0.4 Lab Setup: M365 E5 Developer Tenant
Lab Setup: M365 E5 Developer Tenant
You need a Microsoft 365 E5 environment to complete the hands-on exercises in this course. This subsection walks you through obtaining and configuring one. Do not skip this — every module from Module 1 onward assumes you have a working tenant.
Your three options
| Option | Cost | Best for | Limitations |
|---|---|---|---|
| M365 Developer Program (Instant Sandbox) | Free | Learners with Visual Studio Professional/Enterprise subscription or qualifying partner membership | Requires qualifying membership; restricted since late 2024; 90-day renewable |
| M365 E5 Trial | Free for 30 days | Learners who need immediate access without qualification requirements | 30-day limit; credit card required; must cancel before billing |
| M365 Business Premium or E5 single-license | ~$57/month (E5) or ~$22/month (Business Premium) | Learners who want a stable, long-term environment without renewal concerns | Monthly cost; Business Premium lacks some E5 features |
As of 2025, Microsoft requires an active Visual Studio Professional or Enterprise subscription, or membership in the Microsoft AI Cloud Partner Program, to qualify for the free E5 developer sandbox. If you do not qualify, use Option 2 (E5 trial) or Option 3 (paid license). This restriction may change — check developer.microsoft.com for current eligibility.
Option 1: M365 Developer Program (if you qualify)
Step 1: Check eligibility. Navigate to developer.microsoft.com/en-us/microsoft-365/dev-program. Sign in with a work, school, or personal Microsoft account. If you see the “Set up E5 subscription” button on your dashboard, you qualify. If you see “You don’t currently qualify,” move to Option 2 or 3.
Step 2: Choose Instant Sandbox. When prompted, select “Instant sandbox” (not “Configurable sandbox”). The instant sandbox comes pre-provisioned with 24 test users, Microsoft Teams, SharePoint, Outlook, sample data, and all M365 E5 licenses. This saves hours of manual configuration.
Step 3: Note your credentials. The setup process creates an admin account (e.g., admin@yourdomain.onmicrosoft.com) with a password you set. Write these down — you will use them to access the M365 admin center, Defender portal, and Entra ID portal.
Step 4: Verify your tenant. Navigate to admin.microsoft.com and sign in with your admin credentials. Confirm you see:
- 25 user licenses (24 test users + 1 admin)
- Microsoft 365 E5 subscription active
- Exchange Online mailboxes for test users
Step 5: Verify Defender access. Navigate to security.microsoft.com. You should see the Microsoft Defender XDR portal with the Incidents queue, Advanced Hunting, and Settings accessible. If the portal shows “You don’t have permission,” wait 30 minutes — E5 license propagation can take time.
Option 2: M365 E5 Trial (30 days, no qualification needed)
Step 1: Navigate to microsoft.com/en-us/microsoft-365/enterprise/e5 and click “Try for free.”
Step 2: Follow the sign-up process. You will need a phone number for verification and a credit card (you will not be charged during the trial). Create your admin account and tenant domain.
Step 3: Verify your tenant using the same steps as Option 1 (Steps 4-5).
The trial converts to a paid subscription automatically on day 31. If you want to continue studying beyond 30 days without paying, you will need to set up a new trial with a different email address, or move to Option 3. If you want to keep your environment long-term, the automatic conversion is convenient — just be aware of the billing.
Option 3: M365 Business Premium or E5 single license
If you want a stable environment that does not expire or require renewal, purchase a single M365 E5 license ($57/month) or M365 Business Premium license ($22/month) through the M365 admin center.
Business Premium vs E5 for this course:
| Feature | Business Premium | E5 | Impact on course |
|---|---|---|---|
| Defender for Endpoint | P1 | P2 (full EDR) | Module 4 exercises require P2 for device timeline and live response |
| Defender for Office 365 | P1 | P2 (full) | Module 1 exercises on Threat Explorer require P2 |
| Defender for Identity | Not included | Included | Module 1.5 requires this |
| Defender for Cloud Apps | Not included | Included | Module 1.6 requires this |
| Microsoft Sentinel | Separate Azure subscription | Separate Azure subscription | Both require Azure — see subsection 0.5 |
| Entra ID | P1 | P2 | Risk-based conditional access in Modules 11, 13 requires P2 |
E5 is recommended. Business Premium works for Modules 0-3 and 6-8, but you will hit limitations in Modules that require P2 features. If budget is a concern, start with Business Premium and upgrade to E5 when you reach Module 4.
Creating test users
Regardless of which option you chose, you need test users to simulate a realistic organization. If you used the Instant Sandbox (Option 1), you already have 24 test users. For Options 2 and 3, create at least 6 test users:
| User | Display name | Role | Purpose |
|---|---|---|---|
| admin@yourdomain.onmicrosoft.com | Admin | Global Administrator | Your admin account |
| j.morrison@yourdomain.onmicrosoft.com | Jordan Morrison | Finance Manager | BEC/phishing target |
| s.patel@yourdomain.onmicrosoft.com | Sarah Patel | IT Administrator | Privileged account for CA testing |
| m.chen@yourdomain.onmicrosoft.com | Michael Chen | Standard User | Normal user baseline |
| r.williams@yourdomain.onmicrosoft.com | Rebecca Williams | Executive (CEO) | Impersonation target |
| d.kumar@yourdomain.onmicrosoft.com | David Kumar | Standard User | Second normal user for comparison |
Navigate to admin.microsoft.com → Users → Active users → Add a user. Assign each user an M365 E5 license. These fictional users appear throughout the course as the people in our investigation scenarios.
Throughout this course, investigation scenarios reference a fictional company called Northgate Engineering (northgateeng.com). Your tenant domain will be different (*.onmicrosoft.com), but the user names and investigation narratives use the Northgate Engineering context. When the course says "j.morrison@northgateeng.com received the phishing email," substitute your tenant's version of that user.
Verification checklist
Before moving to subsection 0.5, confirm all of the following:
- You can sign into admin.microsoft.com with your admin account
- You can see active M365 E5 (or Business Premium) licenses
- You have at least 6 test users with licenses assigned
- You can access security.microsoft.com (Microsoft Defender XDR portal)
- You can access entra.microsoft.com (Microsoft Entra admin center)
- The Defender portal shows the Incidents queue (even if empty)
If any of these fail, wait 30-60 minutes for provisioning to complete. New tenants can take up to 4 hours for all services to activate. If still failing after 4 hours, check the M365 Service Health dashboard at admin.microsoft.com → Health → Service health.