View source for TenantTool/UserGuide

{{DISPLAYTITLE:{{SUBPAGENAME}}}}

Test userGuide


# TenantTool — User Guide

Complete reference for managing Microsoft 365 tenants — reports, configuration, scheduled automation and diagnostic tools.

|Format|Lien|
|------|-------------|
|HTML interactif|https://claude.ai/artifact/4tAJUkt1kr61xxEy6KneDQ|
|Confluence Wiki Markup|https://claude.ai/artifact/Dw2ZYTinKjFxwQ56RhSDmC|
|Markdown|https://claude.ai/artifact/UNJUHUaG9DL74Nuk5jSJhT|


---

## Table of Contents

- [Overview](#overview)
- [Roles & Permissions](#roles--permissions)
- [Reports](#reports)
- [Automatic Reports](#automatic-reports)
- [Tenant Configuration](#tenant-configuration)
- [Tools](#tools)
- [User Management](#user-management-admin-only)
- [My Organisation](#my-organisation-admin-only)
- [Logs & Security](#logs--security-admin-only)
- [Clients](#clients-admin-only)
- [Common Workflows](#common-workflows)

---

## Overview

TenantTool is an internal web application for managing and auditing Microsoft 365 tenants. It connects to each tenant's Microsoft Graph API to pull live configuration data, generate reports, and apply standardised settings.

**Key capabilities:**

- **Reports** — On-demand tenant health reports covering Entra ID, Exchange, Teams, SharePoint, Intune, Conditional Access and more
- **Automatic Reports** — Schedule reports to be generated and emailed on a recurring basis (daily, weekly, monthly, quarterly or yearly)
- **Tenant Configuration** — Review and manage tenant-level settings for Identity, Intune, Mail, SharePoint and Teams
- **Tools** — Standalone utilities: Mail Header Analyzer, Domain Tools and Intune Log Analyzer

### Logging in

1. Navigate to the TenantTool URL provided by your administrator
2. Click **Sign in** and enter your credentials. Passkey / WebAuthn authentication is also supported if configured
3. After sign-in you land on the Home page. The left sidebar shows the sections available to your role

---

## Roles & Permissions

Every TenantTool account is assigned one of three roles. Your role controls which sections appear in the sidebar and what actions you can take.

| Role | Description | Typical user |
|------|-------------|--------------|
| **Admin** | Full access to all features, including user management, SMTP configuration, audit logs and the clients directory | MSP internal team |
| **L1** | Operational access to reports, tenant configuration and automatic reports. Scope may be further restricted per client by an Admin | Technicians |
| **Report** | Read-only access to reports and automatic report history | Client representatives, management |

### Feature Access Matrix

> **CFG** = access is **configurable** by an Admin — it can be enabled or disabled per client via the _Page Access_ matrix in My Organisation.

| Feature | Admin | L1 | Report |
|---------|:-----:|:--:|:------:|
| **Reporting** | | | |
| On-demand tenant reports | ✅ | ✅ | ✅ |
| Automatic reports — view history & run now | ✅ | ✅ | ✅ |
| Automatic reports — create / edit / delete | ✅ | ❌ | ❌ |
| **Tenant Configuration** | | | |
| Gold Config | ✅ | ❌ | ❌ |
| Standard Config | ✅ | ❌ | ❌ |
| Policies Provisioning | ✅ | ❌ | ❌ |
| Identity (new tenant, users, groups) | ✅ | CFG | ❌ |
| Device | ✅ | CFG | ❌ |
| Intune | ✅ | CFG | ❌ |
| Mail | ✅ | CFG | ❌ |
| SharePoint | ✅ | CFG | ❌ |
| Teams | ✅ | CFG | ❌ |
| **Tools** | | | |
| Mail Header Analyzer | ✅ | ✅ | ✅ |
| Domain Tools (DNS / WHOIS) | ✅ | ✅ | ✅ |
| Intune Log Analyzer | ✅ | ✅ | ✅ |
| **Administration** | | | |
| Clients management | ✅ | ❌ | ❌ |
| User & invitation management | ✅ | ❌ | ❌ |
| My Organisation (SMTP, security, access rules) | ✅ | ❌ | ❌ |
| Platform Logs & Audit Log | ✅ | ❌ | ❌ |

---

## Reports

_Roles: Admin · L1 · Report_

The Reports section lists every tenant your account has access to. Each tenant can be opened to generate a live health report pulling data directly from Microsoft Graph.

