Microsoft 365 Business Premium Setup Guide for SMBs: A SkyCore Solutions Implementation

Step 1: Acquire Your Subscription and Access the Admin Center

The first step in your cloud migration journey is securing your Microsoft 365 Business Premium subscription. While the initial purchase is a web-based process, accessing the administrative portals is crucial for all subsequent configurations.

Portal alternative: Navigate to the Microsoft 365 Business Premium product page to purchase your subscription. Once purchased, you will receive an email with instructions to access the Microsoft 365 admin center at admin.microsoft.com. Sign in with the administrative credentials created during the sign-up process. Familiarize yourself with the dashboard; this will be your primary graphical interface.

Step 2: Connect PowerShell to Microsoft 365 Services

For efficient and scriptable management, especially for tasks involving many users or repetitive actions, PowerShell is indispensable. We recommend using the modern Microsoft Graph PowerShell SDK and the MSOnline module for some tenant-level configurations.

# Install required modules (if not already installed)
Install-Module -Name Microsoft.Graph -Scope CurrentUser -Force
Install-Module -Name MSOnline -Scope CurrentUser -Force

# Connect to Microsoft Graph
Connect-MgGraph -Scopes "User.Read.All", "Domain.ReadWrite.All", "Policy.ReadWrite.ConditionalAccess", "DeviceManagementManagedDevices.ReadWrite.All", "DeviceManagementApps.ReadWrite.All", "Group.ReadWrite.All", "Directory.ReadWrite.All", "Application.ReadWrite.All"

# Connect to MSOnline (Azure AD PowerShell - legacy but still useful)
Connect-MsolService

• Install-Module Microsoft.Graph: Installs the primary module for interacting with the Microsoft Graph API.
• Install-Module MSOnline: Installs the legacy module for Azure Active Directory management.
• Connect-MgGraph -Scopes "...": Establishes a connection to Microsoft Graph, requesting specific permissions (scopes) needed for tenant, user, domain, and device management. Always connect with the least privilege required.
• Connect-MsolService: Establishes a connection to the MSOnline service using your global administrator credentials.

Portal alternative: While not a direct portal alternative for connecting PowerShell, you can verify your administrative access by logging into admin.microsoft.com and confirming you see all administrative options.

Run this to verify:

# Verify Graph connection by listing tenant domains
Get-MgDomain

# Verify MSOnline connection by listing tenant domains
Get-MsolDomain

Step 3: Add and Verify Your Custom Domain

Integrating your organization's custom domain (e.g., skycore.com) is fundamental. This allows your users to have professional email addresses (user@skycore.com) and utilize Microsoft 365 services under your brand identity.

# Define your custom domain
$DomainName = "yourcompany.com"

# Add the domain to Microsoft 365 using MSOnline
New-MsolDomain -Name $DomainName

# Get DNS verification records (TXT record) required by Microsoft 365
Get-MsolDomainVerificationDNS -DomainName $DomainName -Mode DnsTxtRecord

• $DomainName = "yourcompany.com": Replace "yourcompany.com" with your actual domain name.
• New-MsolDomain: Initiates the process of adding your domain to Microsoft 365.
• Get-MsolDomainVerificationDNS: Retrieves the specific DNS TXT record value you need to add to your domain registrar's DNS settings. This record proves ownership.

Once you have the TXT record value, log into your domain registrar's portal (e.g., GoDaddy, Namecheap, Cloudflare) and add this TXT record to your domain's DNS settings. After the record propagates (which can take minutes to hours), return to PowerShell to complete the verification.

# Once TXT record is propagated at your registrar, run this to verify
Confirm-MsolDomain -DomainName $DomainName

Portal alternative: In the Microsoft 365 admin center (admin.microsoft.com), navigate to Settings > Domains. Click Add domain, enter your domain name, and follow the wizard to add the required TXT record to your domain registrar's DNS. Once the TXT record is added and propagated, click Verify in the admin center.

Run this to verify:

# Check the status of your domain after verification
Get-MsolDomain -DomainName $DomainName | Select-Object Name, Status, IsVerified

Step 4: Create User Accounts and Assign Licenses

Populating your tenant with user accounts is crucial. Microsoft 365 Business Premium includes licenses for each user, providing access to Exchange Online, SharePoint, OneDrive, Microsoft Teams, and desktop applications.

