Office 365 & Microsoft 365 Admin — Complete Reference Guide

Office 365 is Microsoft's cloud-hosted productivity suite bundling Exchange Online (email), SharePoint Online (document management), OneDrive (file storage), Microsoft Teams (collaboration), and the Office application suite. Users access everything from any device with an internet connection — removing the need for on-premises servers for these workloads.

Microsoft 365 builds on Office 365 by adding Windows OS licensing and Enterprise Mobility + Security (EMS). It targets enterprise environments needing centralised control over cloud services and physical endpoints. Think of Office 365 as the productivity layer; Microsoft 365 wraps security, device management, and OS licensing around it.

An O365 Admin manages the full lifecycle of cloud services: creating and managing user accounts and licenses, configuring Exchange Online, SharePoint, and Teams, enforcing security and compliance policies, and troubleshooting service issues. They act as the operational owner of the Microsoft 365 tenant.

Azure AD (now Microsoft Entra ID) is Microsoft's cloud-based identity platform handling user authentication and authorisation across Microsoft 365 and thousands of SaaS applications. Every M365 tenant relies on Azure AD as its identity backbone — storing user objects, group memberships, and access policies.

On-premises AD uses LDAP and Kerberos within a corporate network and is managed via domain controllers. Azure AD is cloud-native, uses modern protocols (OAuth 2.0, OpenID Connect, SAML), and is designed for SaaS apps. In hybrid environments they co-exist, with Azure AD Connect syncing identities between them.

A tenant is a dedicated, isolated instance of Microsoft 365 services assigned to a single organisation. It stores all users, licensed services, domain names, security policies, and data. When a company signs up, Microsoft provisions a tenant — typically identified by a default domain like contoso.onmicrosoft.com.

A subscription is the commercial agreement governing which services and features an organisation has access to. Common examples include Microsoft 365 Business Basic, Business Premium, E3, and E5 — each offering progressively more capabilities, particularly around security and compliance.

Licenses determine which services and feature tiers a user can access. A lower-tier license provides email and basic Teams; a higher-tier one adds advanced security tools, larger mailbox quotas, and compliance features. License assignment is managed per user and drives which workloads are provisioned.

Licenses can be assigned through the Microsoft 365 Admin Center (GUI), via PowerShell for bulk operations, or automatically using group-based licensing in Azure AD. Group-based licensing is preferred in larger environments — add a user to a group and the license is assigned automatically without manual intervention.

Exchange Online is the cloud-hosted version of Microsoft Exchange Server, delivered as part of Microsoft 365. It provides enterprise email, calendar, contacts, and meeting scheduling — all without the organisation managing physical mail servers. Microsoft handles all infrastructure, patching, and uptime guarantees.

A mailbox is a storage container in Exchange Online holding a user's email messages, calendar events, tasks, and contacts. Each licensed user automatically receives a primary mailbox. Additional types — shared, resource, archive — serve other purposes.

Most Microsoft 365 plans include a 50 GB primary mailbox. Enterprise plans (E3/E5) extend this to 100 GB. When an In-Place Archive is enabled, users receive an additional archive mailbox with effectively unlimited storage on qualifying plans.

An archive mailbox provides extra storage for older or less frequently accessed email. It is typically auto-populated by retention policies that move aged content from the primary mailbox, and helps organisations meet data retention requirements without hitting primary mailbox limits.

Litigation Hold prevents email and mailbox content from being permanently deleted — even if the user deletes it. When applied, Exchange retains all content in Recoverable Items, making it available for eDiscovery. Used when an organisation anticipates or is involved in legal proceedings.

Retention policies define how long content must be kept and what happens afterward (retain only, delete only, or retain then delete). They apply across Exchange, SharePoint, OneDrive, Teams messages, and other workloads — the primary tool for data lifecycle management in Microsoft 365.

A shared mailbox lets multiple users access and send email from a common address without a separate password. Commonly used for department inboxes like support@company.com. Shared mailboxes under 50 GB do not require a dedicated license.

The EAC is the web-based management portal for Exchange Online. Admins manage mailboxes, configure mail flow rules and connectors, run message traces, manage accepted domains, and configure anti-spam and anti-malware settings from here.

Mail flow describes the path an email travels from sender to recipient through Exchange Online. It is governed by transport rules, send/receive connectors, and accepted domain configurations. Admins use mail flow controls to route, filter, encrypt, or modify messages based on defined conditions.

