Microsoft 365 Education Licensing and Tenant Setup Guide

Microsoft 365 Education gives eligible schools, colleges, universities, and education nonprofits a secure cloud platform for teaching, collaboration, devices, compliance, and AI readiness. This refreshed guide explains how to verify eligibility, choose the right A1, A3, or A5 plan, set up a modern tenant, and work with IT Partner using least-privilege access.

What Microsoft 365 Education includes in 2026

Microsoft 365 Education is Microsoft’s cloud platform for learning institutions. It combines familiar productivity apps, Teams for Education, Exchange Online, SharePoint, OneDrive, Microsoft Entra ID, device management, security, compliance, and—in eligible scenarios—Microsoft 365 Copilot and Copilot Chat.

Current education licensing is commonly organized around A1, A3, and A5 plans for faculty, staff, and students. Availability, pricing, student benefits, and included features vary by country, institution type, agreement, and Microsoft program rules, so every quote should be validated against current Microsoft terms.

Useful Microsoft starting points include the Microsoft 365 Education product page at https://www.microsoft.com/en-us/education/products/microsoft-365 and Microsoft Learn education deployment guidance at https://learn.microsoft.com/microsoft-365/education/.

A1 vs. A3 vs. A5: choosing the right education plan

A1 is best for institutions that need core cloud collaboration and web-based productivity at the lowest cost. Depending on the offer, A1 typically focuses on browser-based Office apps, Teams, email, file storage, and classroom collaboration.

A3 is usually the better fit when faculty, staff, and students need desktop Office apps, stronger identity and access controls, endpoint management, and more complete administration features. A3 is often the practical baseline for schools that manage institution-owned devices or need more mature security policies.

A5 is designed for institutions with advanced security, compliance, analytics, and voice or threat protection requirements. A5 may include capabilities such as advanced Microsoft Defender features, expanded compliance tools, and enhanced identity protection, depending on the current SKU.

Many education agreements also include student use benefits tied to qualifying faculty or staff licenses. The exact rules, ratios, and eligible products can change, so IT Partner confirms these details during licensing review instead of relying on outdated assumptions such as a fixed number of free student licenses per staff license.

Education eligibility and verification

Microsoft requires institutions to be verified as qualified education customers before they can purchase or activate academic offers. A .edu domain can help demonstrate eligibility, but it should not be treated as the only requirement or an automatic approval path.

Typical verification information may include the institution’s legal name, website, education segment such as K-12 or higher education, physical address, primary domain, tenant information, and documentation from a government agency, ministry of education, accreditation body, or other recognized authority. Microsoft or the transacting partner may request additional evidence depending on geography and customer type.

For customers purchasing through the Cloud Solution Provider program, IT Partner can help validate academic eligibility through Microsoft Partner Center workflows, prepare the required information, and align the tenant, domain, and licensing records before purchase.

Tenant setup checklist for a modern school environment

A successful Microsoft 365 Education rollout starts with the tenant foundation. The recommended setup path is:

1. Create or confirm the Microsoft 365 tenant.
2. Add and verify the school’s primary domain.
3. Configure Microsoft Entra ID for identity, groups, authentication, and role-based administration.
4. Enable MFA for administrators and users, using Security Defaults or Conditional Access where licensing allows.
5. Create users, faculty groups, student groups, administrative groups, and dynamic groups if appropriate.
6. Assign faculty, staff, and student licenses based on role and eligibility.
7. Configure Exchange Online, Teams for Education, SharePoint, OneDrive, and retention settings.
8. Set up Teams policies, Class Teams, Assignments, OneNote Class Notebook, and meeting controls.
9. Configure Intune or Intune for Education for Windows, iOS, Android, and shared devices where licensed.
10. Review security, compliance, backup, data lifecycle, and incident response requirements before broad deployment.

IT Partner can assist with tenant setup, domain migration, identity cleanup, licensing assignment, Teams deployment, and user adoption planning.

