Microsoft 365 for Dental Offices (2026): Licenses, Accounts and MFA

"Friend is an oral surgeon, and I'm getting confused why they have so many Microsoft licenses." That December 2025 sysadmin-forum post described four licences, one front-desk person handling all the email and letters, and Outlook signed in to one mailbox on every computer. Plenty of dental offices run Microsoft 365 the same way: bought years ago, never inventoried.

This guide covers Microsoft 365 for dental offices from the owner's side: which plan fits, how many licences you actually need, when a shared mailbox replaces a licensed account, how a staff name or email change is done properly, which MFA settings to turn on, who should own the tenant, what happens to an account when someone leaves, and which Office versions still work with Dentrix, Open Dental and SoftDent. Every Microsoft fact below comes from Microsoft's own documentation, read on 6 November 2026. Patient email, Outlook encryption and domain records are covered separately in our guide to HIPAA email for dental offices.

Which Microsoft 365 plan does a dental office need?

Most single offices and small groups fit Microsoft's Business family, which is capped at 300 users. Business Basic gives web apps and a 100 GB mailbox, Business Standard adds the desktop Word, Excel and Outlook that dental software calls on, and Business Premium adds Microsoft Defender for Business and Intune Plan 1 for the computers that hold patient data.

Microsoft's plan-options service description says its Business base per-user plans "are designed for organizations with up to 300 users" and that it "reserves the right to enforce the tenant limit of 300 provisioned licenses across the Business family of plans." A DSO past that size moves to the Enterprise plans. The table records what Microsoft publishes; prices are shown only on Microsoft's compare page and change, so confirm them there.

Mailbox and archive sizes are from Microsoft's Exchange Online limits table; Defender for Business says it "is designed for small and medium sized business up to 300 users" and that "Business Premium includes Defender for Business"; the Business Premium device guide says "Business Premium includes Microsoft Intune Plan 1." Outlook's Encrypt button, and which plans include it, is covered in the HIPAA email guide.

A default by practice type. A solo or two-doctor office: Business Standard for everyone who signs in, or Business Premium if the IT provider will actually use Intune and Defender. A multi-location group: Business Premium across the board so every computer is enrolled and policies are uniform. A startup with no computers yet: decide the plan before the first mailbox is created, because the tenant name and domain are set then. If the group is already asking where IT money goes, our guide to hidden IT costs in dental groups covers licence sprawl alongside the other leaks.

How many Microsoft 365 licenses does a dental office need?

One licence for every person who signs in to Outlook, Word, Excel or OneDrive under their own name, and none for shared front-desk or billing addresses, which become shared mailboxes. Operatory computers do not need a licence of their own; the person using them does. Count people, not computers, then remove the licences assigned to people who left.

The forum thread in the opening is the common pattern: several Apps-only licences, one mailbox licence, and the same mailbox opened on every PC. A reply in the thread put Microsoft's per-user rule plainly: "Subscription licenses are per-user, with a limit on the number of devices. If you have 4 staff who use Office, you need 4 licenses, even if they only use one computer." There is a second reason to give each person their own account. The HIPAA Security Rule's technical safeguards at 45 CFR 164.312 list "Unique user identification (Required). Assign a unique name and/or number for identifying and tracking user identity." Ask your compliance adviser how that applies to you; from the IT side, one login per person is the only setup that makes audit logs, MFA and offboarding work.

Two dental-software facts shape the front-desk row. Henry Schein One's Dentrix System Requirements 2026 states: "Printing form letters and labels from Dentrix requires a current Microsoft-supported version of Microsoft Word with letter merge functionality to be installed." Open Dental's manual says "Letter Merge only works with Microsoft Word 2002 or later." So the people who print letters need a plan with desktop Word, and the operatory PCs that never print a letter do not.

A quarterly licence inventory is the simplest saving in Microsoft 365: list every assigned licence against the current staff roster, convert leavers' mailboxes to shared, and reduce the subscription count. Microsoft's admin centre lets you lower the quantity on the subscription page once the licences are unassigned.

When should the front desk use a shared mailbox instead of a licensed account?

Use a shared mailbox for any address the practice owns rather than a person: front desk, billing, referrals, recalls. It holds up to 50 GB without a licence, supports up to 25 users and opens through each person's own licensed account, so there is no shared password. Anyone who signs in as themselves needs a licensed account.

Microsoft's shared mailbox documentation sets the limits plainly: "A shared mailbox can store up to 50 GB of data without assigning a license to it," "A shared mailbox supports a maximum of 25 users," and "To access a shared mailbox, a user must have a licensed Exchange Online mailbox, but the shared mailbox doesn't require a separate license." It also carries the rule most offices miss: "Always block sign-in for the shared mailbox account and keep it blocked." A shared mailbox has a hidden user account with a system-generated password; nobody should ever sign in with it.