Transport rules inspect messages in transit and apply actions based on conditions. Common uses: adding legal disclaimers to outbound email, blocking messages with sensitive data, redirecting mail from specific senders, or prepending warning tags to external emails.

Accepted domains are domain namespaces Exchange Online is configured to receive email for. Outbound connectors route email from Office 365 to external mail systems — used in hybrid deployments or with third-party gateways. Inbound connectors restrict or route email arriving into Office 365 from specific external sources, enforcing IP-based restrictions and TLS requirements.

Full Access lets a delegate open and read another's mailbox. Send As lets the delegate send email that appears entirely from the shared mailbox — the sender's identity is hidden. Send on Behalf shows both identities ("Delegate Name on behalf of Mailbox Owner") — used for executive assistants.

Resource mailboxes represent bookable assets — meeting rooms (Room mailbox) or shared equipment (Equipment mailbox). They auto-accept or decline meeting requests based on availability, making room booking straightforward directly from Outlook calendar.

Mailbox forwarding automatically redirects email to a different address. While legitimate for some workflows, unauthorised forwarding rules are a common indicator of account compromise — attackers set them after gaining access to silently exfiltrate email.

A soft delete enters a 30-day retention window where the mailbox can be fully restored. A hard delete permanently removes the mailbox and is irreversible. Most Admin Center deletions are soft deletes by default.

Autodiscover automatically provides Outlook with the correct Exchange server connection settings. Users simply enter their email address and password; Outlook configures itself. Correct Autodiscover DNS CNAME records are essential for a smooth Outlook experience and significantly reduce configuration helpdesk tickets.

MFA requires users to verify their identity using two or more methods before gaining access. The most common combination is a password plus a push notification or one-time code via Microsoft Authenticator. Enabling MFA dramatically reduces risk from credential theft.

Conditional Access is Azure AD's policy engine granting or blocking access based on signals: user identity, device compliance state, location (IP/country), application being accessed, and real-time risk score. For example, require MFA from outside the corporate network, or block access from non-compliant devices entirely.

Security Defaults are pre-configured baseline security settings Microsoft applies to tenants that haven't implemented Conditional Access. They enforce MFA for all admins, require MFA registration for all users, and block legacy authentication protocols. Ideal for smaller organisations without dedicated security staff.

Legacy authentication refers to older protocols — IMAP, POP3, SMTP AUTH, Basic Auth — that predate MFA. Because these protocols cannot present a second factor, they are a major attack vector. A significant proportion of password spray attacks target legacy auth endpoints. Blocking them is one of the highest-impact security improvements available.

Defender for Office 365 layers AI-driven protection on top of Exchange Online Protection. It adds protection against sophisticated phishing, business email compromise, malicious URLs (Safe Links), and weaponised attachments (Safe Attachments). Plan 1 provides core protection; Plan 2 adds threat hunting, attack simulation, and SIEM integration.

Identity Protection (Azure AD P2) uses Microsoft threat intelligence to detect risk events — impossible travel, anonymised IPs, leaked credentials — and assigns risk levels to each sign-in. Sign-in risk measures the probability a specific authentication attempt was not from the legitimate owner. User risk is an aggregated cumulative score representing the probability an account has been compromised. Policies can automatically force password resets or block access above defined thresholds.

Microsoft Authenticator is the recommended MFA mobile app for Microsoft 365. It supports push notifications (tap Approve), time-based one-time passwords (TOTP), and passwordless phone sign-in where no password is entered at all. Available on iOS and Android, integrating directly with Azure AD MFA.

Passwordless authentication eliminates the password from the sign-in flow entirely. Microsoft supports three methods: Windows Hello for Business (biometrics or PIN on a registered device), Microsoft Authenticator (number-matching push), and FIDO2 security keys (physical hardware keys). Passwordless is more secure because there is nothing to steal or phish.

Spam filter policies define how suspected spam is handled — quarantine, junk folder, or reject — using ML scoring and reputation lists. Anti-malware policies scan all attachments for malware. Safe Links rewrites URLs and checks them at the moment of click in real time, blocking time-of-click phishing attacks. Safe Attachments detonates attachments in an isolated sandbox before delivery, catching zero-day threats beyond signature-based scanning.