Secure partner access with GDAP and least privilege

Partner access should no longer be described as broad, open-ended delegated administration. In 2026, customer-approved Granular Delegated Admin Privileges (GDAP) are the preferred model for partner administration in Microsoft 365.

With GDAP, IT Partner requests only the roles needed for the work being performed, such as license administration, user administration, Exchange administration, Teams administration, security administration, or other specific roles. Access can be time-bound, auditable, and aligned with the customer’s internal approval process.

A customer global administrator may still need to approve certain relationship or role requests, but the goal is to avoid unnecessary standing global admin access. This approach supports least privilege, better auditability, and cleaner separation of duties.

Security and compliance priorities for education

Schools handle sensitive data, including student records, staff information, research data, financial records, and communications. A modern Microsoft 365 Education deployment should include a security and compliance baseline, not just email and Teams.

Important areas include MFA and Conditional Access in Microsoft Entra ID, administrator role hygiene, secure score review, anti-phishing and anti-malware policies in Exchange Online Protection and Microsoft Defender for Office 365 where licensed, endpoint protection with Microsoft Defender for Endpoint where licensed, and device compliance through Intune.

Compliance planning should also cover Microsoft Purview retention, eDiscovery, sensitivity labels, data loss prevention, audit, and lifecycle policies. Student privacy requirements vary by jurisdiction, so institutions should align Microsoft 365 configuration with applicable laws, contracts, records schedules, and internal policies.

Teams, classroom collaboration, and accessibility

Teams for Education remains the center of daily classroom collaboration in many schools. It supports Class Teams, staff teams, PLC teams, Assignments, grading workflows, meetings, chat, channels, OneNote Class Notebook, and integration with learning tools.

SharePoint and OneDrive provide the document foundation for departments, classes, and individual work. Accessibility features across Microsoft 365—such as Immersive Reader, live captions, dictation, translation, and accessibility checking—can help support inclusive learning environments.

A strong rollout should define naming standards, retention rules, guest access, meeting policies, student chat controls, external sharing, and lifecycle management for classes and school years.

AI readiness: Copilot and Copilot Chat in education

AI is now part of Microsoft 365 planning for many education customers. Microsoft 365 Copilot and Copilot Chat availability depends on Microsoft’s current education eligibility, licensing prerequisites, user age requirements, tenant settings, and regional availability.

Before enabling AI broadly, institutions should review identity security, data permissions, SharePoint and OneDrive sharing, sensitivity labels, retention, DLP, and acceptable-use policies. Copilot can surface information that users already have permission to access, so overshared files and outdated permissions should be remediated before rollout.

IT Partner can help assess Copilot readiness, review licensing prerequisites, configure governance controls, and plan a responsible pilot for faculty, staff, or approved student populations.

How IT Partner helps education customers

IT Partner supports education institutions across the Microsoft 365 lifecycle: licensing review, academic eligibility support, tenant creation, migration, identity and security configuration, Teams for Education deployment, endpoint management, compliance planning, and Copilot readiness.

For new tenants, we help design the foundation correctly from the start. For existing tenants, we can review licensing, remove unused or misassigned licenses, improve security posture, clean up partner access, and modernize collaboration settings without disrupting classes.

Key takeaways

• Microsoft 365 Education is still highly relevant, but schools should validate current A1, A3, A5, faculty, staff, and student licensing terms before purchase.
• A .edu domain may help with verification, but academic eligibility should be confirmed through current Microsoft or CSP partner workflows.
• Modern deployments should include Microsoft Entra ID, MFA, Conditional Access where available, Teams for Education, SharePoint, OneDrive, Intune, Defender, and Purview planning.
• Partner administration should use GDAP, least-privilege roles, customer approval, time-bound access, and auditability.
• Copilot planning for education should begin with licensing, data protection, permissions cleanup, responsible AI policy, and a controlled pilot.

Planning a Microsoft 365 Education rollout or license review? IT Partner can help verify eligibility, right-size A1/A3/A5 licensing, configure your tenant securely, and prepare your school for Teams, Intune, Defender, Purview, and Copilot.