# Define user details and the UPN suffix (your verified domain)
$FirstName = "Jane"
$LastName = "Doe"
$DisplayName = "Jane Doe"
$UserPrincipalName = "jane.doe@yourcompany.com" # Ensure this uses your verified domain
$UsageLocation = "CA" # Two-letter country code (e.g., US, CA, UK)
$LicenseSkuId = (Get-MsolAccountSku | Where-Object {$_.SkuPartNumber -eq "SMB_BUSPREM"}).AccountSkuId # Get the SKU ID for Business Premium

# Create a new user account using Microsoft Graph PowerShell
New-MgUser -DisplayName $DisplayName -GivenName $FirstName -Surname $LastName -UserPrincipalName $UserPrincipalName -MailNickname ($FirstName + $LastName) -UsageLocation $UsageLocation -PasswordProfile @{ ForceChangePasswordNextSignIn = $true; Password = (ConvertTo-SecureString -String "InitialPassw0rd!" -AsPlainText -Force) }

# Find the new user object
$User = Get-MgUser -UserId $UserPrincipalName

# Assign the Microsoft 365 Business Premium license
Set-MsolUserLicense -UserPrincipalName $UserPrincipalName -AddLicenses $LicenseSkuId

• $UserPrincipalName: This should match the email address you want for the user on your custom domain.
• $UsageLocation: Required for license assignment; specifies the user's country/region.
• $LicenseSkuId: Automatically retrieves the SKU ID for Microsoft 365 Business Premium. This ensures the correct license is assigned.
• New-MgUser: Creates a new user in Azure AD. We recommend forcing a password change on first sign-in for security.
• Set-MsolUserLicense: Assigns the specified license to the user.

Portal alternative: In the Microsoft 365 admin center (admin.microsoft.com), navigate to Users > Active users. Click Add a user, fill in the user details, ensure the correct domain is selected, and assign the Microsoft 365 Business Premium license during the wizard. You can also bulk add users from a CSV file.

Run this to verify:

# List all users and their assigned licenses
Get-MsolUser -All | Select-Object DisplayName, UserPrincipalName, @{N="Licenses";E={($_.Licenses.AccountSkuId | ForEach-Object {(Get-MsolAccountSku | Where-Object {$_.AccountSkuId -eq $_}).SkuPartNumber}) -join ", "}}

Step 5: Configure Multi-Factor Authentication (MFA) and Security Defaults

MFA is the single most effective way to prevent identity compromise. Microsoft 365 Business Premium includes Azure AD Premium P1, which allows for advanced Conditional Access policies. For SMBs, enabling Security Defaults is an excellent starting point.

# Microsoft recommends using Conditional Access for more granular control.
# However, for quick setup, Security Defaults offer a strong baseline.
# Security Defaults can only be enabled/disabled via the portal or Microsoft Graph API, not MSOnline.

# To check if Security Defaults are enabled via Graph (requires specific permission)
# Connect-MgGraph -Scopes "Policy.Read.All"
# Get-MgPolicyIdentitySecurityDefaultEnforcementPolicy

# If you need to enable it via PowerShell (advanced, usually done via portal for initial setup)
# (This is illustrative; direct PowerShell for this requires Graph API calls with specific JSON payloads)
# $Body = @{
#    IsEnabled = $true
# }
# Invoke-MgGraphRequest -Method PATCH -Uri "https://graph.microsoft.com/v1.0/policies/identitySecurityDefaultsEnforcementPolicy" -Body (ConvertTo-Json $Body)

• Security Defaults enforce MFA for all users/admins, block legacy authentication, and require MFA for privileged activities.
• While direct enablement via simple PowerShell for Security Defaults is complex due to Graph API interaction, it's best handled in the portal for initial setup.

Portal alternative: In the Microsoft 365 admin center (admin.microsoft.com), navigate to Show all > Azure Active Directory. This will open the Azure AD admin center. In the left navigation, go to Azure Active Directory > Properties. Scroll down and click Manage Security defaults. Toggle Enable Security defaults to Yes and save. This immediately enforces MFA for all users upon their next sign-in, requiring them to register a method like the Microsoft Authenticator app.

Run this to verify (Conditional Access policy example for granular control):

# This example creates a Conditional Access policy to require MFA for all users
# Make sure to exclude a break-glass account from all CA policies.

Connect-MgGraph -Scopes "Policy.ReadWrite.ConditionalAccess"

# Create Conditional Access policy
$Users = @{ Include = @("All") }
$Conditions = @{
    ClientAppTypes = @("all")
    SignInRiskLevels = @("none") # You can add Low, Medium, High if you have Azure AD Identity Protection
}
$GrantControls = @{
    Operator = "OR"
    BuiltInControls = @("mfa")
}
$Policy = @{
    DisplayName = "Require MFA for All Users"
    State = "EnabledForReportingOnly" # Start with "EnabledForReportingOnly" or "Disabled" to test
    Conditions = $Conditions
    GrantControls = $GrantControls
    Targets = @{ Users = $Users }
}

New-MgIdentityConditionalAccessPolicy -BodyParameter $Policy

• State = "EnabledForReportingOnly": Crucial for testing. This allows you to see the impact of the policy without enforcing it, preventing lockout. Once confident, change to "Enabled".

