Adding new module

ozahran7 · ozahran7 · commit d251992cc9c1 · 2026-04-14T10:17:57.000-07:00
diff --git a/learn-pr/achievements/surface-portal-onboarding-guide-badge-social.png b/learn-pr/achievements/surface-portal-onboarding-guide-badge-social.png
diff --git a/learn-pr/achievements/surface-portal-onboarding-guide-badge.svg b/learn-pr/achievements/surface-portal-onboarding-guide-badge.svg
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/1-introduction.yml b/learn-pr/device-partner-university/surface-portal-onboarding-guide/1-introduction.yml
@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.surface-portal-tenant-setup.introduction
+title: Introduction
+metadata:
+  title: Introduction
+  description: This content is part of the "Microsoft tenant setup for Surface Portal access" module.
+  ms.date: 04/14/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 1
+content: |
+  [!include[](includes/1-introduction.md)]
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/2-verify-whether-a-microsoft-tenant-exists.yml b/learn-pr/device-partner-university/surface-portal-onboarding-guide/2-verify-whether-a-microsoft-tenant-exists.yml
@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.surface-portal-tenant-setup.verify-whether-a-microsoft-tenant-exists
+title: Verify whether a Microsoft tenant exists
+metadata:
+  title: Verify Whether A Microsoft Tenant Exists
+  description: This content is part of the "Microsoft tenant setup for Surface Portal access" module.
+  ms.date: 04/14/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 2
+content: |
+  [!include[](includes/2-verify-whether-a-microsoft-tenant-exists.md)]
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/3-identify-the-global-administrator.yml b/learn-pr/device-partner-university/surface-portal-onboarding-guide/3-identify-the-global-administrator.yml
@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.surface-portal-tenant-setup.identify-the-global-administrator
+title: Identify the Global Administrator
+metadata:
+  title: Identify The Global Administrator
+  description: This content is part of the "Microsoft tenant setup for Surface Portal access" module.
+  ms.date: 04/14/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 2
+content: |
+  [!include[](includes/3-identify-the-global-administrator.md)]
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/4-assign-suitable-roles-for-surface-portals.yml b/learn-pr/device-partner-university/surface-portal-onboarding-guide/4-assign-suitable-roles-for-surface-portals.yml
@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.surface-portal-tenant-setup.assign-suitable-roles-for-surface-portals
+title: Assign suitable roles for Surface Portals
+metadata:
+  title: Assign Suitable Roles For Surface Portals
+  description: This content is part of the "Microsoft tenant setup for Surface Portal access" module.
+  ms.date: 04/14/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 4
+content: |
+  [!include[](includes/4-assign-suitable-roles-for-surface-portals.md)]
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/5-knowledge-check.yml b/learn-pr/device-partner-university/surface-portal-onboarding-guide/5-knowledge-check.yml
@@ -0,0 +1,84 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.surface-portal-tenant-setup.knowledge-check
+title: Knowledge check
+metadata:
+  title: Knowledge Check
+  description: This content is part of the "Microsoft tenant setup for Surface Portal access" module.
+  ms.date: 04/14/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 5
+quiz:
+  title: Check your knowledge
+  questions:
+  - content: "What must you verify before accessing either the Surface Management Portal or Surface Support Portal?"
+    choices:
+        - content: "That Surface devices are already enrolled in Intune"
+          isCorrect: false
+          explanation: "Incorrect. Device enrollment isn't required before validating tenant availability."
+        - content: "That your organization has a valid Microsoft tenant"
+          isCorrect: true
+          explanation: "Correct. Access to both Surface portals requires confirming that a Microsoft tenant exists."
+        - content: "That support roles have already been assigned"
+          isCorrect: false
+          explanation: "Incorrect. Roles are assigned after the tenant is validated and the Global Administrator is identified."
+        - content: "That billing and shipping addresses are configured"
+          isCorrect: false
+          explanation: "Incorrect. Address management is a role-based task and not a prerequisite for portal access."
+  - content: "If a valid Microsoft tenant already exists for your organization, what is the recommended next step?"
+    choices:
+        - content: "Create a new tenant through the Surface Support Portal"
+          isCorrect: false
+          explanation: "Incorrect. The guidance states that you shouldn't create a new tenant if one already exists."
+        - content: "Identify the Global Administrator and request the appropriate access"
+          isCorrect: true
+          explanation: "Correct. The Global Administrator can sign in, create users, and assign the required roles."
+        - content: "Assign yourself the Global Administrator role"
+          isCorrect: false
+          explanation: "Incorrect. You must already have Global Administrator permissions to assign roles."
+        - content: "Proceed directly to assigning Surface roles in Intune"
+          isCorrect: false
+          explanation: "Incorrect. You need appropriate admin access before assigning roles."
