Working effectively with Microsoft Support

For Microsoft 365 issues that exceed your team's investigation capacity — service-side problems, complex configuration questions, suspected service incidents — Microsoft Support is the escalation path. Engaging effectively gets faster resolution; engaging poorly creates frustration on both sides. A few patterns help.

Before opening a case, check service health; for incidents the incident response runbook lists what Microsoft can and cannot do, for commercial escalations see working with your account team, and for onboarding help FastTrack.

When to engage Microsoft Support

Engage when:

• Suspected Microsoft service issue — and Service Health isn't yet showing an incident.
• Configuration-related issue — you've configured what you think is right, behaviour doesn't match.
• Microsoft tooling questions — specific feature not behaving as documented.
• Performance issue — user-impacting, ruled out client-side causes.
• License-related issue — billing, provisioning, or entitlement issues.

Don't engage for:

• User training questions — internal training.
• Issues you haven't first investigated — Microsoft will ask what you've already tried.
• Issues better-suited for community — learn.microsoft.com Q&A or tech community for "how-to" questions.

How to engage

Microsoft 365 tickets can be created via:

• Microsoft 365 admin centre → Support → New service request — the standard path for most issues.
• Premier / Unified Support portal — for organisations with premium support contracts.
• Microsoft FastTrack — for deployment-related issues (eligible organisations).
• Microsoft Partner Center — for CSP partner-managed tenants (partner opens the ticket).

Preparing a good support request

The faster Microsoft can understand your issue, the faster they help. Prepare:

• Concise description — what you're trying to do, what's happening, what should happen.
• Steps to reproduce — exact actions that trigger the issue.
• Time of occurrence — specific timestamps with timezone.
• Affected users — specific UPNs (not "many users").
• Error messages — exact text, error codes, screenshots.
• What you've tried — eliminates rabbit holes Microsoft would otherwise check.
• Service Health status — confirm no known incident applies.
• Audit log evidence if relevant.
• Network info — for performance issues.

Vague requests like "Email isn't working" produce slow responses. Specific requests like "User john@company.com gets 5.7.708 error on outbound mail to gmail.com addresses since 14:00 UTC; SPF passes; DMARC passes; Defender shows no anomaly" get fast meaningful responses.

Severity levels

Microsoft Support classifies severity:

• Severity A (critical) — complete service unavailability impacting many users; mission-critical service blocked. Microsoft commits to fastest response (typically within 1 hour for Unified Support).
• Severity B (high) — significant impact on production but with workarounds. Response within several hours.
• Severity C (moderate) — limited impact, not production-stopping. Response within a business day or two.

Match the severity to the actual impact. Inflating severity for a minor issue wastes Microsoft's time and yours; deflating severity for a major issue means slow response.

Escalation

If progress is slow:

• Ask for case escalation to a senior engineer.
• Engage your Microsoft account team (CSA, account executive) for high-impact issues.
• For Unified / Premier customers, the Technical Account Manager (TAM) can escalate internally.
• Twitter (X) sometimes gets attention for visible incidents but isn't a substitute for the formal channel.

Information you may be asked

Be ready to provide:

• Tenant ID — the GUID identifying your tenant.
• Microsoft 365 user UPNs affected.
• Test sign-in details if reproducibility requires.
• Screen recordings or screenshots.
• Defender XDR / Entra ID logs if the issue is identity- or security-related.
• Network connectivity test results if performance-related.
• Customer Lockbox approval — for issues requiring Microsoft engineer to access your tenant content directly (Microsoft 365 E5).

What to expect

• Initial response — Microsoft confirms ticket received, asks for additional info.
• Investigation phase — Microsoft engineer works the issue, may ask for screen-share or logs.
• Update cadence — varies by severity. For sev A, hourly updates; sev C, daily or longer.
• Resolution proposal — Microsoft suggests a fix or workaround.
• Verification — you confirm the issue is resolved.
• Closure — case closes; survey may be sent.

After resolution

• Document the fix in your internal runbook.
• Capture lessons — what to do differently if this recurs.
• Provide feedback in the post-case survey — Microsoft does track this.

For organisations with serious Microsoft 365 dependence, the relationship with Microsoft Support is a real operational asset. Treat it deliberately — well-prepared cases get fast responses; poorly-prepared cases drag on. The discipline of "describe specifically, demonstrate clearly" pays back continuously.