Microsoft permissions and customer access
How assessment reads, console grants and native action permissions stay separate, and which Exchange changes remain manual.
TenantVigil only reads your Microsoft 365 tenant. It never changes a setting: you apply each fix yourself.
Need a hands-on starting point?
Start with one tenant or talk to the team if you want help evaluating fit, permissions, or rollout approach.
Three permissions stay separate
TenantVigil keeps assessment reads, console access and native action permissions apart. Assessment consent lets TenantVigil read a customer's Microsoft 365 configuration. Console access decides which of your staff can open that customer in TenantVigil. Native action permissions decide which Microsoft changes TenantVigil may send.
None of the three stands in for another. A staff member with console access still needs the customer's Microsoft consent before TenantVigil can read the tenant, and a native change still needs its own Microsoft permission grant and registered callback.
Assessment reads
Standard customer-admin consent is read-oriented. It covers scans, findings, service health and the scoped inventory pages.
SharePoint CSOM checks are the exception within reads: they produce results only after certificate access and the customer's SharePoint Sites.FullControl.All consent are granted.
Console access
Partner admins see every customer the MSP owns. Members see only the customers assigned to them. Suspended or banned partners lose console access, and alerts stop.
A customer's owners and admins see a plain-English explanation of the MSP access they have granted.
Native action permissions
Native changes are not part of assessment consent. Each registered sender needs its Microsoft callback URI registered and its permission granted before it can call Microsoft for a customer.
The current default for approved fixes is stated at the top of this page. Even when fixes are on, a native action runs only after an exact plan, safety checks, scoped approval and the customer's Microsoft consent for that action.
Manual Exchange boundary
These Exchange changes have no supported Microsoft API, so TenantVigil does not automate them: mail forwarding, FullAccess, SendAs, distribution-list membership and an unsupported organisation setting.
A technician makes those changes manually in Microsoft 365 or PowerShell, then reports back in the product.
Next action
Assign staff to customers, or read the full supported-changes reference.
- Assign staff to customers
- Supported changes and manual work