+  - content: "Which role is recommended for comprehensive access to both the Surface Management Portal and Surface Support Portal?"
+    choices:
+        - content: "Global Reader"
+          isCorrect: false
+          explanation: "Incorrect. This role provides read-only access and can't manage service or replacement requests."
+        - content: "Service Support Admin"
+          isCorrect: false
+          explanation: "Incorrect. This role can't manage shipping addresses and doesn't provide full access."
+        - content: "Microsoft Hardware Warranty Administrator"
+          isCorrect: true
+          explanation: "Correct. This role is recommended for overseeing service requests, replacements, and shipping and billing updates across both portals."
+        - content: "Microsoft Hardware Warranty Specialist"
+          isCorrect: false
+          explanation: "Incorrect. This role doesn't allow management of billing or shipping addresses."
+  - content: "Which capability isn't available to a user assigned the Microsoft Hardware Warranty Specialist role?"
+    choices:
+        - content: "Viewing service requests"
+          isCorrect: false
+          explanation: "Incorrect. The Specialist role allows users to view service requests."
+        - content: "Creating or managing device replacement requests"
+          isCorrect: false
+          explanation: "Incorrect. The Specialist role includes permission to create and manage replacements."
+        - content: "Adding, editing, or deleting ship-to addresses"
+          isCorrect: true
+          explanation: "Correct. This role doesn't include permissions to manage shipping addresses."
+        - content: "Read-only access to the Microsoft 365 tenant outside the support portals"
+          isCorrect: false
+          explanation: "Incorrect. This read-only access is included with the Specialist role."
+  - content: "What additional role is required for a Microsoft Hardware Warranty Administrator to access the Surface Management Portal only?"
+    choices:
+        - content: "Service Support Admin"
+          isCorrect: false
+          explanation: "Incorrect. This role focuses on support tasks and doesn't provide tenant visibility."
+        - content: "Billing Admin"
+          isCorrect: false
+          explanation: "Incorrect. This role manages billing and shipping but doesn't grant Entra visibility."
+        - content: "Global Reader"
+          isCorrect: true
+          explanation: "Correct. Global Reader provides read-only visibility into Microsoft Entra, which is required for Surface Management Portal access."
+        - content: "Global Administrator"
+          isCorrect: false
+          explanation: "Incorrect. Global Administrator isn't required and is discouraged for routine Surface management tasks."
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/6-summary.yml b/learn-pr/device-partner-university/surface-portal-onboarding-guide/6-summary.yml
@@ -0,0 +1,13 @@
+### YamlMime:ModuleUnit
+uid: learn.dpu.surface-portal-tenant-setup.summary
+title: Summary
+metadata:
+  title: Summary
+  description: This content is part of the "Microsoft tenant setup for Surface Portal access" module.
+  ms.date: 04/14/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: unit
+durationInMinutes: 1
+content: |
+  [!include[](includes/6-summary.md)]
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/includes/1-introduction.md b/learn-pr/device-partner-university/surface-portal-onboarding-guide/includes/1-introduction.md
@@ -0,0 +1,10 @@
+This module shows how to access Surface portals, verify that your organization's Microsoft tenant meets the required prerequisites, identify the Global Administrator, and assign the roles needed to get started. By completing these steps, you can confirm that your environment is ready to manage and support Surface devices through the Surface Management Portal and Surface Support Portal.
+
+>[!NOTE]
+> This module is for partners supporting customers. Some steps require customer tenant permissions (for example, Global Administrator).
+
+## Learning objectives
+
+- Verify Microsoft tenant availability of your organization's domain.
+- Identify the Global Administrator.
+- Assign required roles to enable access to Surface Management and Support Portals.
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/includes/2-verify-whether-a-microsoft-tenant-exists.md b/learn-pr/device-partner-university/surface-portal-onboarding-guide/includes/2-verify-whether-a-microsoft-tenant-exists.md
@@ -0,0 +1,21 @@
+To access either Surface Management Portal or Surface Support Portal, you must validate your organization's Microsoft tenant. A Microsoft tenant is your organization's private space in Microsoft's cloud. It gives your organization access to Microsoft services like:
+
+- Microsoft 365 (Outlook, Teams, SharePoint, etc.)
+- Entra ID
+- Surface Management and Support Portals
+
+Your organization's tenant is identified by its domain name. It's where users, devices, and data are managed securely. Before creating a new tenant, you must verify that one doesn't already exist. Do the following before creating a new tenant:
+
+:::image type="content" border="true" source="../media/check-tenant-status.gif" alt-text="Animation showing how to check tenant status using the Tenant Lookup tool.":::
+
+- Check if your organization has an existing tenant by visiting the [tenant validation page](https://gettenantpartitionweb.azurewebsites.net/).
+- Enter your organization's domain name to check if a tenant already exists.
+- Review the result.
