Microsoft 365 Admin Center Features Most IT Support Staff Never Use (But Should)

If you have logged into the Microsoft 365 admin center more than a handful of times, you have probably noticed something: the interface is genuinely sprawling. There are tabs within tabs, menus nested in side panels, and entire feature categories that seem to exist purely to advertise other Microsoft products you don't need.

What is less obvious is that buried beneath that clutter are some genuinely powerful tools that most entry-level IT support staff simply never discover. Not because they are hidden in any malicious sense, but because Microsoft's interface design leads most people directly to the obvious buttons: add a user, reset a password, manage a license.

The real leverage sits elsewhere. And if you are trying to move from healthcare into IT support, or you are already in a support role looking to justify better tooling for your team, knowing what these features actually do will change how you pitch automation to your manager and how you solve problems faster on the job.

Let us walk through the ones that actually move the needle.

The Threat Explorer: Your Secret Weapon for Email Security

Most IT support staff handle email security reactively. A user reports a phishing email. You delete it. They report another one. You delete that too.

The Threat Explorer (buried under Security > Email and Collaboration > Threat Explorer, if you are using the new admin center) gives you a completely different vantage point. Instead of responding to user complaints, you can see every suspicious email in your tenant in one place. You can filter by sender, date, malware type, or phishing confidence score. Then, crucially, you can remove those emails retroactively from all users' mailboxes, not just the one who reported it.

For a healthcare background IT support person, this is the mental shift from band-aid to diagnosis. Instead of firefighting individual reports, you are actively hunting for the threats your users missed. If someone is being targeted by a sophisticated phishing campaign, Threat Explorer lets you find the pattern, understand its scope, and eliminate it systematically.

The feature is included in M365 Defender (which comes bundled with E5 licences, or as an add-on). If your organisation has not turned it on, that is a conversation worth having with your manager.

Health Dashboard: Stop Guessing About System Status

This one surprises even experienced admins because it is genuinely useful but never mentioned in training. The Health Dashboard (Settings > Health and Service Performance > Health Dashboard) shows you real-time service incidents, advisory notices, and upcoming maintenance windows across your entire M365 estate.

Without this, your first sign of a problem is usually a flood of support tickets. Users cannot access Teams. Nobody can send email. And you are scrambling to find out what is happening. With Health Dashboard open, you would have seen that notification 10 minutes earlier, and you would have been able to communicate proactively instead of waiting to be shouted at.

For IT support staff moving into their first tech role, this is how you start looking professional: you answer user calls by saying "Yes, we have identified that, here is the current status," rather than "Let me investigate." The information is already there.

Audit Logs and Advanced Query Language: Forensics for Your Tenant

Most IT support staff know that audit logs exist somewhere, but very few actually use them properly. This is partly because the audit log interface is genuinely not intuitive, and partly because IT training tends to teach you how to run a basic audit search, not how to do something actually useful with one.

If you learn to use the Advanced Query Language (AQL) in the audit logs, you can answer questions that otherwise would take hours of manual investigation:

Which admin accounts have actually been used to make changes in the last 30 days?

Has anyone accessed a particular user's mailbox in the last week?

Who created that distribution list, and when?

Has a specific file been shared externally, and by whom?

This skill is worth learning early because it sits at the intersection of security and efficiency. When someone accuses an admin of overstepping their access, you can prove or disprove it in minutes. When a file leak occurs, you can trace the actual chain of events, not just speculation.

The queries are written in a Kusto-like syntax, which sounds scary but is actually quite learnable if you spend an afternoon on it. And that is exactly the kind of hands-on skill that accelerates career progression from generic support into more specialised roles like IT Security or Governance.

Automated Provisioning and Deprovisioning Workflows

This feature exists in the admin center but is almost never set up by smaller IT teams because it requires thinking about process first, not just tools. Under Identity > Users > Lifecycle management, you can build automated workflows that act on user lifecycle events: new hire, role change, termination.

Without this, every new user is a manual process. Someone submits a request, you create the account, you assign licences, you add them to the right groups, you send them a welcome email. Repeat this 20 times a month and you have wasted 10 hours of your own time on repetitive work.

With automated provisioning, new users can be created and configured to standard templates automatically. When a user's role changes (signalled by a change in their Azure AD attributes), their access can be updated without anyone manually touching it. When a user leaves, their mailbox can be converted to a shared mailbox automatically, or deleted on schedule.

For healthcare workers moving into IT support, this is a fundamental insight: the best IT support people do not support more users by working faster. They support more users by building systems that reduce how much work each user generates. Automated workflows are the first step in that direction.

Report Reader and Power BI Integration

Most IT support staff have no idea what reports are actually available to them because nobody teaches this. Under Reports in the admin center, there is an entire suite of dashboard data: app usage, email activity, device compliance, SharePoint storage, Teams usage, and much more.

If you can read these reports, you can identify problems before users even report them. You can see that storage quota is running out. You can spot that a particular user is receiving unusually high volumes of mail (possible compromise). You can identify which Teams channels are actually being used and which are digital graveyard sites.

For organisations using Power BI, you can actually build your own dashboards on top of M365 data, giving you visualisation tools that the standard admin center simply does not offer. This is getting into analytics territory, but the basic skill of reading and interpreting the built-in reports is something every IT support person should have.

Want to go deeper on M365 administration? Our Microsoft 365 Administrator Course (currently on the waitlist) covers both foundational and advanced features like these, with practical labs so you can actually build configurations that matter. If you are serious about moving beyond helpdesk-level support into systems administration, request a free discovery call to see if the course fits your timeline.

Frequently asked questions

What is the difference between Threat Explorer and the regular security alerts I already get?

Threat Explorer is proactive and historical; security alerts are reactive and real-time. Alerts notify you when something matches a rule, but Threat Explorer lets you hunt through past emails to find patterns and threats your users might have missed or that predate your alert rules. You can retroactively remove malicious emails from all mailboxes at once, which standard alerts cannot do.

Do I need E5 licensing to use all these features?

Not entirely, but some features require higher tiers. Health Dashboard is available to all M365 tenants. Threat Explorer requires M365 Defender (E5 add-on or included with E5). Automated provisioning workflows and advanced audit logs are available in most business plans, but some advanced query options need E5 or additional licensing. Check your tenant's current licence tier before assuming a feature is unavailable.

How much time could these features actually save my IT team?

If you are managing 50+ users, automated provisioning alone could save 5 to 10 hours per month. Threat Explorer and audit logs reduce security incident response time from hours to minutes. Health Dashboard eliminates the guesswork when users report service issues. Combined, these features typically save a small IT team 15 to 20 hours per month, which could fund half a support technician's salary over a year.

Are these features covered in standard M365 training courses?

Rarely. Most M365 training focuses on the obvious tasks: user management, licence assignment, basic security. The features we have covered here require either hands-on exploration or specific training in security, governance, or advanced administration. That is why experienced IT support people who have discovered these tools tend to be significantly more efficient than those following only standard documentation.

Should I learn these features before my first IT support role, or after I have started?

Both. Before you start, understand the conceptual landscape so you know these tools exist. Once you are in role, prioritise hands-on learning on the features most relevant to your organisation's size and security needs. Threat Explorer and Health Dashboard should come first because they solve immediate, common problems. Audit queries and automation workflows can follow once you have the basics solid.