I'm curious what other organizations struggle with most.

In the environments I've worked with, the biggest challenges aren't authentication or MFA anymore. It's governance after access has already been granted.

Things like:

• Nobody knows who owns an application.
• Hundreds of security groups with no clear purpose.
• Access reviews only happen before an audit.
• Standing privileged access that nobody questions anymore.
• Employees not knowing what they can actually request.

If you could change one thing about Microsoft Entra Governance tomorrow, what would it be?

Regarding Microsoft Teams, is there a method to restrict attachment sharing to a specific external domain, rather than enabling it for all external users?

I have attempted PowerShell scripts, but these have universally enabled the functionality. Your guidance on this matter would be greatly appreciated.

A new DLP rule is available to control sharing of SharePoint and OneDrive files with selected domains and email addresses. The new rule supports an allow list (permit sharing) and can also specify a deny list (block sharing). The user interface takes a little getting used to, but when everything is configured and SharePoint has had a chance to respond to the block, the rule works and any attempt by a blocked user to use a sharing link is refused.

https://office365itpros.com/2026/07/22/block-sharing-dlp-sharepoint/

This sounds so stupid I'm ashamed to post it. But at our non-profit, I had previously configured several rooms anyone could edit. Works fine. Now I go to make a new shared calendar and no one can see it, and the options I remember from the previous configuration are not there. I remember some settings to be sure anyone could make a meeting or reserve a time, but I don't see them at all.

Is it different or am I just nuts? Microsoft 365 help is no help..

Hi everyone,

I recently started learning Dynamics 365 Finance & Operations (F&O) development and have been following the Microsoft Learn learning path:

https://learn.microsoft.com/en-us/training/paths/build-finance-operations/

For about a month now, I haven't been able to access the Launch VM/Lab environment. It suddenly disappeared from all the exercises, and because of that I can no longer practice the technical side of F&O development in Visual Studio (creating tables, forms, classes, enums, extensions, etc.).

I've already tried:Different browsers, Incognito mode, Different Microsoft accounts

Unfortunately, the VM is still unavailable. I also noticed that several other learners are reporting the same issue, and Microsoft moderators have indicated that the F&O Learn lab VMs are currently unavailable with no ETA.

Could anyone suggest where I can practice F&O development now?

I'm specifically looking for a way to get hands-on experience with: Visual Studio development, X++, Creating tables, forms, enums, classes, Extensions and data entities

I'm currently learning on my own, so I'm looking for any legitimate options, such as:

Free or low-cost practice environments

Trial or sandbox environments

Any other alternatives that developers use for learning

I'd really appreciate any recommendations. Thanks in advance!

Hi everyone,
I’m currently working on a SharePoint migration for my organization. We need to migrate a large number of SharePoint Online sites from one Microsoft 365 tenant to another.
This is the first time I’m handling a migration on this scale, so just wanted to know how other people have done it in a real production environment.
If anyone has done a large SharePoint tenant to tenant migration, how was your experience? Did you face any major issues during the migration? Did you go with Microsoft’s native method or use some other solution?

We’re implementing Microsoft Purview for a large enterprise with approximately 3,600 endpoints. The organization currently has no sensitivity labels in place, but we need to roll out Purview policies (DLP, information protection, etc.).

My current thinking is:
Define the label taxonomy first.
Pilot with 10 users.
Expand to around 150 pilot users.
Roll out organization-wide.
Start with manual sensitivity labelling so users become familiar with the labels.
Introduce automatic labelling after the manual phase.
My concern is that users may apply incorrect labels during the manual phase, which could affect policy effectiveness.

Would it be better to:
Start with manual labelling and transition to auto-labelling?
Introduce auto-labelling much earlier?
Or use a hybrid approach from the beginning?
For those who have deployed Purview at enterprise scale, what rollout strategy worked best, and what would you do differently if you were starting again?

Hi all,

Random query that has my stumped (Microsoft documentation isn't overly helpful).

We are in the processing of performing a move from SfB 2015 On-Premise (running CU12) to Teams with Direct Routing. I have a script used previously, that was using the HostedMigrationOverrideUrl (which do not exist in since SfB Online was shutdown).

When I attempt to move a user using Move-CsUser -Identity [[email protected]](mailto:[email protected]) -Target sipfed.online.lync.com

It tries to use autodiscover from our Hybrid setup, but ultimately fails because none of the old infrastructure with SfBO has been shutdown.

Anyone done this effectively using the Move-CsUser command? Or can give me some hot tips to fix it?

I can to the hard cutover method of updating the AD attributes msRTCSIP-PrimaryHomeServer (clearing that out) and updating the msRTCSIPDeploymentLocator to sipfed.online.lync.com and doing a delta sync with Entra Connect.

But I have to set the user in SFB to -Enabled $False otherwise they will still be able to sign into SFB. And they no longer get the notification that they have been migrated to Teams on the SFB Desktop App.

