Microsoft 365 admin center topics

How to move user from a CSP Exchange Online licence to a Microsoft direct licence in the same tenant

Mike_Soulby — Mon, 03 Aug 2026 22:37:37 GMT

I have an existing Microsoft 365 tenant with a single Exchange Online (Plan 1) licence that was purchased through Bluehost (Endurance International Holding B.V. CSP). Microsoft notified me that Endurance is no longer authorised as a Direct Bill CSP, so I decided to purchase a new Exchange Online (Plan 1) subscription directly from Microsoft

My current situation is:

Exchange Online (Plan 1) purchased through Bluehost/Endurance
Exchange Online (Plan 1) purchased directly from Microsoft
Both subscriptions are now active

The problem is that Microsoft 365 appears to pool the licences together. Under Users → Active users → Licences and apps I only see Exchange Online (Plan 1) and there is no way to choose which subscription the user is assigned to.

The licensing page simply shows:

Licences assigned from all subscriptions: 1 / 2

The two subscriptions are only distinguishable by their billing profiles (one is the Bluehost/Endurance CSP subscription and the other is my new Microsoft direct subscription).

I want to make sure my mailbox is consuming the Microsoft direct licence.

How can I determine which subscription my user is currently licensed from?
If the user is still consuming the CSP licence, what is the supported way to move them onto the Microsoft direct subscription?
Is the licence automatically reassigned if the CSP subscription is cancelled, or is there a manual process that should be followed?

I want to keep the existing tenant, mailbox, domain and email data and only change the billing source for the licence.

Any guidance from anyone who has completed this transition would be greatly appreciated.

Microsoft Customer Agreement created without Billing Profile after CSP deauthorization

IanBartlett — Wed, 29 Jul 2026 10:11:26 GMT

I am the Global Administrator of a Microsoft 365 tenant that previously had an Exchange Online Plan 1 subscription supplied through Endurance International Holding B.V. (Bluehost).

This is not a mailbox migration issue. My mailbox already resides in Exchange Online within my existing Microsoft 365 tenant. The only intended change is to move from the former Cloud Solution Provider (CSP) to direct Microsoft billing after the CSP was deauthorized.

The Partner Relationships page now displays:

Endurance International Holding B.V. (Netherlands)'s account is closed. Find a new partner using Partner app finder or buy from Microsoft directly.

Following Microsoft's guidance, I have:

Created a Microsoft Customer Agreement (MCA)

Created a Billing Account ("Pecten Development")

Added and verified a SEPA payment method

Updated the Sold-to and Technical Contact details

However:

Purchasing Exchange Online Plan 1 continually requests a Billing Profile.

Completing the Billing Profile workflow never creates one.

My Billing Account contains no Billing Profile or Billing Scope.

Azure Cost Management reports that there is no supported billing account or subscription.

I therefore cannot purchase Exchange Online Plan 1 directly from Microsoft before the existing subscription expires.

I have also confirmed that:

The former reseller account is closed.

There are no delegated partner roles remaining.

Microsoft support repeatedly directs me back to the former CSP.

Bluehost have confirmed they can no longer escalate through Microsoft CSP channels because their reseller relationship has ended.

My current diagnosis is that the Microsoft Customer Agreement has been created successfully, but the associated Billing Profile/Billing Scope was never provisioned. This leaves the tenant unable to purchase services directly from Microsoft despite the former CSP relationship having been closed.

Has anyone encountered this after a CSP deauthorization?

Does this require intervention by the Microsoft Commerce team, or is there another way to force creation of the missing Billing Profile?

If a Microsoft moderator requires my tenant ID or billing account details, I would be happy to provide them by private message.

Thank you.

Make Your Test Data Less Boring with M365Mutator

TonyRedmond — Fri, 10 Jul 2026 09:15:10 GMT

Testing Microsoft 365 scenarios often involves test data. If the data is stale or always the same, it might not generate good results or help to identify lurking problems. The M365Mutator app helps to solve the problem by mixing things up in your test data. The app can change properties of Entra ID accounts, send email, update calendars, and generally make sure that whatever you’re testing has fresh information to run against.

https://office365itpros.com/2026/07/10/m365mutator-test-data/

Make Your Test Data Less Boring with M365Mutator

TonyRedmond — Fri, 10 Jul 2026 09:15:05 GMT

https://office365itpros.com/2026/07/10/m365mutator-test-data/

Unable to access our Microsoft Entra admin center

AlexAG — Mon, 06 Jul 2026 07:14:17 GMT

We cannot create a support request from the admin center because we cannot sign in

Dear Microsoft Support Team,

We are unable to access our Microsoft Entra admin center because even our administrator account, email address removed for privacy reasons, is being prompted for MFA, and we do not currently have access to the Microsoft Authenticator method required to complete the sign-in.

