it-m365-operations

Trace the message end-to-end using sender, recipient, message ID, and timestamp rather than assuming delivery from submission. Check transport rules, connectors, anti-spam actions, quarantine, forwarding, and recipient-side processing before concluding the cause.

Check the service plan state, workload provisioning, group-based assignment conflicts, usage location, and propagation delay. Confirm activation state separately from license assignment, since they are distinct conditions.

Start with Microsoft 365 service health and active advisories before any local remediation. If a Microsoft-side incident is confirmed, begin incident coordination and link the advisory evidence instead of changing tenant configuration.

No, it explicitly excludes pure on-premises Exchange or SharePoint with no Microsoft 365 dependency. It also excludes identity lifecycle governance, confirmed malicious activity requiring security containment, and unapproved tenant-wide redesign.

Check nested-group support, site and team membership synchronization, guest account state, and item-level permissions. Treat sharing link access and direct permissions as separate paths when diagnosing the effective access.

Resolve all targets to immutable IDs, export the proposed delta, identify conflicts and protected objects, run a pilot ring, then execute in bounded batches. Record per-target results and read back effective state, preserving failures for retry.