M365 Business Standard trial
Personal subdomain under nw7.nat-acc.ca
10 Lakeview Logistics users
Microsoft Entra ID
MS-102 aligned
Day 1
Trial signup & domain
Day 2
User creation & licences
Day 3
Groups & bulk operations
Day 4
Roles & admin centre tour
Day 5
Review & assessment
Week 1 is the foundation. Every lab from Week 2 through Week 8 builds on what's created here — the trial tenant, the custom domain, the user accounts, the security groups, and the admin structure. Students are playing the role of the IT admin at Lakeview Logistics, a fictional logistics company that has just decided to migrate from on-premises infrastructure to Microsoft 365. The goal by Friday: a fully configured M365 tenant with 10 licensed user accounts, four security groups, a custom domain, and an admin account structure ready for everything that follows.
Lakeview Logistics — the 10 users created this week
Sarah Chen
IT Manager
Primary admin account
Global Administrator role
Dev Sharma
IT Support Specialist
Helpdesk Admin role
LL-IT group
Marcus Webb
Operations Director
Standard user
LL-Management group
Priya Nair
Finance Manager
Standard user
LL-Finance group
Tom Bellamy
Accountant
Standard user
LL-Finance group
Diane Rousseau
HR Director
Standard user
LL-Management group
Kevin Park
Sales Manager
Standard user
LL-Sales group
Leila Farrokhzad
Sales Account Executive
Standard user
LL-Sales group
James Okafor
Logistics Coordinator
Standard user
LL-Operations group
Aisha Mwangi
Fleet Coordinator
Standard user
LL-Operations group
Custom domain setup
Each student signs up for an M365 Business Standard trial. Rather than using the default *.onmicrosoft.com domain, each student verifies a personal subdomain under nw7.nat-acc.ca — for example lakeviewlogisticsjd.nw7.nat-acc.ca. DNS records for verification and mail flow are managed through the shared DNS control panel. This means every user account from Day 2 onwards uses a realistic custom domain UPN, DNS lab work is real, and the domain verified here is the same one used for Exchange Online (Week 3) and DNS labs throughout the course.
| DNS record type | Purpose | Where created | When needed |
|---|
| TXT (MX verification) | Proves domain ownership to Microsoft during domain verification | Shared DNS control panel (nw7.nat-acc.ca) | Day 1 — required before custom domain is accepted by M365 |
| MX | Routes email for the custom domain to Exchange Online | Shared DNS control panel | Day 1 / Week 3 — required for Exchange Online mail flow |
| CNAME (Autodiscover) | Enables Outlook and other clients to auto-configure Exchange settings | Shared DNS control panel | Week 3 — required for Outlook client configuration |
| CNAME (Lyncdiscover / SIP) | Teams/Skype for Business service discovery | Shared DNS control panel | Week 5 — required for Teams federation |
| SPF (TXT) | Authorises M365 as a legitimate sender for the domain — prevents spoofing | Shared DNS control panel | Week 3 — required for email anti-spoofing |
Security groups created this week
| Group name | Type | Members | Used for (later weeks) |
|---|
| LL-IT | Security group | Sarah Chen, Dev Sharma | IT admin policy scope, CA exclusions, Intune admin groups (Weeks 2, 6) |
| LL-Finance | Security group | Priya Nair, Tom Bellamy | Finance DLP policies, Teams messaging policy, sensitivity label scope (Weeks 4, 5, 7) |
| LL-Management | Security group | Marcus Webb, Diane Rousseau | Management meeting policy, executive access controls |
| LL-Sales | Security group | Kevin Park, Leila Farrokhzad | Sales SharePoint site access, Teams guest policy scope (Weeks 4, 5) |
| LL-Operations | Security group | James Okafor, Aisha Mwangi | Operations SharePoint, Intune compliance scope (Weeks 4, 6) |
| LL-AllStaff | Microsoft 365 group | All 10 users | Org-wide policies, all-staff Teams team, SharePoint intranet (Weeks 4, 5) |
Admin roles assigned this week
| Role | Assigned to | What it allows | Why this role |
|---|
| Global Administrator | Sarah Chen (admin account) | Full control of all M365 services and Entra ID | Primary admin — full access needed for course labs. A separate Global Admin break-glass account is created in Week 2. |
| Helpdesk Administrator | Dev Sharma | Reset passwords, manage service requests, view user profiles | Realistic scoped role for IT support — cannot change licences or security settings |
| SharePoint Administrator | Sarah Chen | Manage SharePoint sites, storage, permissions | Required for Week 4 SharePoint labs — demonstrates role stacking |