### Generating a report

1. Click **Reports** in the sidebar — you will see a list of tenants sorted by client and name
2. Click the **View** button on the tenant row. TenantTool initiates an OAuth flow against that tenant's Azure AD — a consent page may appear on first use
3. A progress indicator shows while data is fetched from Microsoft Graph. Large tenants may take 15–30 seconds
4. The report opens with summary stat tiles at the top, followed by tabs for each domain area
5. Click **Export HTML** to download a self-contained file you can share or archive

### Report tabs

| Tab | Content |
|-----|---------|
| **Entra ID** | User counts, MFA adoption, guest accounts, admin roles, SSPR status, conditional access policies overview and licence summary |
| **Exchange** | Mailbox statistics, shared mailboxes, distribution lists, mail connectors and hygiene settings |
| **Teams** | Teams and channels count, guest access settings, meeting policies and external access configuration |
| **SharePoint** | Site collection list, storage usage, sharing settings and external access policies |
| **Intune** | Enrolled devices by platform, compliance status, configuration profiles with issues, and stale sync alerts |
| **Conditional Access** | List of all CA policies with enabled/disabled state, targets, grant controls and detected gaps |

> **Note:** Reports connect live to Microsoft Graph — no data is cached. Each time you open a tenant report, the latest data is fetched.

---

## Automatic Reports

_Roles: Admin · L1 · Report (view & run) — Admin only: create / edit / delete_

Automatic reports run on a schedule and send results by email. They are grouped by report type on screen. Use the header row to collapse or expand each group.

### Available report types

| Report type | Description |
|-------------|-------------|
| **O365 Client Report** | A comprehensive overview of the tenant's Microsoft 365 health — users, licences, mailboxes, security posture and more — sent as a formatted HTML email |
| **Check Exclusion Group Member** | Lists current members of security groups matching a configured name pattern, with the date and actor UPN of the most recent addition within the last 30 days |

### Creating a schedule _(Admin only)_

1. Click **"New schedule"** — the creation form slides in at the top of the page
2. Select the **tenant** this schedule will run against
3. Choose the **report type**
4. Configure **recipients**: From address · To — Client (optional) · To — Provider (comma-separated for multiple)
5. Set the **recurrence and time**: Daily / Weekly / Monthly / Quarterly / Yearly, and the local time of day. A specific first run date is optional — leaving it empty calculates the next occurrence automatically
6. Click **Save**. Toggle the switch in the first column to enable or disable without deleting

### Running a report immediately

1. Click the **▶ play button** on the schedule row
2. Optionally enter a **test email address** to redirect the report to yourself only
3. Click **Run** — a spinner shows while the report generates; a toast confirms the result

### Viewing execution history

Click the **history clock icon** on a schedule row to see the last 50 executions (start time, duration, error details). Click **All history** at the top of the page for the combined last 100 executions across all schedules.

> **Tip — Debug mode:** When enabled on a schedule, the raw source data is attached to the email for troubleshooting. Use only temporarily — it makes emails significantly larger.

---

## Tenant Configuration

_Roles: Admin · L1 (configurable per page — see Page Access in My Organisation)_

The Tenant Config section groups all pages that read or apply settings to a tenant. Access to each sub-page is controlled per client by the Admin via the Page Access matrix.

| Section | Description |
|---------|-------------|
| **Policies Provisioning** | Deploy and synchronise Gold or Standard configuration policies to a tenant in one step |
| **Identity** | New tenant onboarding, user management (create, disable, reset password) and group management (members, owners) |
| **Device** | Review and manage device compliance policies and Intune device settings |
| **Intune** | Manage Intune configuration profiles, compliance baselines and remediation policies |
| **Mail** | Review Exchange Online settings — connectors, transport rules, DKIM, anti-spam baselines |
| **SharePoint** | Manage SharePoint Online sharing settings, site access policies and storage quotas |
| **Teams** | Configure Teams policies, guest access, external calling and meeting settings |

> ⚠️ **Warning:** Tenant Config pages connect live to the tenant and can modify settings. Always confirm the target tenant before saving changes.