PIM (Azure AD P2) provides just-in-time privileged access. Instead of permanent admin roles, users are eligible for a role and must activate it on demand — specifying a justification and time window. This dramatically reduces the standing attack surface for admin accounts. PIM enforces MFA at activation and creates a full audit trail.

Also called a "break-glass" account — a highly privileged account used only when normal admin access is unavailable (e.g. all Global Admins locked out due to a Conditional Access misconfiguration or MFA outage). Must be excluded from all Conditional Access policies, use strong offline-stored credentials, and trigger immediate alerts when used.

Before a custom domain can be used in Microsoft 365, the admin must prove ownership. Microsoft provides a TXT or CNAME record value to publish in the domain's public DNS zone. Once Microsoft detects the record, ownership is confirmed and the domain is ready for email and services.

Microsoft 365 requires: an MX record to route inbound email, a TXT (SPF) record for sender authentication, CNAME records for Autodiscover and Teams SIP federation, and optionally DKIM TXT records for email signing. Incorrect or missing records cause email delivery failures or Outlook configuration issues.

A Mail Exchanger (MX) record is a DNS entry specifying which mail server receives email for a domain. For Exchange Online, the MX record must point to Microsoft's mail endpoint (e.g. contoso-com.mail.protection.outlook.com). Incorrect MX records cause inbound email delivery failures.

Sender Policy Framework (SPF) is a DNS TXT record listing mail servers authorised to send email for a domain. Receiving servers check SPF to verify that inbound email is from an authorised source. For Microsoft 365, the standard SPF record includes include:spf.protection.outlook.com.

DomainKeys Identified Mail (DKIM) adds a cryptographic digital signature to outgoing email headers. The receiving server retrieves the corresponding public key from DNS and verifies the signature — confirming the email wasn't tampered with in transit and genuinely originated from the claimed domain.

Domain-based Message Authentication, Reporting, and Conformance (DMARC) builds on SPF and DKIM to tell receiving servers what to do when email fails authentication — nothing (p=none), quarantine it, or reject it. It also provides aggregate reporting, giving domain owners visibility into who sends email on their behalf.

A distribution group is a mail-enabled group used to send a single email to multiple recipients at once. When you email the group alias, Exchange expands it and delivers to every member. Ideal for department mailing lists, but does not provide collaboration resources like shared sites or calendars.

Microsoft 365 Groups are collaboration-oriented groups provisioning a bundle of shared resources: a shared mailbox and calendar in Exchange, a SharePoint team site, a shared OneNote notebook, and a Teams channel if connected. More feature-rich than distribution groups and the foundation for modern Microsoft 365 collaboration.

The Global Administrator has unrestricted access to all Microsoft 365 services, settings, and data — the most powerful role in a tenant. Microsoft recommends no more than 2–4 Global Admins, protected with PIM, MFA, and dedicated admin-only workstations.

Service Administrator roles (Exchange Admin, SharePoint Admin, Teams Admin, etc.) grant management permissions scoped to a specific service only. Following least privilege, most day-to-day admin work should use service-specific roles. RBAC is the underlying model — permissions are bundled into named roles assigned to users or groups, simplifying management and enabling audit of who has what access.

Dynamic groups automatically add or remove members based on user attribute rules — for example, all users where Department equals "Finance". When user attributes change, group membership updates automatically, eliminating manual maintenance. Particularly powerful for automating license assignments and Conditional Access policies.

Mailbox migration moves user mailboxes from an on-premises email system to Exchange Online. Microsoft 365 supports three main methods: Cutover (all mailboxes in one go — suitable for small orgs), Staged (batches over time), and Hybrid (for large enterprises maintaining coexistence between on-prem and cloud).

A hybrid deployment connects an on-premises Exchange organisation with Exchange Online using the Hybrid Configuration Wizard. It creates seamless coexistence: free/busy calendar info is shared across both environments, email flows naturally between on-prem and cloud mailboxes, and users see a single unified Global Address List.

Azure AD Connect is the on-premises tool that synchronises identities from Active Directory Domain Services to Azure AD. It runs on a Windows Server and periodically syncs user accounts, groups, and credentials. Without it, cloud and on-prem identities are completely separate.

