Microsoft 365 Education: Tenant Setup Guide for US Schools

Each step consumes the one before it: School Data Sync needs a verified domain and licenses to assign, class teams come from the groups it creates, and Intune for Education reads the same school groups.

Education SKU prices are quoted on request; our education licensing guide walks the A1, A3 and A5 ladder.

Microsoft reviews every institution before it can buy education offers. Through the Cloud Solution Provider program the partner submits the legal name, website, segment, physical address and primary domain, and Microsoft checks them against its qualified educational user definitions. The review takes several business days, and a declined institution can still buy commercial or nonprofit SKUs.

Three things shorten it: a legal name on the order that matches the state school directory; the domain the school publishes (a .edu domain helps but is not the test); and the tenant boundary decided first, because verification is per tenant. One tenant per district is the normal answer.

Create the tenant through your provider in the United States region, add the district's primary domain and confirm ownership with the TXT record Microsoft issues, and set it as the default so School Data Sync creates users on it. Do not create accounts by hand at this stage; every manual account later has to be matched against the roster.

Storage is pooled for education tenants rather than allotted per user, and the pool grows with paid faculty licenses; the licensing guide sets out the base pool, the per-user additions for A3 and A5, and the 100 GB OneDrive limit on A1 users. Student use benefit licenses add nothing to the pool. Meeting recordings and class OneDrives fill the pool first, so set the recording retention period in step 8 rather than after the first warning.

Microsoft's school deployment tutorial for Intune starts with Entra ID, and so should you:

1. Create two cloud-only emergency access accounts with the Global Administrator role, long passwords stored offline, excluded from every Conditional Access policy.
2. Give the people who run the tenant named accounts with the role they need (User, License, Teams or Intune Administrator) and keep Global Administrator to the emergency accounts plus one or two people.
3. Require MFA for every staff account. With A1 only, turn on security defaults. With A3 or A5, which include Entra ID P1, build Conditional Access policies: require MFA for all users, block legacy authentication, require a compliant device for administrators. Our Conditional Access policy list is the template.
4. Decide the student authentication model by age band before accounts exist: password with MFA for high school, passwordless on shared devices for younger grades.
5. If the district runs on-premises Active Directory, keep Entra Connect for staff identities and let School Data Sync match to it.
6. Give your partner access through granular delegated admin privileges (GDAP), scoped to the roles and time window the work needs.

The ladder has three rungs:

• Office 365 A1 carries no charge for a verified institution: web and mobile apps, Exchange Online, Teams for Education, SharePoint and OneDrive, no installed desktop apps, and the 100 GB OneDrive limit.
• Microsoft 365 A3 is the faculty and staff baseline: installed Microsoft 365 Apps, Windows 11 Education, Intune for Education, Entra ID P1 for Conditional Access, Defender for Endpoint Plan 1 and the baseline Purview tools.
• Microsoft 365 A5 adds Entra ID P2, the Defender Plan 2 products, Purview premium compliance, Teams Phone Standard, Audio Conferencing and Power BI Pro.

The student use benefit, as Microsoft's Product Terms describe it, attaches up to 40 student instances to each paid faculty or staff suite license and up to 15 to each paid standalone license, at no additional charge. It matches the faculty product and is tied to covering faculty and staff with paid licenses, so order against the real staff count.

Assign through group-based licensing with groups School Data Sync populates. Microsoft 365 Copilot for education is a separate per-user add-on for A3 and A5 users at $216.00 per user per year on an annual commitment (Microsoft education price list, October 2026).

School Data Sync (SDS) is Microsoft's rostering service for Education tenants, and Microsoft's deployment guide recommends it as the preferred way to create students and teachers as users. Its planning checklist states the gates: a Microsoft 365 Education tenant, a Global Administrator to run it, and an SDS Plan 1 (A1) or SDS Plan 2 (A3 or A5) license on that administrator.

From one roster SDS creates the users, the Microsoft 365 groups for Exchange Online and SharePoint, the class teams with their OneNote Class Notebooks, the school groups that Intune for Education uses, and the rostering and single sign-on data for third-party learning apps. The decisions on the checklist, in order:

1. Source: a connector for the student information system, or CSV files in SDS's own format or the OneRoster format.
2. Create unmatched users: on for a new tenant; off, with a matching rule, where staff accounts already exist from Entra Connect.
3. Licenses per role, so the sync assigns A1 to students and A3 to teachers as it creates them.
4. SDS security groups, which the checklist recommends enabling so group-based licensing and Conditional Access can target students, teachers and staff.
5. Student age groups, so age-dependent settings apply.

