Module 7 of 9

📚 M365 Admin Center Course · Module 7 of 9

Settings, Domains & Integrated Apps

📂 Course: M365 Admin Center
📦 Module: 7 of 9
🎯 Exam: MS-102
⏱ Read time: ~25 min

MS-102 Exam Alignment
MS-102

Objective 1.1 — Deploy and configure Microsoft 365 tenant: configure organisation settings, add and verify custom domains, manage DNS records for M365 services, configure integrated app consent, and manage delegated partner access.

Configure organisation profile, security & privacy, and service settings
Add a custom domain and configure required DNS records (MX, TXT, CNAME)
Set domain as default and manage multiple domains
Configure admin consent for integrated third-party apps
Understand GDAP vs legacy DAP for partner relationships

Exam Tip: DNS records are heavily tested. Know which records are required (MX for email, TXT for ownership verification, Autodiscover CNAME for Outlook, SPF TXT for anti-spoofing) and what each one does.

The Settings section is where you configure how Microsoft 365 behaves for your entire organisation — from the company name users see in apps, to how password policies work, to which custom domains route your email. If Admin Center is the cockpit, Settings is where you configure the instruments. This module covers Org settings, custom domain setup, integrated app management, and partner access controls.

⚙️ Settings → Org Settings

Org settings contains three tabs — Organization profile, Security & privacy, and Services. These are tenant-wide settings that apply to all users.

M365 Admin Center › Settings › Org settings

Microsoft 365 admin center
|
Settings › Org settings › Organization profile

Settings

Org settings

Integrated apps

Domains

Partner relationships

Organization profile

Security & privacy

Services

Organization nameContoso Ltd ①

Technical contactadmin@contoso.com

Release preferencesTargeted release — selected users ②

Country/regionUnited Kingdom

① Organization name — this is the display name shown in user-facing Microsoft 365 apps (Teams, Outlook, OneDrive). Change it here to reflect your company's trading name.

② Targeted release for selected users — this tenant is configured to roll out new M365 features to a specific group of pilot users before general availability. The alternative is Standard release, where everyone receives features at general availability simultaneously.

🔒 Settings → Org Settings → Security & Privacy

Setting	What It Controls	Exam Note
Password expiration policy	Set passwords to never expire, or expire after a defined number of days (14–730)	Microsoft recommends "never expire" combined with MFA — forced password changes without MFA actually reduce security
Customer Lockbox	Require explicit admin approval before Microsoft support can access your tenant data	Requires M365 E5 or the Customer Lockbox add-on
Idle session timeout	Automatically sign out users after a period of inactivity on Microsoft 365 web apps	Applies to web browser sessions only — does not affect desktop apps or mobile apps
Activity reports anonymisation	Replace usernames with identifiers in usage reports	Controlled under Reports > Privacy — may be required under GDPR in some regions

🌐 Settings → Domains

When a Microsoft 365 tenant is created, it starts with an onmicrosoft.com domain (e.g. contoso.onmicrosoft.com). To route real business email through Microsoft 365, you must add and verify your own custom domain.

M365 Admin Center › Settings › Domains

Microsoft 365 admin center
|
Settings › Domains

Settings

Org settings

Integrated apps

Domains

Partner relationships

Domains

+ Add domain

Domain nameTypeStatus

contoso.com ①Managed✓ Healthy · Default

contoso.co.ukManaged✓ Healthy

contoso.onmicrosoft.com ②onmicrosoftBuilt-in

① contoso.com — Default domain. The default domain is used for all new user UPNs. Only one domain can be the default; change it by clicking the domain and selecting "Set as default".

② contoso.onmicrosoft.com — Built-in, cannot be deleted. Every tenant has this permanent domain. Even when you add custom domains, this one always remains.

