Microsoft 365 & Copilot in the Enterprise · Chapter 1 of 12
The tenant, and the decision you cannot undo
Everything in Microsoft 365 hangs off one object. Understanding it properly makes the rest of the estate legible.
Before anything else, what the hiring evidence for this actually says.
Across 3,010 job descriptions in the corpus behind this site, Microsoft Entra ID (including its old name, Azure Active Directory) appears in 8.1% — 243 postings. That is a real, substantial presence, and it is concentrated in identity and infrastructure roles.
Everything else in this book is close to invisible. Microsoft 365 or Office 365 by name: 0.7%. Intune, SharePoint and Purview: about 0.1% each. Power Platform: 0.1%. Conditional Access: one posting. Microsoft 365 Copilot and Copilot Studio: zero. Not one, in 3,010.
So read this book for what the evidence supports. The identity layer is a hiring market. The rest is knowledge that makes you effective inside a role — the thing that gets you into the room where the licensing decision or the Copilot rollout is being argued about — not a job title you should be optimising towards. Chapter 2 is the one with a market behind it.
If you have never run a Microsoft 365 programme, the single most useful thing to fix in your head first is what a tenant is — because every other decision refers back to it, and one of its properties is genuinely permanent.
Microsoft's own wording is that a tenant is the default collaboration and licensing boundary. In practice: it is your organisation's identity directory in Microsoft's cloud, plus everything scoped to it.
A naming history you will trip over constantly
Azure Active Directory was renamed Microsoft Entra ID. The guidance was published 11 July 2023, the name appeared in the product interface on 15 August 2023, and the licence names changed on 1 October 2023.
Nothing functional changed — no feature, no price, no service-level agreement. It was purely a rename.
You will meet both names for years. Documentation, error messages, third-party tools and every engineer over thirty still say Azure AD. This is the first of many renames in this book, and they are the main reason Microsoft documentation is hard to search.
Getting a real domain name on it
The tenant is created with a permanent yourcompany.onmicrosoft.com address, which nobody wants on their business cards. You attach your real domain by proving you own it — either automatically, if your DNS is hosted somewhere Microsoft integrates with (GoDaddy, Cloudflare, IONOS and a few others), or by publishing a TXT record, which is just a piece of text in your domain's public DNS that only the domain's owner could have put there.
Microsoft says verification takes up to ten minutes, though some registrars need up to 48 hours. The one operational rule worth memorising: create your users and their mailboxes before you point the domain's MX record — the DNS record that says where mail should go — at Microsoft. Do it the other way round and mail arrives for mailboxes that do not exist yet.
One tenant, or several?
Microsoft names the reasons organisations end up with more than one: conglomerates with subsidiaries, mergers and acquisitions, divestitures, data-residency rules that differ by country, separate development and test environments, and departments that quietly signed up for their own.
There is a feature called a multitenant organisation that groups tenants you own so that people across them appear as colleagues rather than external guests in Teams. It does not merge anything. It is a collaboration and discovery layer, capped at 100 tenants, and it needs an Entra ID P1 licence for every person in it.
Separately there is cross-tenant synchronisation, which pushes user objects one way from a source tenant to a target on roughly a 40-minute cycle. Microsoft's documentation answers the obvious question directly: it is not a migration tool, because the source tenant is still required for those users to sign in.
There is still no supported way to merge two tenants. In 2026.
Microsoft shipped a Migration Orchestrator in public preview around December 2025 which moves content — Exchange mailboxes, OneDrive, and Teams chats. Its own documentation is blunt: this migration moves content, not identities.
Explicitly out of scope: Teams channels and SharePoint sites. That data stays in the source tenant.
So the personal-data slice is now covered natively, and the collaboration slice — which is usually the larger and messier half — still needs third-party tooling or Microsoft Consulting Services. If you are ever asked to scope a post-acquisition integration, this paragraph is the one that sets the budget.
Check yourself