Step 6: Deploy Microsoft Defender for Business

Microsoft Defender for Business, included with Microsoft 365 Business Premium, provides enterprise-grade endpoint security tailored for SMBs. It's designed to protect devices from advanced threats and provides automated investigation and response capabilities.

# While direct PowerShell for initial Defender for Business onboarding is complex and often GUI-driven,
# you can use PowerShell to enroll devices into Intune, which then facilitates Defender deployment.

# Example: Setting up a Windows device enrollment profile in Intune (via Graph API)
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.ReadWrite.All"

# Create a new enrollment profile (simplified example for AutoPilot or direct enrollment)
# This is a high-level conceptual example, actual JSON payload for Graph API is extensive.
$EnrollmentProfile = @{
    displayName = "SkyCore Solutions - Windows Enrollment Profile"
    description = "Profile for Windows AutoPilot enrollment"
    enrollmentType = "windowsAutopilot"
    # ... more complex properties like OOBE settings, etc.
}
# New-MgDeviceManagementWindowsAutopilotDeploymentProfile -BodyParameter $EnrollmentProfile

• Initial setup of Defender for Business is primarily done through the Microsoft 365 Defender portal.
• Device enrollment (covered in Step 7) is a prerequisite for Defender for Business to protect endpoints.

Portal alternative: Navigate to the Microsoft 365 admin center (admin.microsoft.com), and under Setup, select Go to Microsoft Defender. This will redirect you to security.microsoft.com. Follow the guided setup to onboard your devices. For Windows devices, this typically involves either a group policy deployment script, Microsoft Intune (recommended for M365 BP), or manual installation. Microsoft recommends leveraging Intune for seamless deployment.

Run this to verify:

In the Microsoft 365 Defender portal (security.microsoft.com), go to Assets > Devices. After enrolling devices (see Step 7), they should appear here with a health status. Also, review Configuration management > Device configuration to ensure Defender policies are deployed.

Step 7: Set Up Basic Device Management with Microsoft Intune

Intune, also part of Microsoft 365 Business Premium, allows you to manage and secure devices across various platforms. For SMBs, focus on essential policies like compliance, Windows Update rings, and basic app deployment.

# For creating Intune device compliance policies using Graph PowerShell
Connect-MgGraph -Scopes "DeviceManagementManagedDevices.ReadWrite.All", "DeviceManagementApps.ReadWrite.All", "DeviceManagementConfiguration.ReadWrite.All"

# Example: Create a simple Windows compliance policy (requires complex JSON structure for Graph)
# This is a conceptual example for illustration purposes.
$CompliancePolicyBody = @{
    displayName = "SkyCore Solutions - Windows Basic Compliance"
    description = "Ensures basic security for Windows devices"
    platform = "windows10AndLater"
    settings = @(
        @{ settingName = "osMinimumVersion"; value = "10.0.19041" }, # Minimum Windows 10 version
        @{ settingName = "passwordRequired"; value = $true },
        @{ settingName = "encryptionRequired"; value = $true }
    )
    # ... more properties like assignment to groups
}
# New-MgDeviceManagementDeviceCompliancePolicy -BodyParameter $CompliancePolicyBody

• Initial Intune setup and policy creation via PowerShell can be quite verbose due to the complexity of the Graph API payloads.
• The portal is often more practical for SMBs to define these policies.

Portal alternative: From the Microsoft 365 admin center, navigate to Show all > Endpoint Manager. This opens the Microsoft Intune admin center (endpoint.microsoft.com). Go to Devices > Enroll devices and set up enrollment options (e.g., Windows enrollment for AutoPilot or manual MDM enrollment). Then, go to Devices > Compliance policies and create a new policy, for example, to require BitLocker encryption and a minimum OS version for Windows devices. Assign this policy to your user groups.

Run this to verify:

In the Microsoft Intune admin center (endpoint.microsoft.com), go to Devices > All devices to see enrolled devices. Navigate to Devices > Compliance policies and review the reporting for your deployed policies to ensure devices are compliant.

Step 8: Implement Data Loss Prevention (DLP) Policies

Data Loss Prevention (DLP) policies, managed within the Microsoft Purview Compliance Portal, help protect sensitive information like client data, financial records, or intellectual property from being accidentally or intentionally shared outside your organization. This is a key security feature of Microsoft 365 Business Premium.