Adding a Custom Domain — DNS Records Required

1 Go to Settings → Domains → Add domain and enter your domain name (e.g. contoso.com).
2 Verify ownership: Add the TXT record Microsoft provides to your domain registrar's DNS. This proves you control the domain. Verification usually completes within minutes but can take up to 72 hours.
3 Configure M365 services: Add the following DNS records to your domain registrar:

DNS Record	Type	Purpose
MX record	MX	Routes incoming email to Microsoft 365 Exchange Online. Without this, email sent to @contoso.com does not reach M365 mailboxes.
Autodiscover CNAME	CNAME	Points autodiscover.contoso.com to M365. Allows Outlook to automatically discover and configure mail settings without manual configuration.
SPF TXT record	TXT	Declares which servers are authorised to send email on behalf of your domain. Prevents spoofing. Value: v=spf1 include:spf.protection.outlook.com -all
DKIM CNAME records	CNAME (×2)	Used for DKIM email signing — digitally signs outgoing emails to prove they originate from your domain.

⚠️ MX Record Cutover — Plan Carefully

Changing the MX record routes all new incoming email to Microsoft 365. Before changing it, ensure all mailboxes are created and migrated. Many organisations lower the MX TTL to 300 seconds (5 minutes) a few days before cutover to speed up propagation.

🔌 Settings → Integrated Apps

Third-party and Microsoft apps often request access to M365 data — calendars, emails, files — using OAuth. The Integrated apps section lets admins control this at an organisational level rather than leaving it to individual users.

M365 Admin Center › Settings › Integrated apps

Microsoft 365 admin center
|
Settings › Integrated apps

Settings

Org settings

Integrated apps

Domains

Available apps

Deployed apps

Blocked apps

App namePublisherConsent status

Salesforce Connector ①SalesforceNeeds admin consent

DocuSign for M365DocuSignAdmin consented

Unknown App XYZUnknownBlocked

① Salesforce Connector — Needs admin consent. Users who try to use it will be blocked or prompted individually. Click the app and select "Grant admin consent" to pre-approve it for all users.

User Consent Settings

Under Settings → Org settings → Services → User consent to apps you can control whether users can consent to apps themselves:

Allow user consent — users can grant apps access to their own M365 data. Risk: users may grant excessive permissions without understanding what the app accesses.
Require admin consent — users cannot consent; they must request admin approval. More secure but creates more admin overhead.
Allow consent from verified publishers only — a balanced middle ground; users can consent to apps from publishers Microsoft has verified, but not unknown publishers.

🤝 Settings → Partner Relationships (GDAP)

💡 What Is GDAP?

Granular Delegated Admin Privileges (GDAP) is the secure model for Microsoft partners (resellers, managed service providers) to access customer tenants. Under GDAP, partners are granted specific roles (not Global Admin by default), for a defined time period. This replaced the legacy DAP (Delegated Admin Privileges) model which gave partners permanent Global Admin access by default — a significant security risk. In Settings → Partner relationships, you can view which partners have access, what roles they hold, and when that access expires.

⚡ PowerShell: Domain Management

PowerShell — Manage Domains

Connect-MgGraph -Scopes "Domain.Read.All"

# List all domains in the tenant with their status
Get-MgDomain | Select-Object Id, IsDefault, IsVerified, AuthenticationType

# Get required DNS records for a domain
Get-MgDomainServiceConfigurationRecord -DomainId "contoso.com" |
  Select-Object RecordType, Label, Ttl, SupportedService

# Check if a domain is verified
(Get-MgDomain -DomainId "contoso.com").IsVerified

🎓 Interview Q&A

Q: What DNS records are required when adding a custom domain to Microsoft 365 for email routing?

The primary records needed are: a TXT record for domain ownership verification, an MX record to route incoming email to Exchange Online, an Autodiscover CNAME to enable automatic Outlook profile configuration, and an SPF TXT record to authorise M365 to send email on behalf of the domain. Additionally, two DKIM CNAME records are recommended for email signing. All these are displayed on the Domains page once the domain is added — Microsoft provides the exact values to copy into your registrar's DNS.

Q: What is the difference between Standard Release and Targeted Release in Microsoft 365?

Standard Release means all users receive new features when Microsoft makes them generally available. Targeted Release means a selected group of users (or the entire organisation) receives new features ahead of general availability — typically 1–4 weeks early. This is used by IT teams to pilot test features, update documentation, and train staff before the feature rolls out to everyone. Configured in Settings → Org settings → Organization profile → Release preferences.

Q: A Microsoft partner needs to access your M365 tenant to help manage Exchange Online. What is the secure way to grant them access?