As a result, we cannot access Entra ID / Microsoft 365 admin settings to reset MFA methods, issue a Temporary Access Pass, or re-register authentication methods for the affected users.

Tenant/domain: itieurope.com

Affected admin account: email address removed for privacy reasons

Issue: MFA is required to sign in, but the Authenticator method is unavailable

Impact: We are locked out of the tenant administration portal and cannot manage users or authentication methods

We request assistance with one of the following recovery actions:

Reset MFA methods for the administrator account email address removed for privacy reasons; or

Enable re-registration of MFA for this account; or

Provide a Temporary Access Pass or another Microsoft-approved recovery method so that we can regain administrative access to the tenant.

We had force majeure, the only authenticator was on the phone, which was destroyed due to an unforeseen situation. (crashed)

We are ready to verify domain ownership, provide billing information, tenant details, proof of identity, or any other information required to confirm that we are the legitimate owners/administrators of this Microsoft 365 tenant.

Please escalate this as an urgent tenant lockout / admin access recovery issue.

Kind regards,

itieurope.com

email address removed for privacy reasons

Looking for Microsoft 365 best practices for a large dynamic company group

TheITGirl — Tue, 30 Jun 2026 18:59:38 GMT

Looking for Microsoft 365 best practices for a large dynamic company group

I'm a Microsoft 365 admin trying to figure out the best architecture for a company-wide group (100+ users) and I'm wondering if there's a better approach than what I'm currently doing.

What I need

I want a single company group that can:

Automatically include users through dynamic membership
Share SharePoint sites, files, OneDrive content, Teams resources, etc.
Allow sending company-wide emails
Allow sending required Outlook meeting invitations (not optional)
Have moderation/approval for announcements, meeting invites, or posts
Allow certain trusted users to bypass approval while everyone else requires approval
Scale as employees are hired/terminated automatically

Current setup

Dynamic Distribution List

Used for company-wide emails and Outlook meeting invites.
Membership is dynamic using an Exchange recipient filter based on US users.

Private Microsoft 365 Group

Used for SharePoint, file sharing, and collaboration.
Membership is dynamic through an Entra ID Dynamic Membership Rule.
I had to use PowerShell to configure some permissions because the portal didn't support everything I needed.

Problems I'm running into

I now have two separate groups that should always contain the same people.
The Dynamic Distribution List works well for email/meetings but doesn't provide SharePoint, Teams, or file collaboration.
The Microsoft 365 Group provides collaboration but doesn't seem to support everything I need for company-wide communication.
I haven't found a clean way to have approvers/moderators, while allowing a few designated people to post or send meeting invites without requiring approval.
I also haven't found a good way to make Outlook meeting requests "required" from the sender side other than relying on attendees not changing their RSVP.

My questions

Is there a better Microsoft 365 architecture for this?
Should I be using a Dynamic Distribution List, a Microsoft 365 Group, a Mail-enabled Security Group, Teams, Viva Engage, or something else?
Is there a supported way to have dynamic membership + SharePoint + company email + moderated announcements/meeting invites all in one solution?
How do large organizations typically handle company-wide communications while keeping membership automatic?
Is maintaining two dynamic groups (one for collaboration and one for email) simply the recommended approach?

I'd love to hear how other Microsoft 365 admins have solved this in production. Thanks!

FraudThrottle Block SP/OD - 2+ Months Unresolved - Cases #2604230040009484, #2605260040000004

Azram7112 — Wed, 24 Jun 2026 14:23:14 GMT

Summary:

My organization's SharePoint and OneDrive access has been completely blocked for over 2 months due to a FraudThrottle flag. This is a production-blocking issue that standard SMB support has been unable to resolve despite two open support cases.

Details:

- SharePoint Online and OneDrive for Business are entirely inaccessible across the tenant

- No downloads, uploads, or sync operations work

- The block is caused by a FraudThrottle security flag triggered on our M365 E5 Developer trial subscription (purchased directly from Microsoft, not via CSP)

- Support has confirmed the FraudThrottle block but has been unable to escalate or resolve it

- The subscription status shows Active, but the FraudThrottle flag overrides access

Cases:

- Case #2604230040009484 (original)

- Case #2605260040000004 (follow-up)

What I Need:

Escalation to the FraudThrottle/Identity protection engineering team to review and clear the false-positive block on our tenant. Standard support tiers have exhausted their ability to resolve this.

