01Executive summary

In most small businesses, Microsoft 365 is the business: mail, files, Teams, and the identity every other app signs in with. Mistakes there are visible immediately, and the same request (new hire, leaver, mailbox change) arrives in dozens of slightly different tenants.

This case study covers how I handle that work consistently: the lifecycle of an identity from creation to departure, the licensing and mailbox decisions in between, and the scripting that keeps repeated work accurate.

02Disciplines & technologies

03The problem

Identity work looks routine until it goes wrong. A leaver whose mailbox is deleted instead of converted loses the business years of correspondence. A licence assigned by hand gets forgotten and billed for months. A SharePoint folder shared with “everyone” quietly exposes payroll. A user without MFA becomes the way in.

Each tenant is configured a little differently, some synced from on-premises AD and some cloud-only, so the same request needs a different procedure depending on where the identity is mastered.

04Environment & complexity

05My contributions

• User provisioning and deprovisioning across tenants
• Licence assignment, clean-up and SKU changes
• Converting user mailboxes to shared mailboxes for leavers so data stays without a licence
• Exchange Online administration: permissions, forwarding, aliases, distribution groups
• SharePoint site and library permissions
• MFA enrolment and sign-in security support
• Entra Connect troubleshooting for hybrid identities
• PowerShell and Microsoft Graph for bulk and repeatable tasks
• Google Workspace administration with GAMADV-XTD3

06Identity lifecycle & tooling

Leaver procedure (generalised)

1. Confirm source of authoritySynced users are changed in on-premises AD; cloud-only users in Entra ID. Changing the wrong side gets overwritten on the next sync.
2. Block sign-in and revoke sessionsStop access first, then deal with data.
3. Convert the mailboxConvert to a shared mailbox and grant access to whoever inherits it, so the licence can be removed without losing mail.
4. Hand over filesGive a manager access to OneDrive content before retention clocks start.
5. Remove licences and groupsReclaim the licence and remove group memberships.
6. DocumentRecord what was done and who now has access.

# convert a leaver mailbox to shared and grant access
› Set-Mailbox -Identity user@domain -Type Shared
› Add-MailboxPermission -Identity user@domain -User manager@domain -AccessRights FullAccess
# check licence assignment via Microsoft Graph PowerShell
› Get-MgUserLicenseDetail -UserId user@domain
# Google Workspace: list a user and suspend with GAM
› gam info user user@domain
› gam update user user@domain suspended on

07Challenges & decisions

08Outcomes

• Ongoing

  Ongoing administration of Microsoft 365 and Google Workspace tenants.

• Verified

  Shared mailbox conversions performed for departing users, keeping business mail available without a paid licence.

• Not documented

  No figures for licence savings or ticket volumes are claimed.

09Lessons & capabilities

• Know where an identity is mastered before you touch it
• Licences follow people only if someone makes them
• A good leaver process protects the business, not just the account
• PowerShell and Graph turn ten tenants into one procedure

Capabilities demonstrated

• Entra ID
• Exchange Online
• SharePoint permissions
• PowerShell
• Microsoft Graph
• GAMADV-XTD3
• Hybrid identity

10Related work