Password Hash Synchronisation (PHS): syncs a hash of the on-prem password hash to Azure AD; users authenticate directly against Azure AD — best cloud resilience. Pass-Through Authentication (PTA): validates credentials against on-prem AD in real time via lightweight agents — no password data stored in the cloud. Federation (ADFS): redirects all Azure AD authentication to an on-premises identity provider — maximum control but introduces on-prem dependency for cloud sign-in.

Microsoft Purview is the unified hub for all compliance and data governance tools. From here, admins manage retention policies, DLP policies, eDiscovery cases, audit log searches, sensitivity labels, communication compliance, and the Compliance Manager dashboard.

eDiscovery identifies, collects, and produces electronically stored information (ESI) in response to legal, regulatory, or internal investigation requirements. Purview provides eDiscovery Standard (search and export) and eDiscovery Premium (advanced analytics, custodian management, review sets, and legal hold workflows).

Microsoft 365 maintains a unified audit log recording user and admin activities across Exchange, SharePoint, Azure AD, Teams, and other services. Admins search these logs in the Purview portal to investigate suspicious activity, track configuration changes, or respond to compliance requests. Retention: 90 days (Standard) or up to 10 years (Premium).

DLP policies scan content across email, Teams, SharePoint, and OneDrive for sensitive information types — credit card numbers, Social Security numbers, medical data — and prevent inappropriate sharing. Actions include blocking transmission, applying encryption, notifying the user, or alerting admins. Defined in Microsoft Purview.

Microsoft Purview is the unified data security, compliance, and governance platform bringing together data classification, sensitivity labels, DLP, eDiscovery, information protection, data lifecycle management, compliance manager, and audit capabilities under one portal.

Retention labels are item-level controls applied to individual documents, emails, or Teams messages — manually or automatically via classifiers. They can mark content as a record, preventing modification. Sensitivity labels classify and protect content (Public, Internal, Confidential, Highly Confidential). Labels can apply encryption, restrict sharing, add visual markings, and control actions within Office apps.

Secure Score measures an organisation's security posture across Microsoft 365. It assigns points for security configurations in place, and provides a prioritised list of recommended improvement actions with estimated impact scores. Tracking Secure Score over time gives a quantifiable view of security improvement progress.

Legal Hold is applied to specific mailboxes to preserve all content for legal purposes — reactive and applied on demand. Retention policies are proactive, automated, and applied across content repositories based on schedule. Legal Hold preserves everything indefinitely; retention policies apply defined timeframes and may ultimately delete content.

Teams is Microsoft's hub for workplace collaboration — combining persistent chat, video meetings, calling, file sharing, and app integrations in a single workspace. Each Team is backed by a Microsoft 365 Group, giving members a shared SharePoint site, mailbox, and notebook.

SharePoint Online is the cloud-hosted document management and intranet platform in Microsoft 365. It provides team sites (collaboration), communication sites (publishing), and document libraries with versioning, co-authoring, metadata, workflows, and fine-grained permission controls. SharePoint is the file storage backbone behind Teams and Microsoft 365 Groups.

OneDrive for Business is each user's personal cloud file storage space within Microsoft 365 — typically 1 TB or more. Files sync to devices and are accessible from any browser. When a user leaves, their OneDrive is preserved and admin-accessible for a configurable period, allowing data transfer to a manager.

Guest access adds an external user as a member of a specific Team — they can see channels, files, and history and are provisioned as Azure AD B2B users. External access allows users from other organisations to chat with your users in 1:1 and group chats, without being added to any Team. External access is more limited but requires no guest account provisioning.

Versioning automatically saves a snapshot of a file every time it is modified in a SharePoint document library. Users can view history, compare versions, and restore any previous version. Admins configure how many major and minor versions are retained. Versioning is a critical safety net for accidental overwrites.

External sharing controls whether SharePoint and OneDrive content can be shared with people outside the organisation — from most restrictive (no external sharing) to most permissive (anyone with a link, no sign-in required). Best practice: set the most restrictive level appropriate for the business and use expiring links with password protection.

PowerShell is the command-line scripting environment for managing Microsoft 365 programmatically. Essential for bulk operations — creating hundreds of users, managing licenses at scale, generating reports — and accessing advanced configurations not exposed in the GUI. Key modules include ExchangeOnlineManagement, Microsoft.Graph, AzureAD, and MicrosoftTeams. For complex environments, PowerShell proficiency is a critical admin skill.

