1.2. How Microsoft 365 Is Governed

💡 First Principle: Microsoft 365 governance works through two parallel systems — admin roles that control who can change configurations, and licenses that control which features users can access. Getting these wrong in either direction creates either security gaps or frustrated users.

Think of it as two separate keys: admin roles are the organizational key (who has authority to act), and licenses are the feature key (what capabilities are unlocked for a user). Both must match for a configuration to work.

⚠️ Common Misconception: Being a Global Admin doesn't give users access to premium features — that requires the right license assignment. Admin roles govern what you can configure, not what users can use.

This matters immediately: the exam tests both. You need to know which admin role touches which admin center, and you need to know what happens (and what doesn't happen automatically) when you assign a license.

Without clear governance, M365 environments drift. Someone gives the wrong person admin access. Users get licenses for features that aren't yet configured. Data sits unclassified and unprotected. Good governance starts with understanding these two levers.

⚠️ Common Misconception: Assigning a license to a group immediately gives all members full access to all features. This is wrong — license assignment grants entitlement, but some features require additional configuration (mailbox provisioning, sensitivity label policies, Copilot setup). The license is the first step, not the last.