+
+>[!IMPORTANT]
+> If a tenant exists, don't create a new one. Reach out to your IT team to get access to the Surface Management and Support Portal's onboarding process.
+
+If, upon using the tenant validation page, you discover that your organization already has a valid tenant, don't create a new tenant. Identify the Global Administrator and ask them to sign in and create a user account and assign the appropriate roles.
+
+>[!NOTE]
+> While validating through the Global Administrator is the recommended practice, creating a new tenant via Surface Support Portal is still an available option if needed.
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/includes/3-identify-the-global-administrator.md b/learn-pr/device-partner-university/surface-portal-onboarding-guide/includes/3-identify-the-global-administrator.md
@@ -0,0 +1,20 @@
+The admin centers—Microsoft 365 Admin Center (Surface Support Portal) and Intune Admin Center (Surface Management Portal)—are where administrators manage key settings. This includes assigning the user roles and permissions required to access each portal. In these admin centers, administrators assign the roles and permissions required to access each portal.
+
+Follow these steps to identify Golbal Admin in Microsoft 365 Admin Center:
+
+:::image type="content" border="true" source="../media/identify-global-admin.gif" alt-text="Animation showing how to identify the Global Admin in Microsoft 365 Admin Center.":::
+
+- Go to the Microsoft 365 Admin Center ([admin.microsoft.com](/admin.microsoft.com)).
+- Navigate to **Users** on the left-hand navigation pane, then select **Active Users** in the options bar.
+- Select **Filter**, then choose **Global Admins**.
+- Record the Global Admin contact information, then email them for access.
+
+To look up Global Admin on Intune Admin Center for Surface Management Portal:
+
+- Go to the Intune Admin Center ([intune.microsoft.com](/intune.microsoft.com)).
+- Navigate to **Users** on the left-hand navigation pane.
+- Select **Per-User MFA**.
+- In the View filter select **Global Administrators**.
+
+>[!IMPORTANT]
+> To assign access to Surface portals, you must have the Global Administrator role. If you're unable to access either of the Admin Centers or are unable to locate your Global Admin, reach out to your IT team for help in getting the appropriate access or contact information.
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/includes/4-assign-suitable-roles-for-surface-portals.md b/learn-pr/device-partner-university/surface-portal-onboarding-guide/includes/4-assign-suitable-roles-for-surface-portals.md
@@ -0,0 +1,42 @@
+:::image type="content" border="true" source="../media/assign-roles-surface-portal.png" alt-text="Photograph of a person using a Surface device in an office setting.":::
+
+Microsoft provides a range of built-in administrator roles designed for managing Surface devices through both the Surface Management Portal and the Surface Support Portal. These roles are tailored to facilitate efficient management and maintenance of Surface hardware within your organization. Let's review some of the available roles and the permissions that they have access to:
+
+| **Role type** | **Permissions** | **Description** |
+| :---: | :---: | :---: |
+| Global Admin | View service requests Create/manage device replacement requests Add/edit/delete ship-to addresses | Provides broad administrative control over Surface devices, but use is discouraged for specific Surface management tasks to minimize security risks. |
+| Service Support Admin | View service requests Create/manage device replacement requests | Focused role for managing service requests and device replacements without broader system access. |
+| Billing Admin | View service requests Create/manage device replacement requests Add/edit/delete ship-to addresses | Manages billing and shipping address aspects of device replacements and service requests. |
+| Global Reader | View all administrative settings and configurations across Microsoft Entra Read-only access to Microsoft 365 tenant and associated services | Perfect for audit, compliance, and oversight roles requiring view-only access to configurations and settings. |
+| Microsoft Hardware Warranty Admin | View all service requests. Create/manage device replacement requests. Add/edit/delete ship-to addresses. Read-only access to the Microsoft 365 tenant outside of the Surface Support Portal. | Best suited for managing comprehensive warranty-related tasks and service requests for Surface devices. |
+| Microsoft Hardware Warranty Specialist | View own service requests. Create/manage device replacement requests. Read-only access to the Microsoft 365 tenant outside of the Surface Support Portal. | Ideal for specialists handling specific service requests and device management tasks. |
+
+>[!NOTE]
+> To access Surface Management Portal (Intune), users assigned the Microsoft Hardware Warranty Admin or Microsoft Hardware Warranty Specialist role must also be assigned the Read Only Operator role.
+
+To assign new roles to users:
+
+- Open the necessary Admin Center (Microsoft 365 Admin Center for Surface Support Portal, Intune Admin Center for Surface Management Portal).
+- Select **Users**.
+- Select **Active Users**.
+- Select **Manage Roles**.
+
+A recommended role for access to both portals is the Microsoft Hardware Warranty Administrator role. This role is suited for overseeing the comprehensive management of Surface devices—granting access to view all support requests, service orders, and updating shipping and billing addresses. These functions are all crucial for overseeing the entire lifecycle of Surface device management.