Daily breakdown
Day 1
Lecture: M365 tenant architecture, Entra ID, admin centre landscape
Lab 1-A: Sign up for M365 Business Standard trial → verify personal subdomain under nw7.nat-acc.ca → add DNS records → confirm domain verified → tour admin centres (admin.microsoft.com, entra.microsoft.com)
Day 2
Lecture: Entra ID user objects, UPNs, licences, admin roles
Lab 1-B: Create all 10 Lakeview Logistics user accounts manually → assign M365 Business Standard licences → configure UPNs with custom domain → set usage location → verify sign-in for each account
Day 3
Lecture: Security groups vs M365 groups, dynamic membership, bulk operations via CSV and PowerShell
Lab 1-C: Create all six security groups → assign members → bulk import additional users via CSV → explore PowerShell (Get-MgUser, New-MgGroup, Add-MgGroupMember) → configure dynamic group for LL-AllStaff
Day 4
Lecture: Admin roles — Global vs scoped, least privilege principle, role assignment best practices
Lab 1-D: Assign Helpdesk Admin role to Dev Sharma → assign SharePoint Admin to Sarah → test role boundaries (what Dev can and cannot do) → tour all major admin centres → document the Lakeview Logistics admin structure
Day 5
Review: tenant structure, users, groups, roles, domain
Assessment: given a new-hire scenario, create user, assign correct licence and group memberships, assign appropriate admin role, verify access scope — all documented with reasoning
The nw7.nat-acc.ca subdomain system
Why a custom subdomain instead of onmicrosoft.com? Using the default *.onmicrosoft.com domain throughout the course would be simpler but teaches nothing about DNS — one of the most common pain points in real M365 deployments. Every student gets a personal subdomain (e.g. lakeviewlogisticsjd.nw7.nat-acc.ca) that they verify and own for the duration of the course. This means all UPNs look like s.chen@lakeviewlogisticsjd.nw7.nat-acc.ca — a realistic naming pattern. DNS record management is done through a shared control panel managed by the instructor or a class DNS tool. Students completing full M365 domain verification with their real subdomain — no workarounds needed.
Key concepts introduced this week
| Concept | What it is | Why it matters for the rest of the course |
|---|
| Tenant | An organisation's dedicated instance of M365 services — isolated from all other tenants. Identified by the onmicrosoft.com domain and the tenant ID (GUID). | Every subsequent lab operates within this tenant. Understanding that it is an isolated container prevents students from confusing their lab work with production systems. |
| Entra ID (formerly Azure AD) | The identity platform underlying all M365 services. Every user, group, device, and application in the course is an object in Entra ID. | Referenced in every single subsequent week. Entra ID is the foundation of CA policies (W2), Exchange recipients (W3), SharePoint permissions (W4), Teams policies (W5), hybrid join (W6), Defender (W7), and eDiscovery roles (W8). |
| User Principal Name (UPN) | The sign-in identifier for a user — format is firstname.lastname@domain. Must be unique within the tenant. | UPNs created this week are used to sign in throughout every lab. When Entra ID Connect syncs on-prem AD in Week 6, UPN matching between on-prem and cloud accounts is critical. |
| Licence assignment | Attaching a service plan (e.g. M365 Business Standard) to a user account, which activates the services they can use. | Without a licence, accounts exist in Entra ID but cannot use Exchange, SharePoint, Teams, or any workload. The E5 Security/Compliance trial added in Week 5 unlocks Defender and Purview features. |
| Security groups vs M365 Groups | Security groups: for access control and policy targeting (no mailbox, no Teams team). M365 Groups: create a mailbox, SharePoint site, and Teams team automatically. | Security groups (LL-Finance, LL-IT etc.) are used as policy targets in CA, DLP, Teams, and Intune throughout the course. LL-AllStaff is an M365 Group that gets a Teams team in Week 5. |
| Admin roles | Entra ID built-in roles that grant specific administrative permissions. Global Admin has unlimited access; scoped roles (Helpdesk Admin, SharePoint Admin) have limited, defined access. | The principle of least privilege — assigning only the permissions needed — applies throughout. Week 2 creates a CA policy specifically for admin roles (CA004). Week 8 audits role assignments. |