Microsoft Graph is the unified REST API for all Microsoft 365 data and services. It provides a single endpoint (graph.microsoft.com) through which applications and scripts can read and write users, groups, emails, calendar events, Teams messages, SharePoint files, and much more. It is the foundation for all modern Microsoft 365 integrations and automation.

The Microsoft Graph PowerShell SDK replaces older service-specific modules (MSOnline, AzureAD) with a unified set of cmdlets wrapping the Graph API. It provides consistent authentication via Microsoft Entra ID and access to every Microsoft 365 resource from a single module.

Intune is a cloud-based endpoint management solution within Microsoft 365. It manages Windows, macOS, iOS, and Android devices — applying configuration profiles, compliance policies, software deployments, and security settings from a central admin portal. Intune integrates with Azure AD and Conditional Access to enforce device compliance as a condition of accessing corporate resources.

MDM (Mobile Device Management): full device management at the OS level — enforce PIN requirements, encryption, app whitelists, OS updates, and remote wipe the entire device. Appropriate for corporate-owned devices. MAM (Mobile Application Management): manages specific applications rather than the full device. App protection policies restrict copy/paste to personal apps, require app PINs, and can remotely wipe only corporate data. Appropriate for BYOD scenarios.

Compliance policies define security standards a device must meet — minimum OS version, BitLocker encryption enabled, screen lock with PIN, antivirus active. Intune marks devices compliant or non-compliant. Conditional Access policies can then block non-compliant devices from accessing corporate data entirely.

Windows Autopilot is a zero-touch provisioning technology allowing new devices to be shipped directly from OEM to end users, who set them up with their corporate credentials. Autopilot reads the device hardware ID from a cloud profile and automatically joins Azure AD, enrolls in Intune, and applies all policies and apps — without IT ever physically touching the hardware.

A full wipe factory-resets the device, removing all data and settings — used for lost, stolen, or decommissioned corporate devices. A selective wipe removes only corporate data and managed app data, leaving personal content (photos, personal apps) completely untouched — the appropriate action for BYOD devices when an employee leaves.

Windows Update for Business, managed through Intune update rings, controls when and how Windows feature and quality updates are deployed. Admins configure deferral periods, deployment rings (pilot, broad, critical), and deadline enforcement — enabling controlled, staged rollouts rather than immediate OS updates across all devices simultaneously.

The Service Health Dashboard in the Microsoft 365 Admin Center shows real-time operational status of all Microsoft 365 services. Admins view active incidents, advisories, and planned maintenance, plus a historical view of past incidents with root cause analyses — useful for reporting SLA impact to stakeholders.

Message trace tracks the journey of a specific email through Exchange Online infrastructure — from sender to recipient, including every hop and delivery failure. It is the primary tool when users report missing emails, providing detailed delivery status and reason codes for non-delivery reports.

SSPR allows users to reset their own passwords without contacting the helpdesk, using pre-registered authentication methods — mobile app, email, phone call, or security questions. Enabling SSPR significantly reduces helpdesk call volume and gives users immediate access restoration outside business hours.

License reconciliation is auditing assignments to ensure no licenses are wasted on inactive accounts or former employees. Regular reconciliation reduces costs and ensures licenses are available for new hires. Group-based licensing automatically assigns licenses to users in an Azure AD group — add a user to the group and the license is assigned automatically, removing manual overhead.

When a user account is deleted, it enters a soft-delete state for 30 days. During this period, the account — including its mailbox, OneDrive, and Azure AD object — can be fully restored from the Admin Center or via PowerShell. After 30 days, the account is permanently deleted and standard recovery is no longer possible.

Check in Azure AD that the account is enabled and not blocked. Verify the password hasn't expired and the correct license is assigned. Review Azure AD Sign-in logs for the exact error code. Check whether a Conditional Access policy is blocking access (device non-compliance, unrecognised location). If MFA is configured, ensure the user's authentication methods are registered and functional.

Run a message trace in the Exchange Admin Center to identify the failure point. Check that SPF and MX DNS records are correctly configured. Review outbound transport rules — a rule may be blocking or redirecting messages. Verify outbound connectors if routing through a third-party gateway. Check whether the destination domain has blocked your sending IP range.

