The central web portal at admin.microsoft.com where admins manage users, groups, domains, licenses, billing, and organization-wide settings for a Microsoft 365 tenant.
The Microsoft 365 admin center (admin.microsoft.com) is the primary web-based management portal for a tenant, covering user and group management, license assignment, domain verification, billing, and org-wide settings. Global administrators and delegated roles such as User Administrator or License Administrator handle day-to-day operations here. A key exam distinction is that this portal manages tenant-level concerns, while deeper workload configuration—mailbox policies, SharePoint quotas, Teams meeting settings, or compliance—requires the appropriate specialized admin center (Exchange, SharePoint, Teams, or Purview). Knowing which tasks belong where is a common AB-900 test point.
The admin portal used to manage Exchange Online email objects such as user mailboxes, shared mailboxes, distribution lists, and mail flow rules.
The Exchange admin center (EAC) is the dedicated web portal for managing Exchange Online mail objects: user mailboxes, shared mailboxes, resource mailboxes (rooms and equipment), distribution groups, mail-enabled security groups, and mail flow rules (transport rules). Administrators reach it at admin.exchange.microsoft.com or through a link in the Microsoft 365 admin center. The key exam distinction is scope: the Microsoft 365 admin center handles user accounts and license assignments, while the EAC handles mail-specific configuration such as mailbox delegation and detailed mail flow. Both portals are role-scoped views of the same tenant.
The admin portal for managing SharePoint in Microsoft 365, including sites, document libraries, folders, sharing settings, site roles and permissions, and data access governance reports.
Each Teams team and Microsoft 365 group is backed by a SharePoint site for its files; when a site is connected to that group, the group’s owners and members are automatically mapped to the site’s Owners and Members groups, so grant access to the group rather than to individual users.
The admin portal used to manage Microsoft Teams objects such as teams, channels, and the policies that control messaging, meetings, and app behavior.
The Microsoft Teams admin center (admin.teams.microsoft.com) is the dedicated portal where administrators create and manage teams, configure channels, and apply messaging, meeting, calling, and app permission policies to users or groups. It is separate from the Microsoft 365 admin center, which handles licensing and user accounts but lacks Teams-specific policy controls. A key exam distinction is that policies here are assigned per-user or per-group and override tenant defaults, while app permission policies control which third-party and Microsoft-published apps users can install. Group governance settings such as expiration and naming policies are configured in Microsoft Entra ID.
Microsoft 365 licenses are assigned to users either directly or through group-based licensing, and the license determines which services and features a user can access.
Microsoft 365 licenses use two assignment models: direct assignment, where an admin manually assigns a license to an individual user in the Microsoft 365 admin center, and group-based licensing, where Microsoft Entra ID (formerly Azure AD) automatically licenses every member of a security or Microsoft 365 group. Group-based licensing scales better in larger organizations by tying access to membership. A license is a prerequisite, not just billing: Microsoft 365 Copilot is a separate add-on assigned on top of a qualifying base plan such as E3 or E5. Removing the license or group membership revokes the associated feature access.
Users are individual identities in Microsoft Entra ID, and groups are collections of users used to assign licenses, permissions, and policies at scale.
In Microsoft 365, every identity lives in Microsoft Entra ID (formerly Azure Active Directory). A user object represents one person’s credentials, license assignments, and sign-in settings. Groups collect users so licenses, app permissions, and Conditional Access policies apply once to many people instead of one at a time. The exam-critical distinction is between group types: a security group controls access to resources and supports group-based licensing, while a Microsoft 365 group provisions a shared mailbox, calendar, SharePoint site, and Teams workspace together. Distribution groups are email-only and cannot grant license or resource access.
Microsoft Entra is Microsoft's cloud identity and access management product family, with Microsoft Entra ID providing directory, authentication, and authorization services for Microsoft 365.
Microsoft Entra is Microsoft’s unified identity and access management product family. Its core component, Microsoft Entra ID — formerly Azure Active Directory — is the identity backbone for Microsoft 365, issuing authentication tokens, enforcing Conditional Access policies, and providing single sign-on to connected applications. For AB-900, note that Entra ID is the directory and identity provider, while the Microsoft 365 and Microsoft Entra admin centers are separate, role-scoped management surfaces. Controlling which users or groups can reach Copilot and agent capabilities depends on Entra ID groups and license assignments, making this relationship essential to understand.