Three limits matter at a dental front desk. First, "You can't prevent users from deleting messages in a shared mailbox," so a referral or lab thread can vanish with one keystroke; Microsoft points to a Microsoft 365 group when deletion must be restricted. Second, email sent from a shared mailbox cannot be encrypted with Outlook's Encrypt button because the mailbox has no security context of its own, which is why the HIPAA email guide tells offices to send patient records from a named account or the patient portal. Third, over 50 GB the shared mailbox needs an Exchange Online Plan 2 licence to reach 100 GB, and a legal hold on it needs Plan 2 or Plan 1 with the archiving add-on.

Shared mailboxes also behave in ways staff do not expect. A small-business owner on the same forum listed them: "when someone chooses 'Reply all' and the shared mailbox address is automatically included, or the lack of automatically selecting the shared mailbox as the default sender address … when one person reads a message and everyone else sees it as read, or the need to change the signature every time because it can't be set automatically for a shared mailbox." Your IT provider should set each person's Outlook to send from the shared address, give the front desk a folder routine (New, In progress, Done) instead of marking things unread, and set the signature once in the shared mailbox's web settings.

How do you change a staff member's name and email address in Microsoft 365?

A Microsoft 365 administrator changes four things: the display name, the username (which is also the sign-in name), the primary email address, and an alias that keeps the old address delivering to the same inbox. Microsoft allows up to 400 aliases per user at no cost; alias changes can take up to 24 hours to apply.

This is the request behind "how to change last name on outlook email." The person cannot do it from Outlook; it needs someone with the right admin role. In the Microsoft 365 admin centre, the username and email live under "Manage username and email" and the display name under "Manage contact information." Microsoft's alias article states: "You can create up to 400 aliases for a user. No additional fees or licenses are required," and "It can take up 24 hours for the new aliases to update." Microsoft also recommends keeping the sign-in name and the primary address the same: "It's a best practice, however, to have the person's sign-in UPN match their primary SMTP address."

The steps your IT provider follows

1. 1. Confirm the request in writing: current name and address, new name and address, the date it should take effect.
2. 1. Change the display name under Manage contact information.
3. 1. Add the new address as an alias, then set it as primary; the old address drops to an alias automatically.
4. 1. Change the username to match the new primary address.
5. 1. Have the person sign out of Outlook, Teams and OneDrive on every computer and phone and sign back in with the new username.
6. 1. Update the signature, then send a test message from Outlook desktop and from Outlook on the web.

Step six is not ceremony. Microsoft documents a difference between the clients: "Outlook on the web will use the alias at which the email was received. Outlook desktop will use her primary email alias." If a patient writes to the old address and the front desk replies from the web, the reply still shows the old name unless the admin enables sending from aliases.

Two catches. If your subscription was bought through GoDaddy or another reseller, Microsoft says the new alias cannot be made primary in the Microsoft 365 admin centre; it has to be done in the reseller's own console. And a brand-new tenant or custom domain may refuse the change for up to four hours while setup finishes.

Everything outside Microsoft 365 that still carries the old name

• • The practice management software login (Dentrix, Eaglesoft, Open Dental, Curve or Denticon) and the user's name on clinical notes
• • The clearinghouse and payer-portal accounts, which need their own name and email change; see our guide to shared payer portal logins and MFA in dental groups
• • E-signature, patient-communication and online-review tools where the address is the login
• • The password manager entry and any MFA app registered to the old username; see password management for a dental office
• • The website team page, Google Business Profile and printed cards

Which MFA settings should every dental office turn on in Microsoft 365?

Turn on Microsoft Entra security defaults if the tenant has no premium licences: every user must register for MFA, administrators must complete MFA at every sign-in, and legacy authentication is blocked. Business Premium tenants should use Conditional Access policies instead, which let IT require MFA everywhere while allowing managed office computers to sign in cleanly.

Microsoft's security defaults page lists the controls: "Requiring all users to register for multifactor authentication," "Requiring administrators to do multifactor authentication," "Blocking legacy authentication protocols" and "Blocking device code flow." It adds that security defaults suit organisations "using the free tier of Microsoft Entra ID licensing" and that "If you're an organization with Microsoft Entra ID P1 or P2 licenses, security defaults are probably not right for you" because Conditional Access is available. Business Premium carries the P1 features; Basic and Standard do not.

The grace period is gone. Microsoft states: "Starting July 29, 2024, new tenants and existing tenants have the 14-day grace period for users to register for MFA removed." When prompted, users see a number in Outlook or Teams that they type into the Microsoft Authenticator app, which Microsoft added to "prevent users from falling for MFA fatigue attacks." Microsoft also enforces MFA on its own admin portals: "Starting in February 2025, MFA enforcement gradually begins for sign in to Microsoft 365 admin center," after the Azure portal, Entra admin centre and Intune admin centre in October 2024.