+
+>[!IMPORTANT]
+> For Surface Management Portal access only, users assigned the Microsoft Hardware Warranty Administrator role must also be assigned the Global Reader role, which provides visibility into administrative settings and configurations across Microsoft Entra.
+
+Other roles that may be valuable are the Microsoft Hardware Warranty Specialist role, which allows for the creation and management of device replacement requests and a read-only view of the Microsoft 365 tenant outside of the support portals. However, this role doesn't have the ability to add, edit, or delete billing and shipping addresses.
+
+Implementing one or more of these roles ensures your team is equipped with the necessary permissions to manage Surface devices efficiently and securely. Let's review the available roles for accessing the portals and what their capabilities are:
+
+| **User roles and access level** | **View service requests** | **Create/manage device replacement requests** | **Add, edit, delete ship to addresses** |
+| :---: | :---: | :---: | :---: |
+| Global Admin | ✔️ | ✔️ | ✔️ |
+| Service Support Admin | ✔️ | ✔️ | ❌ |
+| Billing Admin | ✔️ | ✔️ | ✔️ |
+| Global Reader | ✔️ | ❌ | ❌ |
+| Microsoft Hardware Warranty Administrator | ✔️ | ✔️ | ✔️ |
+| Microsoft Hardware Warranty Specialist | ✔️ | ✔️ | ❌ |
+
+This information can help you or your IT team assign the appropriate role before proceeding with portal access. Now that you understand the key admin roles and how they unlock access to the Surface Management and Support Portals, you're ready to move forward with confidence.
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/includes/6-summary.md b/learn-pr/device-partner-university/surface-portal-onboarding-guide/includes/6-summary.md
@@ -0,0 +1,3 @@
+In this module, you learned how to validate your organization's Microsoft tenant, identify the Global Administrator, and assign the required administrative roles needed to access the Surface Management Portal and Surface Support Portal. These steps help ensure your environment is properly configured to begin managing and supporting Surface devices.
+
+You also explored how different administrator roles control access and capabilities across the portals, enabling your organization to assign the right permissions to the right users and confidently support the full Surface device lifecycle.
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/index.yml b/learn-pr/device-partner-university/surface-portal-onboarding-guide/index.yml
@@ -0,0 +1,43 @@
+### YamlMime:Module
+uid: learn.dpu.surface-portal-tenant-setup
+title: Microsoft tenant setup for Surface Portal access
+metadata:
+  title: Microsoft Tenant Setup For Surface Portal Access
+  description: "In this module, you'll learn how to set up a Microsoft tenant for accessing Surface Portal, including verifying tenant existence, identifying the global administrator, and assigning suitable roles for Surface Portals."
+  ms.date: 04/14/2026
+  author: ozahran7
+  ms.author: v-zahranomar
+  ms.topic: module
+  ms.service: surface
+summary: >
+  Learn how to set up a Microsoft tenant for accessing Surface Portal, including verifying tenant existence, identifying the global administrator, and assigning suitable roles for Surface Portals.
+
+abstract: |
+  By the end of this module, you're able to:
+  - Verify whether a Microsoft tenant exists for your organization to access Surface Portal.
+  - Identify the global administrator of your Microsoft tenant who can grant access to Surface Portal.
+  - Assign suitable roles for Surface Portals to ensure proper access and permissions.
+
+prerequisites: |
+  - None
+iconUrl: /training/achievements/surface-portal-onboarding-guide-badge.svg
+ratingEnabled: false
+levels:
+  - beginner
+roles:
+  - administrator
+  - business-leader
+  - business-owner
+  - business-user
+  - technology-manager
+products:
+  - surface
+units:
+  - learn.dpu.surface-portal-tenant-setup.introduction
+  - learn.dpu.surface-portal-tenant-setup.verify-whether-a-microsoft-tenant-exists
+  - learn.dpu.surface-portal-tenant-setup.identify-the-global-administrator
+  - learn.dpu.surface-portal-tenant-setup.assign-suitable-roles-for-surface-portals
+  - learn.dpu.surface-portal-tenant-setup.knowledge-check
+  - learn.dpu.surface-portal-tenant-setup.summary
+badge:
+  uid: learn.dpu.surface-portal-tenant-setup.badge
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/media/assign-roles-surface-portal.png b/learn-pr/device-partner-university/surface-portal-onboarding-guide/media/assign-roles-surface-portal.png
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/media/check-tenant-status.gif b/learn-pr/device-partner-university/surface-portal-onboarding-guide/media/check-tenant-status.gif
diff --git a/learn-pr/device-partner-university/surface-portal-onboarding-guide/media/identify-global-admin.gif b/learn-pr/device-partner-university/surface-portal-onboarding-guide/media/identify-global-admin.gif