Use message trace to confirm whether emails arrived at Exchange Online and where they went. Check the user's Junk Email, Deleted Items, and Recoverable Items folders. Review inbox rules that may auto-file or delete messages. Check quarantine for spam-flagged messages. Verify whether a retention or deletion policy has acted on the content.

Open Identity Protection and review the specific risk events — what triggered the flag (leaked credentials, suspicious location, etc.). Force an immediate password reset and confirm MFA is registered. Revoke all active sessions via "Revoke sessions" in Azure AD. Review recent sign-in history and audit logs for any malicious activity.

Act immediately: block sign-in in Azure AD. Reset the password to a strong, unique value. Revoke all active authentication tokens. Re-enable MFA and verify authentication methods are ones the user recognises. Review audit logs and mailbox rules for signs of data exfiltration or lateral movement. Report per your organisation's security incident response process.

First check the Service Health Dashboard for active Teams incidents. Verify the affected user has a valid Teams license. Ask the user to try the Teams web client (teams.microsoft.com) to isolate whether the issue is app-specific or service-wide. Have them clear the Teams desktop app cache. Check Conditional Access policies for rules that might block Teams on specific device types.

Enable the In-Place Archive mailbox (if the license supports it) and configure a retention policy to move older email to archive automatically. Alternatively, upgrade to a license with a larger mailbox quota. For immediate relief, have the user empty large items and their Deleted Items folder. Evaluate whether large attachments should be stored in SharePoint or OneDrive instead.

Commonly caused by a legacy authentication protocol being used by an older Outlook version, or a Conditional Access policy change that invalidated the stored token. Ensure Modern Authentication is enabled for the tenant and Outlook client. Clear Windows Credential Manager of stored Office credentials. Verify MFA registration is current.

Follow an offboarding checklist: (1) Disable sign-in immediately. (2) Reset the password. (3) Assign admin access to the mailbox and OneDrive. (4) Export or transfer any business-critical data. (5) Remove from all groups and distribution lists. (6) Remove or transfer licenses. (7) Document the offboarding actions for audit purposes. Only then delete the account — the 30-day recovery window applies.

Review the reported phishing email in Threat Explorer (Defender for Office 365). Use message trace to identify all recipients. Identify and block the sender domain and any malicious URLs. Check sign-in logs for users who may have entered credentials on a phishing page — treat those accounts as compromised and initiate account remediation. Report to Microsoft via the Report Message add-in.

Zero Trust replaces the old "trust but verify" model with "never trust, always verify." Every access request — regardless of originating inside or outside the corporate network — must be authenticated, authorised, and continuously validated based on all available signals: identity, device health, location, and the sensitivity of the resource being accessed. Microsoft 365 is built on Zero Trust principles through Azure AD, Conditional Access, Intune, and Defender products.

Customer Lockbox provides organisations explicit control over Microsoft engineer access to their content. When Microsoft support needs to access tenant content to resolve an issue, a Customer Lockbox request is generated — an admin must approve or deny it within a time window. Included in Microsoft 365 E5 and available as an add-on for E3.

Multi-geo allows enterprises to store specific users' data (Exchange mailboxes, OneDrive, SharePoint) in a chosen geographic region — for example, EU employees' data pinned to European data centres. Used primarily to meet data residency requirements under local data protection laws such as GDPR. Requires specific add-on licensing.

Identity governance (Azure AD Premium P2) manages the entire lifecycle of user access. Key tools: Entitlement Management (package-based access requests and approvals), Access Reviews (periodic certification of who has access to what), and Lifecycle Workflows (automating onboarding and offboarding tasks based on HR system events).

Cyber resilience is an organisation's ability to continue operating and recover quickly after a cyber attack. For Microsoft 365 environments this means tested retention and backup strategies, incident response plans, emergency admin accounts, business continuity runbooks, and monitoring enabling rapid detection and containment of threats.

Continuous compliance moves away from point-in-time audit snapshots toward real-time, automated monitoring of compliance controls. In Microsoft 365 achieved through Compliance Manager (continuously evaluating controls against regulatory frameworks), alert policies, DLP monitoring dashboards, and automated responses to compliance violations.

Microsoft 365 offers: zero hardware investment, automatic security patching, geo-redundant infrastructure with a 99.9% uptime SLA, built-in enterprise security features, and a predictable per-user subscription cost model. The continuous innovation cadence means organisations automatically benefit from platform improvements without major upgrade projects.