Has anyone else experienced a similar FraudThrottle block on a dev/trial subscription? Any suggestions on how to expedite escalation to engineering?

Thank you.

Not For Profit Licence suddenly disappeared and then deleted

WRTAdmin — Wed, 17 Jun 2026 18:18:32 GMT

Hi All

Have a big issue. Have a not for profit account for our charity. Renewed licence earlier in the year and all was ok and working. Then a few days ago I had reports of not being able to access data. After much hunting I found the below. Seems account was suddenly and without warning disabled and then reported as deleted a few days later. What do I do? I desperately need to recover the files that were on the associated teams?

Any help would be much appreciated

Sole Admin Locked out of Microsoft tenant -- MFA Error 500121

briarcliffar — Wed, 17 Jun 2026 16:12:48 GMT

Sole Admin Locked out of Microsoft 365 Tenant- MFA Error 500121 using OTPKEY

Im the original administrator of a Microsoft 365 Business Basic tenant for the City of Briarcliff.

Tenant: briarcliffar.onmicrosoft.com

Admin Account:

email address removed for privacy reasons

I can succesfully enter the correct password, nut MFA verification fails with error code 500121.

I have original microsoft 365 setup email showing the admin account

The microsoft purchase receipt and Order ID.

Access to billing email account

Control of the cityofbriarcliff.gov domain through Cloudflare.

The tenant was never fully configured beyond the initial setup process. I was able to sign in originally and reached the Connect and Configure your domain page but did not complete deployment.

I need assisstance with recovery of the sole administrator account and MFA reset for tenant. I can provide provide proof of purchase, original setup email, billing information, and proof of control of cityofbriarcliff.gov

MCA billing account stuck in "under review" status for 4+ days, no resolution

LanceB1 — Sat, 13 Jun 2026 16:29:19 GMT

I'm the Global Admin for a Microsoft 365 tenant (domain: fortunamg.net) recently transitioned from a GoDaddy CSP reseller relationship to a direct Microsoft Customer Agreement (MCA) billing account.

After setting up the MCA billing account and adding a payment method, I attempted to make an edit to my billing account address (updating to the new 9-digit zip code format). This triggered an "Account under review" status, which states the review usually takes up to 2 days. It has now been over 4 days with no update or email notification.

This review is blocking me from purchasing a subscription, which I need to do to restore an active Microsoft 365 subscription on this tenant (currently showing as "Disabled" following the GoDaddy detach).

Billing Account ID: 7793dd6e-68c9-5362-c5e2-3fe091b9854c

Domain: fortunamg.net

Could someone help check the status of this review or escalate to the appropriate team? Phone support has been unable to resolve this. Thank you.

Is Office 365 E3 Developer free

JasonYeung — Tue, 02 Jun 2026 18:37:00 GMT

Hi,

My tenant had a license named "Office 365 E3 Developer" which allowed us to use Outlook / Exchange (among other Microsoft Office products). This license isn't from the Microsoft 365 Developer Program, which come with free licenses.

This license costed CA$11.60 a month per user when we initially purchased it. On May 2, 2026 it still costs $11.60, but when I received my monthly invoice for this tenant, this license was free.

I searched around to see whether this license became free recently, but I couldn't find any info on this. The links I found all say it's a paid license. I was wondering if there's any info on this to see why it became free? Or is it a mistake and Microsoft'll be charging us the next billing cycle?

Jason

Managing Two MSFT Licenses

catherinesjkim — Sun, 17 May 2026 14:16:07 GMT

Hi, I had an old hotmail.com email address but it doesn't exist anymore per MSFT. I purchased an annual Excel annual license several months ago but I can't find an email about it on my Gmail inbox. I just signed up for MSFT 365. How can I find the Excel license subscription so that it doesn't auto-renew?

Inherited group-based license service plan checkboxes are now editable but fail on save

Tom001 — Fri, 15 May 2026 08:59:07 GMT

Hello,

We are observing a possible UI regression in the Microsoft 365 admin center related to group-based licensing.

