Connect a customer tenant

A real customer administrator signs in with Microsoft and completes administrator consent. The admin must be a Global Administrator or Privileged Role Administrator in the customer's directory.

The consent flow checks that the signed-in directory matches the invited tenant and that the invitation issuer is still an approved MSP. A tenant is linked only after those checks pass.

The standard consent lets TenantVigil read the customer's Microsoft 365 configuration for scans, findings, service health and the scoped inventory pages.

Assessment consent does not authorize setting changes. Native changes need their own Microsoft permission grants and registered callback URIs before use. SharePoint CSOM checks also need certificate access and the customer's SharePoint Sites.FullControl.All consent.

Missing consent, disconnection or confirmed lost access blocks scanning; TenantVigil then refuses to scan that tenant rather than returning results from stale or absent data. A missing source permission does not block the scan: the affected checks are left not read, while the rest of the scan still reports what it could read.

The onboarding page confirms consent with the server before the first scan starts. An incomplete consent is shown as incomplete, not as a scan failure.

Each person sees only the customer data their current grants allow. A customer's owners and admins see the MSP's access and recorded activity in Settings.

When a customer leaves your MSP or moves to another provider, your team's access ends with the relationship. The customer owner disconnects or leaves from Settings; native Microsoft grants may need separate removal in Microsoft Entra.

Review the permission model, then assign staff to customers.

• Microsoft permissions and customer access
• Assign staff to customers