JSON batching is one of the most effective ways to speed up the processing of Graph API requests. Although it might seem complicated, once you understand how batches are put together and submitted to the Graph batch endpoint, it’s not that hard. JSON batching is of particular interest to large Microsoft 365 tenants that might need to process tens of thousands of accounts, mailboxes, groups, and so on. All explained here, along with a PowerShell script to show how it’s done.

https://office365itpros.com/2026/07/21/json-batching-primer/

Hello all, hope someone can advise here as I seem to have caused some licensing issues after defederating from GoDaddy.

We want to be in a place where we are paying monthly for however many licenses we use and are only tied to a 1 month subscription.

I defederated from GoDaddy and removed their GDAP permissions, they are still showing as our reseller in the admin portal.

I went to purchase the licenses direct from MS and in the "Purchase Services" bit of the admin center there was the option to chose between either MCA Billing account or MOSA billing account.

I chose MOSA and went through the whole process to buy the licenses but it kept failing so I went back and chose MCA instead.

I'm getting confused as under "Billing Accounts" in the admin portal I can only see the MOSA account.

Under "Your Products" I can switch between MOSA and MCA account, the MOSA account shows Business Standard licenses with an expiry of next year which would be a year term. The MCA account shows M365BS licenses with expiry of september this year.

I've not cancelled anything in GoDaddy yet and I'm just wondering if anyone can help me get the billing in order on Microsoft's end before I do.

Last weekend, I faced an unexpected issue with Exchange Online Mailbox Archive.

After completing an IMAP to Exchange Online migration project, I noticed that older mailbox items were not being moved to the Online Archive, even though the archive mailbox was enabled.

I started troubleshooting using Exchange Online PowerShell cmdlets to analyze mailbox settings, retention policies, retention tags, and Managed Folder Assistant processing. However, I still couldn't identify the root cause.

Then, I tested another approach: I created a new MRM Retention Policy using the same retention tag "Default 2 Year Move to Archive".

The result was unexpected: the mailbox started moving emails to the Online Archive successfully.

But the question remained:

Why did the same retention tag work with a new retention policy, but not with the previous one?

I documented the complete troubleshooting journey, including the investigation steps, PowerShell commands, Microsoft Purview analysis, and the final workaround.

I would like to hear your opinion:

• Was this troubleshooting approach correct?
• Have you ever faced a similar Exchange Online Archive or MRM Retention Policy issue?
• What would you investigate differently?

You can check the full troubleshooting sequence here:
https://medium.com/@renato.rossi.ferreira/everything-looked-fine-until-exchange-online-archive-stopped-working-586d1bce05f6?sharedUserId=renato.rossi.ferreira

Let's share knowledge and learn from real-world Microsoft 365 challenges.

Well, I started working last year as a backend Executive operation. I wanted to shift my career into an ERP functional consultant in D365 f&o every time I start to prepare or learn something or other happens lack of motivation, focus and anxiety,stress.

Need suggestions from you community on how I need to prepare for an interview based on the concepts or else I need full on hands-on practice.

Few steps or suggestions would really help full for me.

Hoping for best.

I work for two companies that both use 365. What is an easy way to keep on top of emails and teams messages from both companies? I was able to merge email accounts on my phone and personal desktop, however teams seems to be a bit more complex, especially with file sharing. I especially don’t want to get the two companies confused with outside correspondences. Thanks!

I am trying to migrate our small company (4 emails) and it feels like this whole process is just set up to fail. I'm following a youtube video that has a lot of great comments, and it's working, except right now, I'm working on building the new migration batch, but it won't recognize the primary domain.

Is there some way I can figure this out on my own? I've been waiting for a call from support, but I feel like this isn't high on their priority list. Or is there someone I can hire to do it for me, or walk me through it on the phone? The budget isn't huge, but this is ridiculous... You'd think they'd want to make this easier.

Had a few machines in a test patch group be upgraded to version 2606 and checking Account/About it now shows as monthly enterprise channel. On these machines the M365 apps install was installed using the Semi annual channel. I found https://learn.microsoft.com/en-us/microsoft-365-apps/updates/unified-update-channels which suggests the SAC channel is being merged into MEC but i was under the impression it was only for new installs for example you cant select that channel when building a configuration.xml. The update from SAC to MEC is causing us issues as part of the update its also updating the C++ 2015-2022

A user assigned managed identity (UAMI) is a secure method to authenticate with many important endpoints, including the Microsoft Graph. It’s like a system assigned managed identity (SAMI), but the big difference is that a UAMI is an Azure resource that isn’t tied to an automation account. It can be used in multiple areas of Azure and a UAMI might be a better option for large organizations that make extensive use of Azure resources.

https://office365itpros.com/2026/07/20/user-assigned-managed-identity/