Upon visiting the Microsoft 365 Dev Center, it will ask you to sign in with your Microsoft account.
This will be the Microsoft account that your developer tenant will be associated with, but not the one you use to log into it.
You should see something like this 👇
So we simply fill out a few forms that let Microsoft know what we intend to do.
Please do not abuse this or use it for business purposes.
I build automation scripts, test SSO like SAML/OIDC with various apps, and build documentation for sharing with others for learning.
And just like that, we now have our own M365 Developer account where we can set up our E5 subscription!
So the next step is to click the big blue "Set up E5 subscription" button and follow the wizard.
Note: Microsoft has a really bad password limitation on sign up, so use a crappy one and change it once you've logged in
2nd note: Kudos to MS on requiring MFA, even if it is SMS :)
You should now see 92 days or so (I did this a bit ago) remaining on the subscription, and you can renew this over and over as long as you are using it appropriately.
While you are here, you can definitely add their sample data packs which might be helpful to learn with :)
Next thing we can do is log into the Azure Portal by going to portal.azure.com
Click the hamburger menu icon (that's what we're calling it, right?), and click Azure Active Directory.
You should now see that you are a Global Admin with Azure AD Premium P2
Feel the power!
So you now have a dev tenant that you can just look around and play in.
Check out Azure AD, poke around, create users, groups, etc.
I have an AD lab that I will be connecting to this, and I'll be creating threads in the near future on setting up everything we can in M365.
If you have specific things you want to see, let me know
Plan is Azure AD first (Roles/PIM, Apps/SP's/SSO, Conditional Access, Users, Groups, AUs, etc), then Exchange/SharePoint/ConfigMgr migration stuff, and finally set up the full Defender/MCAS suite
Bedtime for now though :)
Many people asked about renewals, so I'm tossing a little update on here
I've logged into this tenant about 40 times in the last 90 days and played around with various settings, and I added my GitHub to my dev account with a few dozen commits.
That was all it needed to renew 👇
• • •
Missing some Tweet in this thread? You can try to
force a refresh
I think the most common misunderstanding of Conditional Access is its relationship to authentication, and this results in not understanding how the rest of the controls actually work
Conditional Access performs authorization by evaluating tokens from the authentication service
This provides important insights 💡
CA policies cannot block anything until AFTER authentication occurs
This means CA cannot help with password spray/credential stuffing. This is why we have Password Protection and Smart Lockout.
You likely aren't collecting all available events to the Unified Audit Log
First, not all events are enabled or retained optimally. Consider creating this policy in the Purview portal (leave users and record types blank to collect everything).
Retention is based on license...
This policy only applies to users with the Microsoft 365 Advanced Audit SKU assigned, audit records are retained for 1 year. Audit records for users without this SKU are retained for 180 days (thanks CISA for the bump up from 90 days!)
Second, this still doesn't get everything..
Next we have to enable all the records for mailbox auditing
But wait, Microsoft totally pinky promises that you don't need to manage these records because they enable them for you
So we create a security group named "Salesforce Admins" and add our admins to the group
Then we configure the claims rule in our Identity Provider to send the role value of System Administrator for members of a group with the display name of "Salesforce Admin" 🚩
Unfortunately, display names are almost never unique, so anyone that can create or modify a group to match the display name can now add admins by adding them to this group
In Entra, ANYONE can create a group by default or owners of groups can modify them, no admin roles needed