Environment / scenario:

- Microsoft 365 admin center

- User-level “Licenses and apps” screen

- The user receives the Microsoft 365 license through group-based licensing

- The source group is a Microsoft Entra dynamic security group

- The license and service plan settings are intended to be controlled at the group-based license assignment level

We understand that when a license is inherited from a group-based license assignment, the apps/services for that inherited license should not normally be changed directly at the individual user level. The service plan configuration should be managed at the group/license assignment level.

However, the current UI behaviour is confusing.

Observed behaviour:

1. Open a user in the Microsoft 365 admin center.

2. Go to the user’s “Licenses and apps” screen.

3. The user has a Microsoft 365 license inherited from a group-based license assignment.

4. Some app/service checkboxes appear to be enabled and editable.

5. An administrator can actually clear/uncheck those checkboxes.

6. However, when clicking OK/Save, the operation fails with an error.

In other words, the UI allows an administrator to make a change that cannot actually be committed.

The reason this looks like a regression is that the previous UI behaviour was different.

Previously, when a user’s Microsoft 365 license was inherited from a group-based license assignment, the relevant app/service checkboxes on the user-level “Licenses and apps” screen were greyed out or effectively read-only. Administrators could visually understand that those service plan settings could not be changed directly at the individual user level.

Recently, those same checkboxes appear to be active and editable. The administrator can uncheck them, but the change fails only after clicking OK/Save.

From an administrator UX perspective, this is confusing because the UI appears to allow an unsupported operation and only rejects it at save time.

Expected behaviour:

If service plan settings for an inherited group-based license cannot be changed at the individual user level, we would expect one of the following behaviours:

- The checkboxes should remain disabled/read-only from the beginning.

- The UI should clearly state that these apps/services are inherited from a group-based license assignment.

- The Save/OK button should be disabled for changes that cannot be applied.

- The UI should provide a link or guidance to manage the setting at the group-based license assignment level.

Questions:

1. Has anyone else observed this recent change in behaviour?

2. Was this UI change intentional?

3. Is this a known issue or known UX regression in the Microsoft 365 admin center?

4. Is there any scenario where these checkboxes are intentionally editable for a user who receives the license only through group-based licensing?

5. Does this behaviour differ depending on whether the source group is an assigned security group or a dynamic security group?

6. Is there any recommended administrator workflow when troubleshooting service plan settings for a user whose license is inherited from a group-based license assignment?

To clarify, this is not a question about how group-based licensing works. The concern is specifically about the UI behaviour where inherited license service plan checkboxes were previously greyed out, but now appear editable even though the change fails on save.

If this is not intentional, it would be helpful if the Microsoft 365 admin center could restore the previous read-only/greyed-out behaviour, or clearly explain in the UI why the change cannot be saved.

Thank you.

Why is Microsoft 365 setup (Groups + SharePoint + Domains) still so complex?

corkandclarity — Tue, 12 May 2026 07:40:16 GMT

Microsoft 365 Setup Feedback Summary

Summary of Experience:

Setting up two small business workspaces (Cork & Clarity and Stone Clarity Consulting) in Microsoft 365 required navigating multiple disconnected systems including the Admin Center, Outlook, SharePoint, and an external DNS provider. The process was significantly more complex than expected and not intuitive for a non-technical user.

Key Issues Encountered:

1. Identity and Account Confusion
- Unclear whether to create separate users or use one account with aliases
- Creating multiple users caused login confusion, broken permissions, and access issues

2. Domain and DNS Setup Complexity
- Required switching between Microsoft and external DNS (Looka)
- Instructions were unclear and required manual troubleshooting
- No clear distinction between required and optional DNS records

3. Default Domain Confusion
- New groups defaulted to the wrong domain
- No visible option to change domain during group creation
- Required changing global default domain (non-intuitive)

4. Inconsistent Group Behavior
- Outlook groups and Teams-backed groups behave differently
- No indication of differences or consequences
- Groups appeared in some places but not others

5. Membership and Ownership Issues
- Group creator was not consistently added as member
- Ownership did not always persist after changes
- Groups existed but were inaccessible or invisible

6. Outlook UI Limitations
- Groups not visible despite existing and being correctly configured
- No clear instructions on how to 'activate' or 'follow' groups

7. SharePoint Site Not Created Automatically
- SharePoint sites were not created when groups were created
- Required hidden steps: Outlook → Files → Open in SharePoint
- No indication that the site did not exist yet

8. SharePoint Discovery Issues
- Sites do not appear until manually accessed or followed
- No onboarding or guidance for discovering sites

9. Ghost/Deleted Items Still Visible
- Deleted group (Cork & Clarity Hub) remained visible
- No clear distinction between deleted vs followed sites

10. Fragmented User Experience
- Required switching between multiple platforms
- No single place to manage or understand setup status
- High cognitive load for basic configuration

Conclusion:

While Microsoft 365 is a powerful platform, the initial setup experience is overly complex and fragmented, especially for small businesses. Simplifying group creation, making SharePoint provisioning automatic and visible, and improving UI consistency across apps would significantly improve usability and adoption.