---

## Tools

_Roles: Admin · L1 · Report — no tenant connection required_

The Tools section provides standalone utilities that work entirely in the browser or on locally uploaded files.

### Mail Header Analyzer

Diagnoses email delivery by parsing raw email headers. It surfaces SPF, DKIM and DMARC authentication results, builds a hop-by-hop routing diagram, calculates per-hop delays, and decodes Microsoft antispam headers.

**How to use:**

1. **Get the raw headers** — In Outlook: open message → File → Properties → Internet headers. In Outlook Web: ⋮ → View message details. In Gmail: ⋮ → Show original
2. **Upload or paste** — Upload a `.eml` file with the _Load .eml file_ button, or paste the raw headers text into the text area
3. **Click Analyze** — Results appear immediately (no server call)
4. **Read the results** — Authentication summary (SPF / DKIM / DMARC), routing diagram with delays, hop-by-hop details, antispam header breakdown, and full raw header list

### Domain Tools

Combines DNS lookup and WHOIS information for any domain. Useful for verifying MX records, SPF / DKIM / DMARC DNS entries, registration details and NS propagation.

**How to use:**

1. Type the domain name (e.g. `contoso.com`) in the search field
2. Select the query type: DNS lookup, WHOIS, or both
3. DNS records appear in a formatted table; WHOIS shows registrar, registration and expiry dates, and nameservers

### Intune Log Analyzer

Parses a local **IntuneManagementExtension.log** file and surfaces Win32 app deployment results, PowerShell script executions, Proactive Remediation outcomes, and all errors and warnings — with health check indicators at the top.

**How to use:**

1. **Locate the log file** on the device: `C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log`
2. **Upload the file** — click _Choose .log file_ (up to 50 MB supported)
3. **Read the results** — six stat tiles summarise the log; five tabs break down the analysis:
   - **Checks** — health indicators (log freshness, error rate, deployment failures)
   - **App Deployments** — each Win32 app with success / failed status
   - **Scripts** — PowerShell script execution results
   - **Remediations** — Proactive Remediation detection and remediation outcomes
   - **Errors & Warnings** — filterable list of all error and warning log entries

---

## User Management _(Admin only)_

The Users page lets you manage who can access TenantTool. Access it from the top-right settings menu → **Users**.

### Inviting a new user

1. Click **"Invite user"**
2. Enter the **email address** — the invitation will be sent here
3. Select a **role**: Admin, L1, or Report
4. **Assign to a client** (optional) — limits visibility to that client's tenants only; leave empty for platform-wide access
5. Click **Send** — the user receives an activation email and clicks the link to set their password

> **Tip:** Invitation links expire after 7 days. Use the _Resend_ button on the user row to generate a new link.

### Managing existing users

From the action buttons on each row:

- **Edit** — change the role or client assignment
- **Resend invitation** — resend the activation email
- **Delete** — permanently removes the account

### Passkeys (WebAuthn)

TenantTool supports WebAuthn passkeys as a second factor or primary authenticator (if enabled in My Organisation). Users register their own from their profile page. Admins can view and remove registered passkeys from the Users page.

---

## My Organisation _(Admin only)_

Access from the top-right settings menu. Contains four tabs.

### Organisation tab

Sets the organisation name, logo and timezone. The timezone affects how scheduled report times are displayed and interpreted.

