Admin ownership and recovery
Confirm who can administer the tenant, and make sure there are at least two admin accounts with reliable recovery methods.
Christchurch
Microsoft 365 setup that removes access surprises
The fastest way to reduce we-cannot-log-in incidents is to make ownership and recovery boring: clear admin access, predictable MFA methods, and handover notes that survive staff changes.
What this covers
A practical setup baseline for small teams
This page focuses on the practical checks that keep day-to-day work moving: who owns the tenant, how recovery works when MFA fails, what email/DNS records exist, and what to document so the next change is boring.
Email and mailbox basics
Make mailbox aliases, forwarding rules, shared mailboxes, and signatures predictable and easy to hand over.
MFA methods that survive
Set MFA methods that will not break when someone loses a phone. Reduce single-person dependencies.
Teams and OneDrive basics
Set sensible group/SharePoint structure and a predictable way to share files without where-did-the-folder-go confusion.
DNS notes (SPF/DKIM/DMARC)
Record where the domain lives, where DNS is hosted, and which email records exist so mail deliverability is easier to maintain.
Handover notes
Document the control points (registrar, DNS host, admin accounts, billing owner) so you can change providers without drama.
Setup checks that prevent future lockouts
A Microsoft 365 tenant can look tidy on the surface while still depending on one phone, one browser session, or one person who knows where the domain is registered. A practical setup pass should confirm who owns the tenant, which accounts can recover access, and whether the business can still sign in if a device is lost, a staff member leaves, or the main mailbox is compromised.
The Christchurch setup focus is deliberately operational: make the admin path boring, make email records understandable, and make handover notes useful to the next person. That kind of setup is less glamorous than adding another app, but it prevents a lot of avoidable downtime.
Post-setup handover checks
- Confirm at least two admin accounts and document when each should be used.
- Record MFA methods, backup codes or recovery paths, and any device dependency that still exists.
- List the registrar, DNS host, Microsoft tenant, billing owner, and primary support contact.
- Check MX, SPF, DKIM, and DMARC status and note who can change those records.
- Confirm shared mailboxes, aliases, forwarding rules, Teams/SharePoint locations, and OneDrive sync expectations.
Setup order that avoids future lockouts
A clean Microsoft 365 setup should be built in an order that preserves access. Confirm the domain and admin accounts first, then add MFA methods, mail routing, shared mailboxes, Teams/SharePoint locations, and device onboarding. If the tenant is inherited from another provider, the first job is evidence and ownership rather than changing settings straight away.
1. Tenant and domain ownership
Record the tenant name, primary domain, registrar, DNS host, billing owner, and who can contact Microsoft or the reseller.
2. Admin and MFA baseline
Set at least two suitable admin paths, protect them with strong authentication, and avoid relying on one phone or one staff member.
3. Mail and sender setup
Confirm MX, SPF, DKIM, DMARC, mailbox aliases, shared mailboxes, and which systems send as the business domain.
4. Handover and review
Write the control points down, then review them after staff changes, phone replacements, domain changes, or provider moves.
Email and DNS setup decisions
Microsoft 365 setup often becomes DNS work. The setup note should show where inbound mail routes, which senders are authorized, whether DKIM is enabled, and how DMARC is being monitored or enforced. This avoids the common situation where a new CRM, website form, scanner, or accounting tool sends mail without being included in the authentication plan.
- Export the current DNS zone before adding Microsoft 365 records.
- Keep one SPF record and include only legitimate active senders.
- Record DKIM selector records and whether DKIM signing has been enabled in the platform.
- Start DMARC carefully and identify who receives and reviews DMARC reports.
- Link the handover to email deliverability support if spam/bounce issues appear after setup.
Teams, SharePoint, and OneDrive structure
File setup is where many small teams lose clarity. A predictable structure should separate personal OneDrive storage from team/shared files, make ownership visible, and avoid important work being trapped in one person's sync folder. The setup should also document what happens when staff join or leave.
Team files
Use Teams/SharePoint locations for shared work so files are not dependent on one person's personal OneDrive.
Sync expectations
Record what should sync to devices, what should stay cloud-only, and how to spot sync errors before files go missing.
Permissions
Keep group membership and access rules understandable so a future admin can add or remove users safely.
Offboarding
Document how mailbox, OneDrive, Teams, and device access will be handled when someone leaves.
First-week verification checklist
A Microsoft 365 setup is not complete when the first mailbox sends mail. It is complete when access, recovery, mail flow, shared files, and handover notes have been tested under normal work conditions.
- Test admin sign-in and backup admin sign-in without relying on a single device.
