Microsoft 365 Admin Center Basics for Small Business

The Microsoft 365 admin center is where you actually run your Microsoft 365 tenant — where users are added, licenses assigned, mailboxes provisioned, security settings enabled, and every “why can’t Bob see the shared calendar” ticket eventually lands. Once you know your way around it, most small-business M365 administration takes minutes, not hours. This is the small-business owner’s tour.

What the admin center is (and is not)

The Microsoft 365 admin center lives at admin.microsoft.com and is the top-level control panel for your entire M365 tenant. It is where you go to add users, assign licenses, set up domains, and get to every other Microsoft admin portal (Exchange admin center, SharePoint admin, Entra ID / Azure AD, Intune, Defender, Purview).

What it is not is a place to configure everything. Once you outgrow the basics, you will spend most of your time in the specialized admin centers linked from the sidebar — Exchange for mailboxes, Entra ID for identity and MFA, SharePoint for site permissions, Intune for device management. The main admin center remains the launchpad.

Roles: who gets what

Never do day-to-day work as the Global Administrator. Global Admin is the “root” of the tenant and if that account is compromised, the entire company is compromised. The right pattern for a small business:

• Two Global Admin accounts. One is the “break-glass” account (a strong password, MFA, locked in a password manager, used only when something is broken). The other is your day-to-day admin account, used only for admin work.
• A regular user account for you, personally. This is what you use for email, Teams, and the actual work of your business. It has no admin rights.
• Delegated roles for anyone else who helps. “User Administrator” for someone who onboards users. “Exchange Administrator” for someone who fixes mailbox issues. Never Global Admin for a helper unless they truly own the tenant with you.

Adding a user (the everyday task)

The most common thing you will do in the admin center: add a user when someone joins.

1. Go to Users > Active users > Add a user.
2. Fill in first/last name, username (the part before @yourdomain.com), and display name.
3. Set a temporary password. Check “Require this user to change their password when they first sign in.”
4. Assign a license (Business Basic / Standard / Premium — the license controls what apps and features the user gets). If you are deciding, our Microsoft 365 plans compared guide walks through which fits which use case.
5. Add any group memberships needed (departmental distribution lists, security groups).
6. Optionally assign roles (leave blank for a regular user).
7. Review and finish. The user will receive their sign-in info via a method you choose (email to their manager, print it, etc.).

The whole thing takes 3-5 minutes once you have done it a few times. Standardize the process — a checklist and a shared naming convention will save you a lot of ticket-time later.

Licenses: assigning, reassigning, and reclaiming

Licenses are the meter that Microsoft charges by. You buy N of each license (say, 15 Business Standard), and you assign them to users one at a time. Two things that will save you real money:

• Reclaim licenses when people leave. Remove the license immediately on offboarding. Convert the mailbox to a shared mailbox if you need to preserve the address — a shared mailbox up to 50 GB does not require a license.
• Right-size the tier. A shared frontline account (say, a warehouse iPad or a shop-floor kiosk) may only need Business Basic ($6/user/month) rather than the office team’s Business Standard ($12.50/user/month). Reserve Business Premium (which adds device management and advanced security) for users who actually benefit — usually all admin users and everyone who handles sensitive data.

Setting up email

New tenants come with an @yourbusiness.onmicrosoft.com domain by default. To use your real domain (@yourcompany.com) for email you need to add and verify the domain, then move the MX record at your DNS provider.

1. Admin center > Settings > Domains > Add domain.
2. Enter your domain. Microsoft will give you a TXT record to add at your DNS host — do that, then click Verify.
3. Once verified, Microsoft will list the DNS records for email (MX, SPF, DKIM, Autodiscover). Add each at your DNS host, exactly as Microsoft specifies.
4. Enable DKIM for the domain (Defender / Exchange admin > Email authentication).
5. Add a DMARC policy (start with p=none, monitor for 4-6 weeks, then move to p=quarantine).

Give the DNS changes a few hours to propagate. Send yourself a test email from an outside address to confirm delivery, then to a Gmail account to confirm SPF/DKIM alignment (Gmail shows the auth results in the message details).

Security you must turn on before you do anything else

1. Multi-factor authentication for every user. Non-negotiable. Use the Microsoft Authenticator app; SMS is a fallback only.
2. Security defaults (or Conditional Access if you have Business Premium). Security defaults are one toggle in Entra ID and enforce MFA for admins and users, block legacy authentication, and require MFA on risky sign-ins.
3. Enable auditing. Purview > Audit > Turn on the audit log. Otherwise you cannot investigate an incident later. Free with any license.
4. Restrict who can create Microsoft 365 groups and Teams. By default any user can, which creates admin sprawl fast.
5. Configure the Outbound spam filter. Set the “notify admin on suspicious outbound mail” and cap outbound messages per hour to a sane number (this catches account takeovers before your domain is blacklisted).

For the deeper security lane — Conditional Access policies, Defender for Business hunts, incident response — cross over to how to secure Microsoft 365.

Groups and shared mailboxes

Two features that solve real everyday problems:

• Distribution groups (info@, sales@) — everyone in the group receives mail sent to the address. Free.
• Shared mailboxes — a mailbox with its own address that multiple users can open in Outlook, reply-as, and share the inbox. Free up to 50 GB.
• Microsoft 365 Groups — a modern group that includes a shared mailbox, a shared calendar, a SharePoint site, and a Team. Use for actual teams; keep them named clearly.

Common admin gotchas

• The person who set up the tenant left, and no one else has Global Admin. Fix: recover the tenant via Microsoft support (proof of ownership is required and it is slow — do not let it happen).
• MFA is on for users but not admins. Fix: enable it for all admins today.
• DNS records for email are wrong. Symptom: intermittent delivery failures. Fix: rerun the Setup DNS wizard.
• Everyone can send from every shared mailbox. Fix: restrict Send-As permissions in Exchange admin.
• Licenses cost more than they should. Fix: right-size tiers and reclaim unused licenses monthly.

The bottom line

The Microsoft 365 admin center is not complicated — but it rewards a small amount of setup discipline. Get roles right, turn on MFA and auditing on day one, standardize your user-onboarding steps, and reclaim licenses on offboarding. For a step-by-step tenant setup, see our Microsoft 365 setup guide. For the Google Workspace comparison, read Google Workspace vs Microsoft 365.