O365 Exchange connectors apply spam filters before checking certificate

IanMurphy48 — Thu, 30 Apr 2026 11:27:35 GMT

If you have devices like multifunction printers which need to send email the MS solution is to configure an inbound email connector.

You can use source IP to identify the origen of incoming messages and to associate them with the inbound connector. However the best way is to use a certificate in the TLS session.

So far so good. However theres a design problem. MS applies RBL filters seemingly before checking either the source IP or the certificate. If the IP appears in the list MS simply reject the connection.

The makes no sense as they are checking against the spamhaus general rbl. This RBL contains all dinamic IP ranges. I don't know for other countries but where I am even if you contract a fixed IP, the IP address they assign you is still in the dynamic IP range, its just fixed. This means that the reverse lookup on the IP address shows a name with dynamic in it. Spamhaus automatically include these in their RBL.

Most companies will have a normal fiber connection, with a fixed ip or not. Those fiber connections will almost always be included in a spamhaus rbl as they are not going to be running mail servers.

Thus checking the IP against the general spamhaus RBL makes no sense as it is going to automatically block almost everyone who would actually use an inbound mail connector.

Does anyone know how to communicate this situation to whoever controls this in MS?

Ian

MC1269241 - Can't turn off antropic for agentmode

Emiliabergstrom — Thu, 23 Apr 2026 23:25:06 GMT

Hi,

I’m trying to figure out how to turn off the new feature where Anthropic is enabled by default for everyone in the EU for agent mode in excel and powerpoint, as described in the Message Center news in the title.

It is not possible to press Save when you have unchecked the setting unless you also consent to the terms of use, it is greyed out. Since we want the feature turned off, we do not want to agree to any terms of use.

Has anyone found a solution? This seems to be misconfigured.

The Admin Center offers a uniquely retro approach to licensed group management

Kristin_L_365 — Mon, 13 Apr 2026 19:32:33 GMT

You can see the name of licensed groups from the licensing blade, but you can’t click it or copy the name. Instead, you manually retype it elsewhere—because nothing says “modern cloud platform” quite like a 1997‑era workflow.

Unable to remove Office Store applicaitons in admin center:

CGXD — Fri, 10 Apr 2026 10:52:56 GMT

Hi!

Yesterday I changed the settings in the screenshot below and it worked. It showed that IT blocked access when clicking on the Add-Ins button in Word and Excel. Today it shows the list off add ins and nothing was changed in the settings. Users can install add ins again:

Google shows results of an Org setting in M365 admin panel that doesn't exist anymore. Any help would be appreciated.

M365 only admin locked out MFA error 53003

techycap — Tue, 31 Mar 2026 20:47:41 GMT

I am learning this the hard way....so here it goes.

Currently I am locked out of as the only admin on the tenant with error 53003.

I was updating some Microsoft MFA default policy settings in Entra and mistakenly deleted the admin user from the exclusions list, and got locked out.

Thankfully I have another tenant, not as big the one locked out. Initiated several support tickets for which everyone calls, and despite of subline mentioning the issue says that they have to assign this ticket to Entra. Then the ticket gets updated and noone has been assigned every since. I have initiated severity A support tickets from Azure portal but no one has called in last 24 hours to help. We area business with Business Premium licenses with over 20 users, and now completely locked out.

I have looked almost everywhere online. There is no phone number that takes you to a support agent - PLEASE HELP........

Onedrive sharing not working for one user

Nutmegman28 — Tue, 17 Feb 2026 18:25:48 GMT

There is only one user who cannot share with anyone external or internal. I have checked everything, they are a site owner, a site admin, a site member, we have no restrictions on sharing, it works for others. I made a new site just for them as the only admin, they still cannot share. They have been removed and re-added 5 times. We have a microsoft support ticket and they don't even seem to know the issue. What can I do?