- Send and receive mail internally and externally, then check spam/bounce symptoms.
- Confirm mailbox aliases, shared mailboxes, signatures, forwarding rules, and calendar sharing.
- Confirm Teams/SharePoint/OneDrive file locations and sync behavior on the intended devices.
- Keep the setup note somewhere the business controls, not only in one technician's inbox.
Post-setup loop
Keep Microsoft 365 setup from becoming another forgotten handover
A clean setup should leave a path for remote support, recurring checks, DNS/email ownership, and future provider handover. These routes help keep the tenant understandable after the first week.
Remote IT support NZ
Use remote support when the next step is access triage, screenshots, reversible changes, and a provider-ready handover note.
Domains, DNS, and email reading path
Use this topic path when setup work crosses registrar access, nameservers, MX/TXT records, SPF, DKIM, DMARC, or rollback planning.
SME maintenance calendar
Use the calendar to schedule MFA, backup admin, mailbox, DNS, domain renewal, and profile accuracy checks after setup.
Tools hub
Use the tools hub when setup notes need a reusable checklist, recurring operating habit, or future handover guardrail.
SME tech checklist
Use the broader checklist when Microsoft 365 setup touches websites, email, phones, backups, devices, domains, and provider ownership.
Backup and migration
Use the backup path when setup depends on OneDrive state, old devices, mailbox data, replacement laptops, or file handover.
Services hub
Use the services hub when Microsoft 365 setup touches websites, devices, email deliverability, DNS/routing, networking, or migration work.
Microsoft 365 support NZ
Use the support page when the setup baseline turns into sign-in recovery, mailbox troubleshooting, MFA reset, or tenant admin recovery work.
Related pages
Checklists and support context
These links connect Microsoft 365 setup to DNS ownership, deliverability, and incident-response basics.
Microsoft 365 support NZ
Remote-friendly checks for sign-in recovery, mailbox basics, and DNS notes.
Microsoft 365 checklist
Tenant basics, identity redundancy, mailbox hygiene, and handover notes for small teams.
IT support and Microsoft 365 reading path
A broader sequence for admin access, MFA, mailbox setup, remote support, and handover notes.
Email deliverability support NZ
SPF/DKIM/DMARC checks and DNS control points.
DNS and routing support
Nameserver, TTL, DNS propagation, reachability, and rollback context for domain changes.
Email security and recovery reading path
Use this when setup work involves recovery methods, compromised mailbox risk, MFA, or account lockout planning.
DNS and email checklist
A practical guide to registrar ownership, DNS, routing, and rollback planning.
Email hacked checklist
A calm first-day checklist: contain the mailbox, remove forwarding/rules, and prevent repeat incidents.
SME tech checklist
A broader checklist for websites, domain email, Microsoft 365, phones, backups, and support documentation.
Backup and migration
Restore-first planning when files, OneDrive, mailbox data, or replacement-device handover matters.
Christchurch IT support
General onsite support for accounts, devices, and handover notes.
Context links: About John Finnerty, selected project notes, John Finnerty Christchurch, and John Finnerty New Zealand.
Official references
Microsoft setup references worth checking
These references support the setup flow on this page: protect administrator access, configure MFA carefully, add domain DNS records deliberately, and keep SharePoint/OneDrive file ownership clear.
Emergency access admin accounts
Microsoft Entra guidance for protected emergency access accounts.
Set up multifactor authentication
Microsoft 365 admin guidance for MFA setup and verification methods.
Create DNS records for Microsoft 365
Microsoft domain setup guidance for adding DNS records through a DNS host.
SPF for Microsoft 365 domains
Microsoft guidance on SPF records and why SPF alone is not complete anti-spoofing protection.
OneDrive or SharePoint?
Microsoft guidance for deciding whether files belong in personal OneDrive or shared SharePoint/Teams locations.
FAQ
Microsoft 365 setup questions
A good setup leaves the next administrator with clear ownership, recovery, and DNS notes.
What should be documented after Microsoft 365 setup?
Document tenant admin accounts, backup admin access, MFA methods, registrar, DNS host, billing owner, key mailboxes, shared mailboxes, and recovery contacts.
Why should a small team have more than one admin account?
A second admin account reduces the chance of a lockout when a phone is lost, a staff member leaves, MFA fails, or the main account is compromised.
How does DNS fit into Microsoft 365 setup?
DNS controls mail routing and authentication records such as MX, SPF, DKIM, and DMARC, so the registrar and DNS host should be recorded before changes are made.
Need a clean starting point?
If you can share which domain you use and whether you can access admin accounts, I can usually outline the next steps quickly.