| M365 admin centres | The web portals used to manage different M365 services — admin.microsoft.com (general), entra.microsoft.com (identity), exchange.microsoft.com (mail), teams.microsoft.com (Teams), etc. | Each subsequent week introduces a new admin centre relevant to that week's workload. Students who understand the admin centre landscape from Week 1 spend less time navigating in later weeks. |
Week 1 outputs used in later weeks
| Week 1 element | Used in | How |
|---|
| User accounts (all 10) | Every week | Sarah Chen, Priya Nair, Marcus Webb etc. are the cast of characters in every scenario throughout the course. Their UPNs, job titles, and group memberships create realistic policy scope in every lab. |
| Custom domain (*.nw7.nat-acc.ca) | Week 3 (Exchange), Week 5 (Teams federation), Week 7 (Safe Links) | The domain verified here is used for Exchange mail flow MX record, Autodiscover CNAME, Teams federation, and anti-phishing policy impersonation protection targets. |
| LL-Finance security group | Weeks 4, 5, 7, 8 | SharePoint Finance site access (W4), Teams Finance messaging policy (W5), DLP policy targeting (W7), eDiscovery custodian scope (W8). |
| LL-IT security group | Weeks 2, 6 | CA policy exclusion for IT staff testing (W2), Intune admin group targeting (W6). |
| LL-AllStaff M365 Group | Weeks 4, 5 | All-staff SharePoint intranet site (W4), all-staff Teams team — the primary collaboration space for Lakeview Logistics (W5). |
| Global Admin (Sarah Chen) | Every week | All admin actions throughout the course are performed as Sarah Chen's admin account, creating a realistic single-admin-for-SMB model. |
| Helpdesk Admin (Dev Sharma) | Weeks 2, 8 | Used to demonstrate role boundary testing in CA policy design (W2) and demonstrates role-based access separation in the Week 8 capstone assessment. |
Admin centres introduced this week
| Admin centre | URL | Used for in Week 1 |
|---|
| Microsoft 365 admin centre | admin.microsoft.com | Trial signup, domain verification, user creation, licence assignment, admin role assignment — primary portal for Week 1 |
| Microsoft Entra admin centre | entra.microsoft.com | User and group management, viewing Entra ID objects, admin role assignment — becomes the primary identity portal from Week 2 |
| Microsoft 365 admin centre — Billing | admin.microsoft.com → Billing | Viewing trial subscription status, understanding licence counts, adding the E5 trial (later in Week 5) |
Key design decisions for Week 1
Microsoft Entra ID, not Azure AD. All materials use the current product name — Microsoft Entra ID. Students will encounter "Azure AD" in older documentation, exam questions, and some portal labels still being updated, but all instruction uses Entra ID. When students see "Azure AD" in the portal, they should recognise it as the same product.
UPN format: firstname.lastname@domain. All 10 users follow the same naming convention — s.chen@domain, p.nair@domain, etc. This consistent format makes it easier for students to reason about permissions (who is in LL-Finance?) and for labs to reference accounts by name without ambiguity.
The admin account is Sarah Chen, IT Manager — not a generic "admin" account. Students operate as Sarah Chen throughout the course. This builds the habit of using a named, licenced, auditable admin account rather than a shared generic credential — which is the production best practice. The break-glass account (created in Week 2) is the exception: it is deliberately generic and password-protected offline.
The trial expires in 30 days — plan accordingly. M365 Business Standard trials run for 30 days. The course is 8 weeks. Students need to either extend the trial (available once) or start a fresh trial at approximately the Week 4 boundary if the course runs longer than 30 days. The E5 Security/Compliance trial added in Week 5 has its own 90-day timer.
Learning outcomes — by end of Week 1, students can…
Provision a tenantSign up for an M365 trial and verify a custom domain with correct DNS records
Create and licence usersCreate M365 user accounts with correct UPNs, usage location, and licence assignment
Create and populate groupsCreate security groups and M365 Groups, assign members, explain the differences
Bulk import via CSVPrepare a CSV file and bulk-import user accounts via the admin centre
Assign admin rolesAssign scoped Entra ID admin roles and explain what each role can and cannot do
Use PowerShellConnect to Microsoft Graph PowerShell and run basic user and group cmdlets
Navigate admin centresIdentify the purpose of each M365 admin centre and navigate to common tasks