L1. Entra ID Tenant Configuration and Custom Domains

Entra ID Tenant Architecture

An Entra ID tenant is the dedicated identity boundary for your organization. When a company signs up for any Microsoft cloud service (Microsoft 365, Azure, Dynamics 365), a tenant is automatically provisioned. Every user, group, application, and policy lives inside this boundary.

For the SC-300 exam, you need to understand that a tenant is not the same as a subscription. A single tenant can have multiple Azure subscriptions and multiple Microsoft 365 licenses attached to it. The tenant is the identity layer; subscriptions and licenses are resource layers.

Custom Domains

Every new tenant starts with a default domain: yourorg.onmicrosoft.com. To use your corporate domain (e.g., contoso.com), you must add and verify it. Verification process:

1. Navigate to Entra admin center > Custom domain names
2. Add the domain name
3. Create a DNS TXT or MX record at your registrar
4. Verify the record after DNS propagation; use the troubleshooting guidance if verification fails
5. Set as primary domain if desired

Exam tip: A custom domain must be verified before it can be used for user principal names (UPNs). You cannot create users with an unverified domain suffix.

Tenant Properties

Key tenant properties you can configure:

• Tenant name and technical contact: Basic organizational metadata
• Global privacy statement URL: Required for some compliance scenarios
• Country or region: Chosen at tenant creation. Microsoft Entra ID maps it to the geo-location where directory data is stored, and the tenant location can't be changed after it's set
• Notification language: Controls the language of system-generated emails

Exam tip: The tenant's country or region is permanent. If a scenario requires Entra directory data in a different geo-location, the answer involves a new tenant, not a settings change. Other Microsoft services (Exchange, SharePoint, Azure resources) have their own data residency rules, so check each service's documentation rather than assuming the tenant setting covers them.

Tenant-Level Security Defaults

Security defaults provide baseline protection for tenants that do not have Conditional Access. When enabled, security defaults enforce:

• MFA registration for all users
• MFA challenges for administrators on every sign-in
• MFA for other users when necessary (for example, a new device or app)
• Blocking of legacy authentication protocols
• Blocking device code flow (applies to new tenants from July 1, 2026)

Security defaults provide a free baseline. When replacing them with Conditional Access, disable defaults and immediately enable equivalent policies to avoid a protection gap. Conditional Access requires Microsoft Entra ID P1; risk-based policies require Microsoft Entra ID P2. Review existing Microsoft-managed policies alongside policies your organization creates.

Managing Multiple Tenants

Large enterprises may operate multiple tenants for regulatory, geographic, or organizational reasons. Cross-tenant access settings allow you to configure B2B collaboration and B2B direct connect between tenants. This is configured under External Identities > Cross-tenant access settings.

References

• Microsoft: Add a custom domain
• Microsoft: Security defaults
• Microsoft: Conditional Access overview
• Microsoft: Microsoft-managed policies
• Microsoft: Microsoft Entra ID and data residency