Microsoft's own list of methods includes "Microsoft Authenticator," "Authenticator Lite (in Outlook)," "Windows Hello for Business," "Passkey (FIDO2)," "OATH hardware token" and "SMS." For a front desk, the Authenticator app on a work or personal phone is the usual choice; for the office's emergency admin accounts, Microsoft recommends passkeys or certificate-based sign-in. MFA on the Microsoft account does nothing for the clearinghouse and payer portals, which have their own prompts; those are covered in the payer-portal guide linked above. Phishing is still the way most of these accounts are lost, and our guide to ransomware and phishing in dental practices explains what the attempts look like.

Who owns your Microsoft 365 tenant, and who holds the admin accounts?

The practice should own its tenant, hold its own Global Administrator account, and know who else has that role. Microsoft recommends fewer than five Global Administrators and two cloud-only emergency access accounts that belong to no individual. An IT provider managing the tenant should hold access the practice granted explicitly and can revoke.

Whoever signed up created the tenant. Microsoft says "By default, the user who creates a Microsoft Entra tenant is automatically assigned the Global Administrator role." In many dental offices that was a former office manager, a web designer or an IT company that no longer answers the phone. Microsoft's role guidance is specific: "Microsoft recommends that you assign the Global Administrator role to fewer than five people in your organization," and "Microsoft recommends that organizations have two cloud-only emergency access accounts permanently assigned the Global Administrator role." Those emergency accounts use the tenant's onmicrosoft.com domain, "aren't assigned to specific individuals," have their credentials stored securely, and are tested regularly; Microsoft suggests "for example, every quarter."

When an outside IT company administers the tenant through Microsoft's reseller programme, Microsoft's granular delegated admin privileges model applies: the provider receives time-bound, least-privilege roles that the customer must grant explicitly, rather than standing Global Administrator rights. Ask which model your provider uses. This matters most on the day you change providers, and our guide on fake IT support and voice-clone scams in dental offices shows why the admin account is the target.

What the practice should hold, in writing, at all times

• • The tenant's onmicrosoft.com name and the custom domain attached to it
• • The credentials for one Global Administrator account owned by the practice, with MFA registered to a device the owner controls
• • The two emergency access accounts, their storage location and the date they were last tested
• • The billing owner for the subscription, and whether it is billed by Microsoft or a reseller
• • Where the domain is registered and who can change its DNS records
• • A list of every account with any admin role, reviewed each quarter

If the only Global Administrator left with the last IT company, getting the tenant back means a support case with Microsoft, proof that the practice owns the domain, and time the front desk does not have. Collect the list above before you need it.

What happens to a Microsoft 365 account when someone leaves the practice?

On the last day, reset the password, sign the account out of every session, block sign-in, remove the mailbox from phones, then convert the mailbox to a shared mailbox or forward it, and finally remove the licence. Microsoft keeps the mailbox for 30 days after the licence is removed; after that it is gone for good.

Microsoft's seven-step series for a former employee sets the clock. A password reset plus "Sign out of all sessions" takes effect quickly: "Within an hour, or after the user leaves the current Microsoft 365 page they're on, they're prompted to sign in again." A block alone is slower: "Blocking an account can take up to 24 hours to take effect," so Microsoft says to reset the password first. On the licence: "When you remove or delete a license, the former employee's email, contacts, and calendar are retained for 30 days, and are then deleted permanently." OneDrive is different: "If you remove or delete a license but don't delete the account, the content in the user's OneDrive remains accessible to you even after 30 days."

One detail trips offices that convert and move on. Microsoft notes that if you do not reset the password before converting, "the original username and password will continue to work on the shared mailbox after the conversion is finished." Reset first, convert second, remove the licence third, and leave the account in place as the anchor. The wider leaver process, from the practice software to door codes, is in our guide to dental employee IT onboarding and offboarding.

Which Office versions still work with Microsoft 365 and your dental software?

Office 2016 and Office 2019 reached end of support on 14 October 2025, the same day as Windows 10. Microsoft 365 Apps on Windows 10 keep receiving security updates until 10 October 2028, but Microsoft says those computers should move to Windows 11. Dentrix and Open Dental need a supported Word; SoftDent supports only 32-bit Office 2019 and older.

Microsoft's 2025 end-of-support list names Microsoft Office 2016, Office 2019, Outlook 2016 and Outlook 2019 among the products that ended support on 14 October 2025. Its Microsoft 365 Apps guidance states "Support for Windows 10 ended on October 14, 2025," that Microsoft "will continue providing security updates for Microsoft 365 Apps on Windows 10 for three years after Windows 10 reaches end of support … ending on October 10, 2028," and that "those devices should move to Windows 11." Our guide on whether Windows 10 is still OK in a dental office covers the workstation side, and the companion piece on Windows Server 2016 end of support for a dental office covers the server.