# Connect to the Security & Compliance Center PowerShell
Connect-IPPSSession -UserPrincipalName "admin@yourcompany.com"

# Example: Create a basic DLP policy to detect and block sharing of credit card numbers to external users
# This is a simplified example. Real DLP policies can be much more complex.
New-DlpComplianceRule -Name "SkyCore Solutions - Block Credit Card Sharing External"
-Policy "SkyCore Solutions DLP Policy"
-ContentContainsSensitiveInformation @(@{Name="Credit Card Number"})
-AccessScope "ExternalUsers"
-BlockAccess $true
-RuleErrorAction "Stop"
-Disabled $false

• Connect-IPPSSession: Establishes a connection to the Microsoft Purview Compliance PowerShell module.
• New-DlpComplianceRule: Creates a new DLP rule.
• -ContentContainsSensitiveInformation: Specifies the sensitive information types (SITs) to detect.
• -AccessScope "ExternalUsers": Defines who the policy applies to when sharing externally.
• -BlockAccess $true: Configures the policy to block the sharing action.

Portal alternative: Navigate to the Microsoft 365 admin center (admin.microsoft.com), then Show all > Compliance. This will open the Microsoft Purview Compliance Portal (compliance.microsoft.com). In the left navigation, go to Data loss prevention > Policies. Click Create policy, choose a category (e.g., Financial), select a template (e.g., US Financial Data), and customize the rules for your organization. You can choose to audit first, then block.

Run this to verify:

In the Microsoft Purview Compliance Portal (compliance.microsoft.com), go to Data loss prevention > Alerts and Data loss prevention > Reports to monitor policy matches and incidents. Test the policy by attempting to share sensitive data to an external recipient.

Step 9: Migrate Existing Email and File Data

Migrating existing data is often the most time-consuming part of a cloud migration. Microsoft 365 offers various tools for email (Exchange Online) and file (SharePoint/OneDrive) migration.

# For Exchange migrations, you typically use New-MigrationBatch for cutover, staged, or hybrid scenarios.
# This requires elevated permissions and configuration of migration endpoints.

# Example for a simple PST import (often used for smaller mailboxes)
# First, set up the Azure AzCopy tool and secure storage for PSTs.
# Then use the Import-RecipientDataProperty -Identity "user@yourcompany.com" -PSTFile "C:\path\to\user.pst" cmdlets
# (Note: This is an oversimplification; PST import is a multi-step process involving Azure storage and Import service.)

# For file migration to SharePoint/OneDrive, the SharePoint Migration Tool (SPMT) is GUI-based.
# PowerShell can be used for advanced SharePoint management but not direct migration of files from local shares.
Connect-PnPOnline -Url "https://yourcompany.sharepoint.com/sites/yourteam" -Interactive
# Example: Create a SharePoint document library
# New-PnPList -Title "Company Documents" -Template DocumentLibrary

• Email migration can be performed via cutover migration (for <2000 mailboxes), staged migration (for larger POP/IMAP accounts), or hybrid migration (for Exchange on-premises).
• File migration to SharePoint and OneDrive often uses tools like the SharePoint Migration Tool (SPMT) or Mover.io (acquired by Microsoft).

Portal alternative: For email, in the Exchange admin center (admin.exchange.microsoft.com), navigate to Migration > New migration batch and follow the wizard for your specific migration type. For files, download and use the SharePoint Migration Tool (SPMT) to migrate files from network shares or local drives to SharePoint Online and OneDrive for Business. Alternatively, use Mover.io for cloud-to-cloud migrations.

Run this to verify:

Have users log into Outlook Web App (OWA) and their desktop Outlook client to confirm email access. Verify file migration by having users access their OneDrive and SharePoint sites to ensure all documents are present and accessible.

Step 10: User Onboarding and Ongoing Maintenance

A successful setup extends beyond technical configuration. Proper user onboarding and establishing ongoing maintenance routines are critical for long-term success and security.

# Example: Remind users to reset their passwords (if forced on first login)
# This script would query users who haven't logged in yet or still have initial passwords.
# Get-MsolUser -All | Where-Object {$_.StrongPasswordRequired -eq $true -and $_.LastPasswordChangeTimestamp -eq $null} | Select-Object UserPrincipalName, DisplayName

# Example: Automate reporting of license usage
Get-MsolAccountSku | Select-Object SkuPartNumber, ActiveUnits, ConsumedUnits, WarningUnits, SuspendedUnits

• User training ensures adoption and minimizes support calls.
• Regular monitoring of security alerts and license usage maintains a healthy tenant.

Portal alternative: In the Microsoft 365 admin center, review Reports > Usage to monitor adoption of services like Exchange, SharePoint, and Teams. Periodically check the Microsoft 365 Defender portal for active incidents and alerts. Communicate effectively with your users about new features, security best practices (like phishing awareness), and how to get support.

Run this to verify:

Conduct a user survey or hold a Q&A session to gather feedback on the new environment. Regularly check your admin centers for any service health advisories or security recommendations.