All jobs / IT support / sysadmin

Microsoft 365 interview questions

Microsoft 365 questions a IT support / sysadmin can be asked, from first job to senior. Open one to see the strongest answer and why it works.

1. A colleague says Entra ID is just Active Directory in the cloud. Where is that wrong?

   The strongest answer: It signs people in to cloud applications over web protocols — not a domain controller, so no domain join in the old sense and no Group Policy. On-premises AD syncs into it, but they are different systems

   Why it works: Exactly. Same accounts, very different mechanics — which is why the on-premises habits do not transfer.

   • Cloud sign-in, not a domain controller.
   • No domain join, no Group Policy.
   • Web protocols, not the old ones.
   • Sync links them; it does not merge them.

2. Customers are receiving invoices that appear to come from your domain, and your own newsletter keeps landing in their junk folders.

   What do you put in place, and in what order?

   The strongest answer: Publish a record listing the services allowed to send for the domain, sign outbound mail cryptographically, then add a policy record — started in monitoring, so I see everything that really sends as us before anything is rejected

   Why it works: Right. Monitoring first is the whole discipline: you nearly always find a legitimate sender nobody remembered.

   • Authorise, sign, then set policy.
   • Start the policy in monitoring.
   • Find the senders you forgot.
   • Tighten only once reports are clean.

3. A team wants one inbox. What do you give them?

   The strongest answer: A shared mailbox or a group they are members of — not one login and password on a sticky note

   Why it works: Exactly. Membership, not a communal person. Seasons-as-passwords are a museum.

   • Shared mailbox or group membership.
   • No communal login.
   • No personal Gmail side-path.
   • No “borrow” of an exec mailbox.

4. A new SaaS wants its own password file. What do you push for?

   The strongest answer: SSO into your identity provider, with groups you already review — a second password pile is a second incident pile

   Why it works: Exactly. One identity, reviewed groups. Later-tidy is how you get shadow tenants.

   • SSO to the IdP you review.
   • No spreadsheet directories.
   • No shared SaaS passwords.
   • No souvenir team tenants.

5. A department head asks you to switch on a Microsoft 365 feature for their team this afternoon. What do you check before you say yes?

   The strongest answer: Whether the licences they already hold include it, how many spare licences the tenant has, what an upgrade would cost, and who approves that spend — then I come back with a date rather than a promise in the corridor

   Why it works: Exactly. Entitlement, spare capacity, cost and approval — and the date is what turns you into someone who can be planned around.

   • Check entitlement before you promise.
   • Count the spare licences.
   • Price the upgrade, name the approver.
   • Answer with a date, not a yes.

6. What is a break-glass account for, and how do you keep it from being a pet?

   The strongest answer: IdP or cloud lockout — stored offline, monitored, rarely used, and tested — not a daily convenience login on a sticky note

   Why it works: Exactly. Rare, monitored, tested. Convenience and never-tested are two ways to fail.

   • Offline, monitored, rare, tested.
   • Not a daily login.
   • Not an MFA dodge.
   • Never-tested is not safer.

7. SSO is down. How do you still talk to the company?

   The strongest answer: A path that does not depend on the sick IdP — status page, SMS, or a cached list you practised — not “check email” when email is the IdP

   Why it works: Exactly. Out-of-band you have drilled. Hope is not a channel.

   • Practise an IdP-independent channel.
   • Do not loop on SSO-gated mail.
   • Do not loop on SSO-gated chat.
   • Do not rely on rumours.

8. Anyone in the company can create a team, and every team quietly gets a document site behind it. A finance folder has just been found shared with an “anyone with the link” address.

   What is your stance?

   The strongest answer: Decide as policy who may create teams and what happens when one goes quiet, set what external sharing is allowed at tenant and site level, and report on the links that already exist — sensitive sites are the exception

   Why it works: Right — creation, lifecycle, sharing defaults and visibility of what already exists. Anything less leaves you guessing.

   • Govern creation, not just sharing.
   • Set the defaults at tenant and site.
   • Sensitive sites are the exception.
   • Report on links that already exist.

9. Teams buy SaaS on cards. What is the staff move?

   The strongest answer: A short path to say yes with identity and offboarding, plus a hunt for the risky ones — a war on every tool just teaches hiding

   Why it works: Exactly. Make the front door faster than the card. Wars and fake 0% are how you go blind.

   • Yes-path with identity and offboarding.
   • Hunt the risky tools.
   • Do not war on every app.
   • No fake 0% shadow IT.