2.1 Tenant Properties, Domains & Company Branding

Why tenant hygiene matters on SC-300

Microsoft Entra ID (formerly Azure Active Directory) is the identity system behind Microsoft 365, Azure, and thousands of SaaS apps. Before you design Conditional Access, Privileged Identity Management, or hybrid sync, you must know how the tenant itself is configured. SC-300 scenarios often open with a new organization, a merger, a rebrand, or a delegated-admin request. The candidate who only memorizes MFA methods and forgets domains, device join defaults, or company branding will miss easy points.

A tenant is a dedicated instance of Microsoft Entra ID for an organization. It has a unique tenant ID (GUID), a default domain of the form contoso.onmicrosoft.com, optional verified custom domains, directory objects (users, groups, devices, applications), and organization-wide settings. Tenant administration is the foundation of domain Implement and manage user identities.

Tenant properties

In the Microsoft Entra admin center, open Identity > Overview > Properties (wording may appear under Organization properties). Key fields include:

• Name — display name of the organization in portals and some consent screens.
• Technical contact / Global privacy contact — people Microsoft and partners may use for notices; keep them current and distribution-list friendly where policy allows.
• Privacy statement URL / Privacy info — linked from consent and some user experiences; must be a valid HTTPS URL your legal team owns.
• Country or region — set at tenant creation for many directory defaults; it is not a casual rename and affects data residency expectations for some workloads.
• Preferred language — influences default UI language where locale-specific branding is not applied.

Exam trap: tenant properties are not the same as Azure subscription properties. Subscriptions live under Azure Resource Manager. Entra tenant properties live under the Microsoft Entra directory. Changing a subscription owner does not rebrand the sign-in page or verify a domain.

Also review Security defaults versus Conditional Access. Security defaults are a tenant-wide baseline (block legacy auth, require MFA for admins and users in a simplified model). SC-300 prefers you understand when an organization graduates from security defaults to granular Conditional Access; the decision often appears as a planning scenario rather than a pure click-path item.

User settings

Identity > Users > User settings (and related External Identities blades) control default capabilities for non-admin users:

For SC-300, "users can register applications" set to Yes is often the wrong answer in a regulated enterprise that wants App registrations controlled by Application Administrators. Guest invite set to "anyone including guests" is a common oversharing trap. When a scenario says "only the helpdesk and identity team may invite partners," map that to admins and users assigned to specific admin roles (or a tighter custom process), not open member invites.

User settings also intersect with self-service password reset (SSPR) and authentication methods, but those are deep topics in later chapters. Here, remember that directory defaults shape the attack surface before you write a single Conditional Access policy.

Group settings

Identity > Groups > General (group settings) governs self-service group management:

• Whether users can create Microsoft 365 groups and security groups.
• Whether owners can manage group membership without admins.
• Naming policies, expiration policies, and blocked words (often Microsoft 365 Groups / Entra ID Governance features depending on license).
• Group writeback and on-premises integration flags when hybrid identity is in play.

If a business unit needs collaborative M365 Groups but security teams must own all security groups used for Conditional Access, you do not turn off all group creation blindly. Prefer: allow M365 group creation for users if collaboration requires it; restrict security group creation; use role-assignable groups only for privileged role membership (covered in section 2.2).

Device settings

Identity > Devices > Device settings (and related Device enrollment / join configuration) is heavily tested because device identity feeds Conditional Access device filters and compliance signals.

Scenario pattern: "Sales may Entra-join laptops, contractors may not." Answer with Selected users/groups for join, not Global Administrator open access. Another pattern: "Users keep getting local admin on Entra joined PCs." Check Additional local administrators on Microsoft Entra joined devices and remove broad groups.

Custom domain names

Default domain contoso.onmicrosoft.com always exists. Production tenants add custom domains such as contoso.com and fabrikam.com.

Workflow:

1. Add domain in Microsoft Entra admin center (Identity > Settings > Domain names) or Microsoft 365 admin center.
2. Verify ownership with DNS records Microsoft supplies—commonly a TXT record (or MX in some flows). Verification proves you control the DNS zone.
3. Optionally mark a domain as primary so new users get that domain in suggested UPNs.
4. Assign UPNs and email addresses using verified domains only.

Exam distinctions:

• Verification ≠ federation. Verifying DNS makes the domain usable; federation is a separate auth design.
• You cannot set an unverified domain as primary for production user naming.
• Multiple verified domains are normal (brands, acquisitions). Primary domain is a default convenience, not exclusive ownership.
• Subdomains may need their own verification depending on how DNS is structured; do not assume parent verification automatically covers every child for all scenarios—follow the portal verification requirements shown for that domain.

When a scenario says users still show @contoso.onmicrosoft.com after a rebrand, the fix is usually: verify contoso.com, set it primary if desired, then update user UPNs (bulk or Graph/PowerShell), not "delete the onmicrosoft domain" (you generally cannot remove the initial domain).

Company branding (sign-in page experience)

Company branding customizes the Microsoft Entra sign-in and account experiences users see in browsers and many Microsoft first-party apps. Path: Microsoft Entra admin center > User experiences > Company branding (labels evolve; look for Company branding / Sign-in page).

You can configure:

• Sign-in page background image or color
• Banner logo and square logo variants
• Username hint / sign-in page text
• Custom CSS (within supported limits) for advanced layout tweaks
• Browser language / locale-specific branding so French users see different art than English users
• Favicon and other supported chrome elements where available

Branding is not Conditional Access and not a security control that blocks attackers by itself. It is still exam-relevant because:

1. Users train on a consistent look; phishing pages that lack your branding are easier to spot in awareness programs.
2. Multinational firms need locale-specific branding.
3. Misapplied branding (wrong logo after acquisition) is a common "configure the tenant" task.

Licensing note for study: some advanced branding and organizational messages historically required Microsoft Entra ID P1/P2 or Microsoft 365 suites that include those rights. On SC-300, if a scenario mentions "custom branding for the sign-in page," select Company branding configuration—not Azure Front Door and not a custom SAML app skin—unless the question is clearly about an app's own UI.

Putting it together for exam scenarios

Walk every tenant-admin scenario in this order:

1. Identity of the directory — correct tenant, properties, contacts, privacy URL.
2. Who can do what by default — user, group, and device settings aligned to least privilege.
3. Which names are trusted — verified domains, primary domain, UPN plan.
4. What users see at auth time — company branding per locale.
5. What must wait for later chapters — Conditional Access, PIM, hybrid auth methods—but those assume a clean tenant baseline.

Tenant hygiene is not glamorous, but it is the difference between a directory you can govern and a directory that invents new exceptions every week. For SC-300, expect at least one question that is "pure" tenant configuration rather than Conditional Access theater.