How to Set Up Your Microsoft Entra Tenant the Right Way

Microsoft Entra ID (formerly Azure Active Directory) is the foundation of identity, access, and security in every Microsoft 365 environment. A poorly configured tenant can cause login issues, inconsistent branding, and security gaps that take days to fix.

Getting your Microsoft Entra tenant right from day one means fewer surprises down the line. This guide walks through how to set it up properly, using Microsoft Entra Admin Centre, configuring custom domains, applying company branding, and fine-tuning tenant-wide settings for a clean, secure start.

Never miss an article and subscribe

What Exactly Is Microsoft Entra ID?

If you’ve worked with Microsoft 365 before, you’ll already know it needs an identity platform behind it. That’s where Microsoft Entra ID (previously known as Azure Active Directory) fits in.

Your Entra tenant is your organisation’s identity hub. A space that contains all users, groups, and applications. It separates your company’s data from everyone else’s, while providing authentication and access controls for everything from Teams and SharePoint to Intune and Defender.

When people talk about “signing into Microsoft 365,” they’re really signing into Entra ID. It’s the invisible glue that ties your devices, apps, and permissions together.

Pick the Right Tenant Type Before You Begin

When setting up your Microsoft 365 tenant, you’ll be asked to choose a plan. The plan determines which Entra ID features you can use.

Tenant Type	Ideal For
Microsoft 365 Business	Small to mid-sized organisations (up to 300 users).
Microsoft 365 Enterprise (E3/E5)	Large environments needing full security, compliance, and automation.
Microsoft 365 Education (A1/A3/A5)	Schools and colleges, integrating with Intune for Education.
Microsoft 365 Government (GCC)	US government organisations and contractors.

For most testing or training scenarios, especially if you’re studying for the SC-300 exam or similar, the Microsoft 365 E5 Developer Tenant is the best option. It’s free, renewable, and includes Microsoft Entra ID P2, giving you access to advanced features such as Conditional Access, Identity Protection, and Privileged Identity Management.

When naming your tenant, keep it professional. A name like techbitslab.onmicrosoft.com works better than something personal. You’ll see that name often in Microsoft Entra Admin Center, so it’s worth choosing carefully.

Create Your Tenant in Microsoft 365

Here’s the basic process for provisioning your tenant:

1. Go to Microsoft 365 Enterprise and start a trial or developer subscription.
2. Fill in your organisation details and verify with a phone number.
3. Choose a unique tenant name — this becomes your .onmicrosoft.com domain.
4. Add payment information if requested (you won’t be charged for trials if cancelled in time).
5. Once confirmed, sign in at https://admin.microsoft.com to reach the Microsoft Entra Admin Centre.

Your tenant is now provisioned. It’s blank for now — think of it as a secure shell waiting to be configured.

Add and Verify a Custom Domain

You could stick with the default .onmicrosoft.com domain, but it looks unprofessional and confuses users. Adding your own domain (for example, @controlaltdeletetechbits.co.uk) gives a trusted, branded sign-in.

To add a domain in Microsoft Entra Admin Centre:

1. Go to Settings > Domains in the Microsoft 365 admin portal.
2. Choose Add domain and enter your custom domain name.
3. Microsoft will provide a TXT record to verify ownership. Either:
   • Sign in to your registrar through Domain Connect, or
   • Add the TXT record manually in your DNS zone.
4. Once verified, select Add DNS records automatically so Microsoft can configure mail, Teams, and Intune entries.
5. Set your new domain as the default and create a test user to confirm sign-in works.

If you’re using an on-premises mail system, skip automatic MX record configuration and update those manually to avoid routing conflicts.

Customise Sign-In Branding

Branding your sign-in pages in Entra Microsoft builds trust and reduces phishing risk. Users are more confident entering their credentials when the page looks familiar.

1. Visit https://entra.microsoft.com.
2. Navigate to Entra ID > Company Branding.
3. Edit the Default sign-in experience.
4. Upload your organisation’s:
   • Banner logo (280 × 60 px PNG)
   • Background image (1920 × 1080 px)
   • Square logo (240 × 240 px)
5. Choose a consistent colour theme, for instance, Control Alt Delete Tech Bits uses #007FFF.
6. Add contact details and a short support message so users know how to reach IT if they’re locked out.

You can also create multiple branding profiles, ideal if your company runs several domains or operates in different regions.

Configure Tenant-Wide Settings

Once your branding looks right, it’s time to review the settings that control how your Microsoft Entra tenant behaves across the board.

a) Tenant properties
Under Entra ID > Overview > Properties, review:

• Organisation name and region
• Technical and privacy contact emails
• Whether Security defaults are enabled (many admins disable these once Conditional Access is in place)
• App consent settings — restrict app registration to admins or trusted developers

b) User settings
Go to Identity > User settings and:

• Turn off “Users can register applications” unless necessary.
• Disable self-service purchases if you want licensing controlled centrally.
• Review External collaboration settings for guest user behaviour.

c) Notifications and service health
In Microsoft 365 Admin Centre, navigate to Org settings > Service health. Make sure alerts go to a monitored shared mailbox so downtime notifications aren’t missed.

Strengthen Baseline Security

Before diving into advanced Conditional Access, get the basics right:

• Enable Multi-Factor Authentication (MFA) for administrators and critical accounts first.
• Turn on Self-Service Password Reset (SSPR) — it saves countless helpdesk requests.
• Activate Microsoft Entra ID Protection (part of P2 licensing) to detect and mitigate risky sign-ins automatically.

And finally, maintain two break-glass (Article on how to set these up) accounts with long, random passwords stored securely offline. They must be exempt from Conditional Access policies but closely monitored.

Ongoing Maintenance and Good Habits

Once your tenant is configured:

• Record all configuration changes and keep them versioned.
• Add at least one backup Global Administrator.
• Export your settings regularly using PowerShell or the Graph API.
• Review your Microsoft Secure Score and Identity Secure Score to track improvement.
• Start piloting Conditional Access and Privileged Identity Management (PIM) with a small admin group before rolling out tenant-wide.

A properly configured Microsoft Entra ID tenant forms the foundation of every secure Microsoft 365 deployment. It controls who can access what, under which conditions, and from which devices. Skipping setup steps or leaving defaults unchanged often leads to weak points that attackers can exploit

Whether you’re running a production environment or learning for certification, take time to configure Entra ID with care. Once the tenant is in good shape, you’ll find that managing Conditional Access, compliance, and hybrid identities becomes far easier, and your users will thank you for a smoother, more reliable sign-in experience.

Feel free to buy me a coffee to keep this website up and running