Plan the change. Keep the receipt.
Stage exact supported plans with safety checks, require an authorized customer decision, and keep receipts of supported write attempts and readback outcomes.
Contoso Dental
Change plan
Add group member
Alex Rivera → Billing reviewers
Awaiting approval
Microsoft accepted the request
Today 14:02
Applied; not verified
Nobody can prove what a change did.
Change notes miss the exact user or group. Microsoft's response is lost in a portal tab, so nobody can show what happened.
What you get
Exact plans
Review supported changes and safety checks in an exact plan before customer approval.
Customer approval
Require an authorized customer decision on proposed changes, with emergency windows and stop checks for supported operations.
Attempt receipts
Review supported write attempts and readback outcomes, with compensation only where explicitly supported.
How it works
- 1
Build the plan
Stage the exact supported change and run its preflight safety checks.
- 2
Get approval
Require an authorized customer decision before a supported change runs.
- 3
Read the receipt
Review supported write attempts and readback outcomes; unclear outcomes stay unknown and are never resent.
What needs setup
Native changes require the relevant Microsoft permissions and registered callback URIs before they can run.
After that setup, supported actions include user creation and updates, password resets, sign-in blocking, phone-method removal, group membership and licence changes, and Intune sync, restart and retire.
Send-on-behalf, calendar permissions, group owners and guest settings use their supported native paths after Microsoft setup.
Limits
Mail forwarding, FullAccess, SendAs, distribution-list membership and unsupported organisation-setting changes are manual technician work.
TenantVigil only reads your Microsoft 365 tenant. It never changes a setting: you apply each fix yourself.
Related documentation
Connect a customer with administrator consent, then review the findings and service work in your console.