Microsoft 365 Tenant

What Microsoft 365 Tenant means in practice

The tenant is the boundary that everything else sits inside. Users, groups, licences, policies, SharePoint sites, mailboxes, security configuration and audit data all belong to one tenant. Understanding it as the unit of governance clarifies a lot of otherwise confusing decisions, particularly during mergers, divestments and rebrands.

Tenant configuration is where security posture is actually set. Security defaults or conditional access policies, external sharing behaviour, guest access rules, self-service application consent, audit log retention, and which administrative roles exist and who holds them are all tenant-level settings. Microsoft Secure Score gives a running measurement against recommended configuration, and while chasing the number for its own sake is unproductive, the underlying recommendations are a reasonable starting backlog.

Multi-tenant situations arise more often than expected. Acquisitions arrive with their own tenant. Group structures sometimes maintain separate tenants for regulatory separation. Consolidation is a substantial project involving mailbox and file migration, identity remapping, application reconfiguration and a domain move that has to be sequenced carefully, because a custom domain can only exist in one tenant at a time. Microsoft's cross-tenant synchronisation and migration tooling has improved, but the planning burden remains.

Data residency is a common question for Australian organisations. Microsoft 365 offers Australian data centre regions for the core workloads, and tenants created with Australia as the country generally have core customer data at rest stored locally. Which specific services honour residency, and what happens with newer AI services, changes over time and should be verified against current Microsoft documentation for anything contractually significant rather than assumed.

Tenant hygiene deserves a recurring calendar slot: reviewing administrative role assignments, expiring guests, unused licences, inactive Teams and sites, and application consents. None of it is difficult; all of it accumulates.