The Office question also reaches the copier. Microsoft has retired the old sign-in method that scanners used to send email: "Basic authentication is now disabled in all tenants," and "We also disabled SMTP AUTH in all tenants where it wasn't being used." A copier that stopped scanning to email after an update is usually this, not a broken device; your IT provider sets up a supported sending method. New computers bought for the Office move should be specified for the practice software first; see which computers to buy for a dental office, and for the server side our dental servers and workstations service.

Does Microsoft sign a business associate agreement with a dental office?

Yes. Microsoft states that its HIPAA Business Associate Agreement "is available through the Microsoft Online Services Data Protection Addendum by default to all customers who are covered entities or business associates under HIPAA." It covers listed in-scope services such as Exchange Online, OneDrive for Business and Teams, and Microsoft says the agreement by itself does not satisfy a practice's obligations.

Microsoft's compliance page explains the relationship: "When a covered entity engages the services of a cloud service provider, such as Microsoft, the cloud service provider is a business associate under HIPAA." Its in-scope list for Office 365 names Exchange Online, SharePoint Online, OneDrive for Business, Microsoft Teams, Microsoft Entra ID, Microsoft Defender for Office 365, Forms, Planner and Microsoft Copilot, and Microsoft Intune appears among the in-scope platforms. Microsoft will not sign a practice's own form: "Microsoft can't use a customer's Business Associate Agreement."

The page is equally clear on the limit. Asked whether the agreement ensures compliance, Microsoft answers "No," and says that "using Microsoft services doesn't on its own" do it; the practice remains responsible for its own programme and for how the services are configured. Settings in this guide, such as MFA for every account, blocked sign-in on shared mailboxes, fewer admins and a proper leaver process, are the configuration side of that sentence. Keep a copy of the Data Protection Addendum with your other vendor agreements, and ask your compliance adviser about anything beyond the IT setup.

The IT side: what your IT provider should set up in Microsoft 365

A well-run dental tenant has a short list of settings behind it, and most can be checked in an afternoon. Here is what an IT provider managing Microsoft 365 for a dental office should have in place, with the Microsoft document each item comes from referenced earlier on this page.

Identity and access

• • MFA for every account through security defaults or Conditional Access, legacy authentication blocked
• • Fewer than five Global Administrators, each a named person with MFA, plus two cloud-only emergency access accounts tested quarterly
• • The practice's own Global Administrator account, separate from the provider's access
• • Sign-in blocked on every shared mailbox account

Mail

• • Shared mailboxes for every practice-owned address, with Send From set in each person's Outlook and a signature set once
• • Aliases in place for every past name and address so old mail still arrives
• • A supported sending method for copiers, scanners and practice software that email
• • The domain records (SPF, DKIM and DMARC) and encryption settings described in the HIPAA email guide

Licences and data

• • A quarterly licence inventory against the staff roster, with leavers converted to shared mailboxes and the subscription count lowered
• • A written leaver runbook following Microsoft's seven steps, with the one-hour, 24-hour and 30-day timings on it
• • Business Premium tenants: every office computer enrolled in Intune and Defender for Business reporting
• • Clarity on what Microsoft's retention does and does not cover for your OneDrive and SharePoint files, alongside your practice-software backup; see dental data backup

If a staff member has deleted a file or image that lived in OneDrive or SharePoint, the first-hour steps are in our guide on what to try when a patient file or X-ray has been deleted. An IT provider that offers managed IT services for dental practices should be able to show you this list, with dates, for your own tenant.

What to ask your IT provider about Microsoft 365

How Legend Networking can help

Legend Networking is a Dallas-based dental IT company with 22+ years in dental IT, and has served over 3,500 practices since 2004. Legend supports the IT environment for the practice software Dentrix, Eaglesoft, Open Dental and Archy, and for the imaging systems DEXIS, Vatech, Carestream, Planmeca/Romexis and Dolphin Imaging, which is where the Word requirement, the scanner that stopped emailing and the operatory sign-ins in this guide live. Support is handled by in-house engineers, with no outsourced first-level triage, remote-first nationwide, with onsite dispatch by appointment across served dental markets and 24/7 monitoring of the computers that hold your data.

The author, Ian Lynch, has 22 years in dental IT and oversees the NOC, onsite dispatch and client technology roadmaps. Legend holds a 4.8 rating from 173 Google reviews. For an example of the ground this covers, see a technology upgrade spanning computers, server infrastructure, networking, applications, software and security. Practices outside Texas can start from dental IT in your city.