### Email (SMTP) tab

Configures the outgoing mail server used for invitation emails, password resets and automatic report delivery.

| Field | Description |
|-------|-------------|
| **SMTP Host** | Server address (e.g. `smtp-relay.brevo.com`) |
| **Port** | Typically 587 for STARTTLS |
| **Username / SMTP Key** | Credentials from your email provider |
| **From address** | The sender address displayed on all emails |
| **From name** | Display name (e.g. TenantTool) |
| **SSL / TLS** | Enable STARTTLS (recommended) |

Click **Send test** to send a test email to your own account and verify the settings before saving.

### Security tab

- **WebAuthn / Passkeys** — set the origin URL for passkey registration (must match the exact URL users access TenantTool from)
- **Session timeout** — maximum session duration in minutes before re-authentication is required

### Page Access tab

Controls which Tenant Config pages are visible to L1 users, per client. Each cell can be toggled independently — for example, granting a client's L1 team access to Identity without giving them access to Mail or Teams settings.

> **Note:** Changes to Page Access take effect immediately on the next page load.

---

## Logs & Security _(Admin only)_

### Platform Logs

Real-time application logs for the TenantTool server — errors, warnings and informational events. Use this to diagnose SMTP failures, authentication errors and report generation issues. Logs are streamed live and can be filtered by log level.

### Audit Log

A structured, read-only record of every significant action performed by any user — invitations sent, tenant reports viewed, schedules created or deleted, configuration changes applied.

> **Tip:** Platform Logs are the first place to look when an automatic report fails or an email is not received. Look for `ERROR` entries around the scheduled run time.

---

## Clients _(Admin only)_

Clients represent the organisations whose tenants TenantTool manages. Each client groups one or more tenants and can have dedicated L1 users scoped to it.

### Creating a client

1. Click **Clients** in the sidebar
2. Click **"New client"** and fill in the name, timezone and optional logo (appears on generated reports)
3. Add tenants from within the client's detail view
4. Invite or re-assign L1 or Report users to this client from the Users page

---

## Common Workflows

### Check a tenant's security posture _(Admin · L1)_

1. Go to **Reports** and click the tenant's **View** button
2. Review the **Entra ID** tab — check MFA adoption %, admin role count and guest account count
3. Review the **Conditional Access** tab — verify all critical policies are enabled and look for flagged gaps
4. Click **Export HTML** for a shareable snapshot

### Set up a new monthly report _(Admin)_

1. Go to **Automatic Reports** and click **"New schedule"**
2. Select the tenant, choose **O365 Client Report**, set recurrence to **Monthly**
3. Add the client's email in _To — Client_ and your team's email(s) in _To — Provider_
4. Pick an execution time when Graph API load is low (e.g. 06:00 local)
5. Use the **▶ play button** with your own email as override to verify the report before enabling
6. Toggle the schedule switch to **On**

### Diagnose a failed email delivery _(Admin · L1)_

1. Open **Tools → Mail Header Analyzer**
2. In Outlook: open the message → File → Properties → Internet headers. Copy the full text
3. Paste into the text area and click **Analyze**
4. Check **Authentication** — red chips indicate SPF / DKIM / DMARC failures
5. Check the **routing diagram** — orange/red hops indicate relay or filter delays
6. Check **Antispam headers** — SCL and CAT values explain spam or quarantine classification

### Diagnose an Intune app deployment failure _(Admin · L1)_

1. Copy `IntuneManagementExtension.log` from the device (`C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\`)
2. Open **Tools → Intune Log Analyzer** and upload the file
3. Check the **Checks** tab for health indicators
4. Open the **App Deployments** tab and filter to **Failed**
5. Use the **Errors & Warnings** tab and search by the app's GUID for full error context

### Onboard a new colleague _(Admin)_

1. Go to **Settings → Users** and click **"Invite user"**
2. Enter the colleague's work email and select the appropriate role (L1 or Report)
3. Assign to a client if they should only see specific tenants; leave empty for full access
4. Click **Send** — they receive an activation email
5. Configure **Page Access** in My Organisation if specific Tenant Config pages need to be unlocked for their client

---

_TenantTool Internal User Guide · For questions, contact your TenantTool administrator_