The secure method is GDAP (Granular Delegated Admin Privileges). The partner submits a GDAP relationship request specifying the exact roles they need (e.g. Exchange Administrator — not Global Admin) and the duration of access. The admin reviews and approves this in Settings → Partner relationships. GDAP replaced the legacy DAP model, which gave partners permanent Global Admin access by default.

Q: Users are complaining that whenever they try to connect a new app to their Microsoft 365 account, they get an error saying they need admin approval. What setting controls this?

This behaviour is controlled by the user consent settings in Settings → Org settings → Services → User consent to apps. The tenant is likely configured to require admin consent for all third-party apps. To resolve it, either grant admin consent for the specific app in Settings → Integrated apps, or change the user consent policy to allow consent from verified publishers.

🎯 MS-102 Mock Test

Module 7 — Settings, Domains & Integrated Apps

5 questions · Scenario-based · MS-102 exam style · Pass mark: 70%

Question 1 of 5

You are adding the domain contoso.com to a Microsoft 365 tenant. After entering the domain name, which DNS record type does Microsoft first require you to add to your domain registrar to prove ownership?

AMX record pointing to Microsoft's mail servers

BTXT record containing a Microsoft-generated verification value

CCNAME record for Autodiscover

DA record pointing to Microsoft's IP address

✅ Correct answer: B. Microsoft requires a TXT record at the domain registrar to verify that you control the domain. This is the ownership verification step and must be completed before M365 will accept the domain. The MX, CNAME, and other records come later, once ownership is confirmed.

Question 2 of 5

Your IT team wants to test new Microsoft 365 features before they roll out to all 500 users. You want to enable early access for the IT team of 10 people only. Which setting should you configure?

AStandard release for all users

BTargeted release for the entire organisation

CTargeted release for selected users — add the IT team members

DCreate a Microsoft 365 Group and assign the Preview licence

✅ Correct answer: C. Targeted release for selected users allows you to nominate specific accounts (your IT team of 10) to receive features early, while the remaining 490 users stay on Standard release.

Question 3 of 5

Users in your organisation are being prompted individually to grant a third-party HR application access to their Microsoft 365 calendars every time they sign in. As the administrator, what is the most efficient way to resolve this?

ATell each user to click "Accept" when prompted — this is expected behaviour

BGrant admin consent for the app in Settings → Integrated apps so all users are pre-approved

CCreate a Conditional Access policy that blocks the app

DEnable the app in Microsoft AppSource for all users

✅ Correct answer: B. Granting admin consent in Settings → Integrated apps pre-approves the app's requested permissions for the entire organisation. Users will no longer be prompted individually.

Question 4 of 5

A Microsoft partner reseller who manages your M365 tenant currently has permanent Global Administrator access via the legacy DAP model. Your security team wants to reduce this risk. What is the recommended replacement?

ARemove the partner's access entirely and self-manage the tenant

BTransition to GDAP — grant the partner only the specific roles they need with a time limit

CCreate a shared Global Admin account and give the partner the password

DEnable Privileged Identity Management for the partner's DAP account

✅ Correct answer: B. GDAP (Granular Delegated Admin Privileges) is the Microsoft-recommended replacement for DAP. It lets partners request only the specific roles they need for a defined time period. Microsoft deprecated DAP specifically because permanent Global Admin access for partners was a significant security risk.

Question 5 of 5

You run Get-MgDomain and the default domain returns as contoso.onmicrosoft.com, but it should be contoso.com. What is the most likely cause and fix?

Acontoso.com has not been added to the tenant yet — add it via Settings → Domains

Bcontoso.com has been added but not set as default — go to Settings → Domains, click contoso.com, and set it as default

CThe onmicrosoft.com domain always takes priority — this cannot be changed

DRun Update-MgDomain -DomainId contoso.onmicrosoft.com -IsDefault $false in PowerShell

✅ Correct answer: B. The onmicrosoft.com domain is the default when the tenant is first created. If contoso.com has been added and verified but not set as default, new user UPNs will still be @contoso.onmicrosoft.com. Fix it in Settings → Domains → click contoso.com → Set as default.