disable the account." It's not. The order matters and I learned this the embarrassing way: we offboarded someone, blocked their sign-in, and their phone stayed logged into Teams for over an hour because nobody revoked the active sessions first. Now the doc says: revoke sessions, reset password, block sign-in, THEN strip groups, pull them from the address list, convert the mailbox to shared, drop the license, give the manager access. In that order. Every time.

Licenses

We had people on Business Standard who only ever opened Outlook on the web. That's double the cost of Basic for nothing. I went through the whole tenant one afternoon and the savings were stupid. My rule now: email only gets Basic. If you need the desktop apps you get Standard. That's it. Visio and Project people get add-ons. Nobody gets Standard "just in case" anymore.

Contractors

We used to spin up full accounts for three-week contractors. Guest accounts exist. They're free. Use them. Full account only if they actually need licensed apps, and put an expiration date on it so you're not paying for someone who left in March.

The Temporary Access Pass thing

I didn't know about this for way too long. You can issue a TAP before someone's start date so their laptop and account are ready when they walk in day one. Microsoft even has a built-in onboarding workflow for it. Before I found this, every first morning was chaos.

Phishing reports

The only two questions that matter when someone reports one: did you click anything, and did you type your password anywhere. That's the difference between "delete the email" and "lock the account, reset the password, kill the sessions, make them re-register MFA, block the sender." Ask those two things first and you'll know which one you're dealing with in ten seconds.

That's five of the ten I wrote up. The full set (password resets, MFA headaches, shared mailboxes, distribution lists, OneDrive recovery, Teams issues, license audits) is packaged as a template pack if you want the finished versions:

IT SOP Template Pack — $19

But honestly the five above are the ones that would've saved me the most grief. Start there.

DEV Community: Marcus Reid

5 M365 Admin Tasks You're Probably Doing Without Documentation