Runbook 07 · 43 scenarios
New-user onboarding
Accounts, licences, groups, Teams, mailboxes, access and support permissions.
The “start here” text identifies the first control plane and evidence to inspect. It does not replace change approval, safeguarding requirements, backup or a tested rollback route.
New user account was not created
Start hereCheck the approved identity-provisioning workflow.
Entra / Microsoft 365Synced user has not appeared in Microsoft 365
Start hereCheck Entra Connect or cloud-sync health.
Entra / Microsoft 365Incorrect username or UPN was created
Start hereVerify identity and accepted domain before correction.
Entra / Microsoft 365User usage location is missing
Start hereSet the correct usage location before assigning licences.
Entra / Microsoft 365No licences remain available
Start hereCheck licence inventory and escalate purchasing.
Entra / Microsoft 365Licence assignment fails for one user
Start hereOpen the Microsoft 365 Errors and issues details.
Entra / Microsoft 365Group-based licence assignment fails
Start hereCheck group assignment, usage location and conflicting service plans.
Entra / Microsoft 365Licence is assigned but service is unavailable
Start hereCheck service-plan state and provisioning delay.
Entra / Microsoft 365User receives the wrong licence bundle
Start hereReview licence-group membership and the licence design.
Entra / Microsoft 365Dynamic onboarding group does not add the user
Start hereValidate required user attributes and the rule.
Entra groupsDynamic-group processing is delayed
Start hereReview processing state; updates can take hours and occasionally over a day.
Entra groupsDepartment, school or job-title attribute is incorrect
Start hereCorrect the authoritative HR or directory value.
HR / directoryUser was placed in the wrong school or site group
Start hereCorrect the mapping and audit downstream access.
Entra groupsGroup is the wrong type
Start hereDistinguish security, Microsoft 365, distribution and mail-enabled groups.
Entra groupsGroup owner is missing
Start hereAssign accountable owners and a membership-review process.
Entra groupsUser sees a Team but cannot access its content
Start hereCheck Team membership, guest state and SharePoint access.
Teams / SharePointUser is not a member of the expected Team
Start hereCheck direct membership, group connection and provisioning.
TeamsUser cannot access a private channel
Start hereConfirm explicit private-channel membership.
TeamsUser cannot access a shared channel
Start hereCheck channel membership and cross-tenant settings.
Teams / EntraTeams does not appear for the user
Start hereConfirm the Teams licence and service plan.
Teams licensingTeams sign-in fails
Start hereCheck account state, licence, Conditional Access and compliance.
Teams / EntraTeams features differ from colleagues
Start hereCompare assigned Teams policies and propagation.
TeamsUser cannot create a Team
Start hereCheck group-creation and Teams creation policy.
Teams / EntraUser cannot schedule meetings or record
Start hereCheck meeting policy and relevant licence.
TeamsGuest cannot join or access a Team
Start hereCheck Teams guest access, external collaboration and invitation state.
Teams / EntraExternal user has the wrong account type
Start hereDistinguish guest, member and cross-tenant access.
Entra external identitiesMailbox has not provisioned
Start hereCheck Exchange service plan, domain and provisioning state.
Exchange OnlineUser cannot open a shared mailbox
Start hereCheck Full Access, Send As and licensing conditions.
Exchange OnlineOneDrive has not provisioned
Start hereCheck SharePoint service plan and first-use provisioning.
SharePoint / OneDriveUser cannot access a SharePoint staff area
Start hereCheck site, group, sensitivity and access policy.
SharePointUser is blocked by Conditional Access on the first day
Start hereCheck MFA registration, compliant device and location conditions.
Entra Conditional AccessTemporary password does not work
Start hereCheck account state, password policy and authentication method.
EntraMFA registration cannot be completed
Start hereCheck registration campaign, authentication methods and CA.
Entra authenticationNew user cannot enrol a laptop
Start hereCheck Intune licence, MDM scope and device limits.
Intune / EntraUser receives applications but not configuration
Start hereCompare user and device targeting, filters and sync state.
IntuneUser receives student policy instead of staff policy
Start hereCorrect authoritative attributes and group assignments.
Entra groups / IntuneNew starter has excessive privileges
Start hereApply least privilege and role-based access.
Entra / Intune RBACTechnician cannot support the user device
Start hereCheck Intune RBAC, scope groups and scope tags.
Intune RBACHelpdesk cannot use Remote Help
Start hereCheck Remote Help licence, helper role and scope.
Intune Remote HelpAdministrator action is waiting for approval
Start hereCheck the Multi Admin Approval request state.
Intune governancePrivileged administrator role is not active
Start hereCheck PIM activation, approval and expiry.
Entra PIMAccount works on the web but not the assigned laptop
Start hereCheck cached credentials, join state, token and compliance.
Entra / WindowsLeaver access affects a replacement user
Start hereRemove stale groups, licences, devices and mailbox access safely.
Identity lifecycle