After go-live: what do Day 2 operations for a Microsoft 365 tenant look like?

What Day 2 means for a Microsoft 365 tenant

Go-live ends the migration project and starts the part that lasts for years. Microsoft operates the physical datacenters, hosts, network and operating systems behind Microsoft 365, but its shared responsibility model is clear that, for every deployment type including SaaS, the customer remains responsible for customer data, configurations and settings, and identities and users, and shares responsibility for client devices and applications (Microsoft Learn, Shared responsibility in the cloud, accessed 2026-10-20). Day 2 operations are the recurring work that covers those responsibilities: identity hygiene, security posture, licensing, change management and recoverability. EPC Group's managed Microsoft services practice runs them on a fixed cadence with a named owner for each task, because the failure mode of a tenant is rarely one large mistake; it is a hundred small settings nobody revisited.

The weekly, monthly and quarterly runbook

Every week, EPC Group reviews Service health and the Message center. Service health, under Health in the Microsoft 365 admin center, lists issues for the organization to act on and active issues Microsoft is working on, separates advisories (a problem affecting some users, service still available) from incidents (a service or major function unavailable), and keeps an Issue history tab of incidents and advisories resolved in the last 7 or 30 days. Admins can subscribe up to two email addresses to incident and advisory notifications per service (Microsoft Learn, How to check Microsoft 365 service health, accessed 2026-10-20). The weekly review closes with a short list of user-facing changes for the help desk.

Every month, EPC Group records Secure Score, reconciles licenses against HR leavers and usage, and reviews sign-in risk and guest growth with the client security lead. Every quarter, it runs access reviews of groups, guests and admin roles; Microsoft lets organizations set recurring access reviews at weekly, monthly, quarterly or annual frequencies, with reviewers notified at the start of each one, and recommends asking group owners to confirm that guests still need access (Microsoft Learn, What are access reviews?, accessed 2026-10-20). The same quarterly window includes a restore test from backup, a review of Global Administrator and other privileged assignments, and a review of the runbook itself.

Managing Message center changes

Message center, under Health in the Microsoft 365 admin center, is where Microsoft announces upcoming changes, feature updates and required actions. Each post carries a relevance recommendation of High, Medium or Low based on usage and impact, a Status for your org of Scheduled, Rolling out or Launched for many feature announcements, an Act by date when an action is required, and tags that include Major update, Retirement, Admin impact, User impact and Data Privacy. Major updates are communicated at least 30 days in advance when an action is required, and the post shows the number of monthly active users of the affected service over the last 28 days (Microsoft Learn, Track new and changed features in the Microsoft 365 Message center, accessed 2026-10-20).

The same page documents the controls EPC Group relies on. Each admin sets preferences for which services appear and can receive a weekly digest, emails for major updates only and data privacy messages; the Message center reader role lets non-admins read and share posts; and posts can be synced to Microsoft Planner so that each actionable change becomes a tracked task (same source). EPC Group's triage rule is simple: every post tagged Major update, Retirement or Admin impact, and every post with an Act by date, gets a Planner task with an owner and a due date, and user-impacting changes go to the champions network a week before they land.

Tracking Secure Score over time

Microsoft Secure Score is a measurement of security posture in which a higher number indicates more recommended actions taken. It lives at security.microsoft.com/securescore in the Microsoft Defender portal and groups recommended actions into Identity, Device, Apps and Data; each action lists prerequisites, licenses required, user impact and implementation steps (Microsoft Learn, Assess your security posture with Microsoft Secure Score, accessed 2026-10-20). The History tab graphs the score over time and lists every action taken in the selected range with its resulting points, and the Metrics and trends tab adds a customizable score zone, a comparison trend against organizations of similar seat count, score changes, a regression trend and a risk acceptance trend (Microsoft Learn, Track your Microsoft Secure Score history and meet goals, accessed 2026-10-20).

Microsoft is careful about what the number means: Secure Score is not an absolute measurement of how likely a breach is, and it should not be read as a guarantee against one (Microsoft Learn, Microsoft Secure Score, accessed 2026-10-20). EPC Group therefore tracks it as a trend, not a target. Each month the regression trend is reviewed and every lost point is traced to the configuration, user or device change that caused it, and every action marked risk accepted carries a written reason and a review date in the runbook.

Reconciling licenses

The Billing > Licenses page in the Microsoft 365 admin center shows licenses per product, aggregated across subscriptions for the same product, and lists direct and group-based assignments separately. Its Errors and issues tab shows users who did not receive a license and why, for reasons such as no available licenses, conflicting service plans or an invalid usage location, and failed assignments can be reprocessed after the cause is fixed (Microsoft Learn, Assign or unassign licenses for users in the Microsoft 365 admin center, accessed 2026-10-20). When a license is removed, Exchange Online data for the account is held for 30 days and then deleted unless retention applies (same source), which is why EPC Group never removes a license before the mailbox decision for a leaver is made.

EPC Group prefers group-based licensing, so that joiners, movers and leavers are handled by group membership. Microsoft's guidance for moving a user between licensed groups is to add the user to the destination group first, confirm the new license, and only then remove the original group, to avoid a gap in access (Microsoft Learn, Assign or unassign licenses to a group in the Microsoft 365 admin center, accessed 2026-10-20). Monthly, the licensed-user list from Users > Active users is compared with the HR leaver list and with the Microsoft 365 usage reports (Microsoft Learn, Microsoft 365 admin center usage reports overview, accessed 2026-10-20), and unused assignments go to the client for a decision.

Backups and the shared responsibility model

Because the customer owns its data under the shared responsibility model, recoverability from accidental deletion, malicious overwrite or ransomware is a customer decision. Microsoft 365 Backup is the first-party option: it backs up all or selected SharePoint sites, OneDrive accounts and Exchange mailboxes, keeps backups inside the Microsoft 365 data trust boundary in append-only storage, and is also offered through partner applications built on the Microsoft 365 Backup Storage platform (Microsoft Learn, Overview of Microsoft 365 Backup, accessed 2026-10-20). For Exchange Online, restore points are available at 10-minute granularity for the full year; for OneDrive and SharePoint, at 10-minute granularity for up to 2 weeks and weekly from 2 to 52 weeks (Microsoft Learn, Restore data in Microsoft 365 Backup, accessed 2026-10-20). EPC Group chooses between Microsoft 365 Backup and a third-party product from the client's recovery objectives and retention requirements, then proves the choice with a quarterly restore test of a site, a OneDrive account and a mailbox.

Documented work

ANON-CASES: EPC Group engagement data for Microsoft 365 operations covers mid-size and large organizations in healthcare, financial services and professional services that moved from ad hoc tenant administration to a written Day 2 runbook with Message center triage, monthly Secure Score and license reviews, and quarterly access reviews, delivered by the firm's Microsoft 365 consulting and managed Microsoft services practices. Client names are not published here. Engagements are described by industry and organization size only, and no outcome figures are quoted that cannot be traced to a signed deliverable. EPC Group is a Microsoft Solutions Partner with all six Solutions Partner Designations as of October 2026.

Frequently Asked Questions

Talk to a senior architect

If your tenant went live and nobody owns the runbook yet, a 30-minute discovery call with a senior EPC Group architect covers the cadence, the owners and the first month of Message center, Secure Score and license reviews. See the Microsoft 365 consulting service hub for engagement structures.

Email contact@epcgroup.net or call 888-381-9725.

a Microsoft Gold Partner (2000 until Microsoft retired the program in 2022) — today holding all six Microsoft Solutions Partner Designations.