Run the first sync for one school, check what it produced, then add the rest. Class teams stay visible to teachers only until activated, so the roster can be loaded before term. At year end, start a new sync profile and archive old class teams rather than deleting them.

Teams for Education adds class teams, Assignments, Grades, Classwork and OneNote Class Notebook to the Teams every tenant gets. Set policies before any team is activated:

• Use the education policy wizard in the Teams admin center. It applies one policy set to educators and staff and a stricter one to students.
• Students: no creating meetings or Meet now, no private calling, chat limited to the supervised model where the district requires it, external access off, app installation off.
• Educators: a lobby that holds external attendees, recording allowed with a retention period, transcription on for accessibility.
• Keep parent and guardian communication out of the student spaces.
• Decide now how recordings, inactive classes and departed users are handled; recordings and transcripts are education records under the retention settings in step 8.

If staff have never run a class in Teams, the Microsoft Teams Adoption Training and Pilot ($2,950 per project) runs one department first; a tenant with no Teams governance at all starts with Microsoft Teams initial planning and setup ($3,500 per project).

Intune for Education is the simplified console over the full Intune service, built around school groups rather than individual devices, and it reads the groups School Data Sync created. The A3 license carries it, along with the Windows 11 Education upgrade for the Windows license that came on the device.

1. Enroll staff devices through Windows Autopilot so a new laptop reaches the teacher with the district's settings applied at first sign-in; Intune setup for Windows Autopilot ($1,300 per project) builds the profile.
2. Configure student devices as shared devices with a settings group per grade band: web filtering, app allow lists, no local administrator, automatic sign-out.
3. Set compliance policies Conditional Access can use: disk encryption, a current OS build, Defender active.

Microsoft Intune initial setup for Windows device management ($6,500 per project) is the full-console route, and Managed Microsoft Intune Service ($5 per device) keeps the policies current.

Finish before the first day of term, not after the first incident. For a US district on A3:

1. MFA for every staff account and the Conditional Access set from step 3, with sign-in logs reviewed monthly.
2. The Standard preset security policy in the Defender portal, and Defender for Office 365 Plan 1 features where the tier includes them.
3. SPF, DKIM and DMARC on every sending domain, with every system that sends as the district in the records.
4. SharePoint and OneDrive external sharing limited to existing guests for students, and guest access off for student groups in Teams.
5. Retention policies in Microsoft Purview that follow the state's records schedule for student records, staff mail and meeting recordings, so the pool does not fill with recordings nobody may delete.
6. A Secure Score review with each action assigned: the Microsoft 365 Security Baseline and Secure Score Remediation ($3,450 per project), or the shorter Microsoft 365 Security Audit - Baseline ($525 per project) when you want the list before the work.

Each IT Partner service above is quoted in writing before work begins; Microsoft subscription charges are always the district's own.

Do we have to buy A3 for every employee to get the student licenses at no charge?

The student use benefit is tied to covering faculty and staff with paid licenses, and each paid suite license carries up to 40 student instances; the matching student rows are added at no additional charge.

Can we use School Data Sync without a student information system?

Yes. SDS accepts CSV files in its own format or the OneRoster format, so a small school can roster from a spreadsheet export each term.

Does School Data Sync replace Entra Connect?

No. Entra Connect synchronizes identities from on-premises Active Directory; SDS rosters students, classes and schools. Many districts run both, with SDS matching existing staff accounts.

Is Office 365 A1 enough for teachers?

For a teacher who works in a browser, yes, but A1 has no installed desktop apps, a 100 GB OneDrive limit, and no Intune for Education or Conditional Access. A3 is the faculty baseline for a district that manages devices.

Can students use Microsoft 365 Copilot?

Microsoft sells Copilot for education as a separate per-user add-on for A3 and A5 users at $216.00 per user per year, with age and regional conditions in Microsoft's terms. Clean up sharing first: Copilot shows a student whatever that student can already open.

• Tenant setup and deployment guide for Microsoft 365 for education baseline configurations — Microsoft Learn, checked 2026-10-11
• Planning checklist: School Data Sync — Microsoft Learn, checked 2026-10-11
• School Data Sync overview — Microsoft Learn, checked 2026-10-11
• Set up Microsoft Entra ID (school deployment tutorial) — Microsoft Learn, checked 2026-10-11
• Microsoft Education Solution Guide FAQ — Microsoft Learn, checked 2026-10-11
• What is Intune for Education? — Microsoft Learn, checked 2026-10-11
• Easy policy setup for education in Microsoft Teams — Microsoft Learn, checked 2026-10-11
• Microsoft 365 Education — Microsoft, checked 2026-10-11
• Microsoft Product Terms (Student Use Benefits and Academic Programs) — Microsoft, checked 2026-10-11