TenantTool/UserGuide

Test userGuide

TenantTool — User Guide

Complete reference for managing Microsoft 365 tenants — reports, configuration, scheduled automation and diagnostic tools.

Format	Lien
HTML interactif	https://claude.ai/artifact/4tAJUkt1kr61xxEy6KneDQ
Confluence Wiki Markup	https://claude.ai/artifact/Dw2ZYTinKjFxwQ56RhSDmC
Markdown	https://claude.ai/artifact/UNJUHUaG9DL74Nuk5jSJhT

---

Table of Contents

• Overview
• Roles & Permissions
• Reports
• Automatic Reports
• Tenant Configuration
• Tools
• User Management
• My Organisation
• Logs & Security
• Clients
• Common Workflows

---

Overview

TenantTool is an internal web application for managing and auditing Microsoft 365 tenants. It connects to each tenant's Microsoft Graph API to pull live configuration data, generate reports, and apply standardised settings.

Key capabilities:

• Reports — On-demand tenant health reports covering Entra ID, Exchange, Teams, SharePoint, Intune, Conditional Access and more
• Automatic Reports — Schedule reports to be generated and emailed on a recurring basis (daily, weekly, monthly, quarterly or yearly)
• Tenant Configuration — Review and manage tenant-level settings for Identity, Intune, Mail, SharePoint and Teams
• Tools — Standalone utilities: Mail Header Analyzer, Domain Tools and Intune Log Analyzer

Logging in

1. Navigate to the TenantTool URL provided by your administrator
2. Click Sign in and enter your credentials. Passkey / WebAuthn authentication is also supported if configured
3. After sign-in you land on the Home page. The left sidebar shows the sections available to your role

---

Roles & Permissions

Every TenantTool account is assigned one of three roles. Your role controls which sections appear in the sidebar and what actions you can take.

Role	Description	Typical user
Admin	Full access to all features, including user management, SMTP configuration, audit logs and the clients directory	MSP internal team
L1	Operational access to reports, tenant configuration and automatic reports. Scope may be further restricted per client by an Admin	Technicians
Report	Read-only access to reports and automatic report history	Client representatives, management

Feature Access Matrix

CFG = access is configurable by an Admin — it can be enabled or disabled per client via the Page Access matrix in My Organisation.

Feature	Admin	L1	Report
Reporting
On-demand tenant reports	✅	✅	✅
Automatic reports — view history & run now	✅	✅	✅
Automatic reports — create / edit / delete	✅	❌	❌
Tenant Configuration
Gold Config	✅	❌	❌
Standard Config	✅	❌	❌
Policies Provisioning	✅	❌	❌
Identity (new tenant, users, groups)	✅	CFG	❌
Device	✅	CFG	❌
Intune	✅	CFG	❌
Mail	✅	CFG	❌
SharePoint	✅	CFG	❌
Teams	✅	CFG	❌
Tools
Mail Header Analyzer	✅	✅	✅
Domain Tools (DNS / WHOIS)	✅	✅	✅
Intune Log Analyzer	✅	✅	✅
Administration
Clients management	✅	❌	❌
User & invitation management	✅	❌	❌
My Organisation (SMTP, security, access rules)	✅	❌	❌
Platform Logs & Audit Log	✅	❌	❌

---

Reports

Roles: Admin · L1 · Report

The Reports section lists every tenant your account has access to. Each tenant can be opened to generate a live health report pulling data directly from Microsoft Graph.

Generating a report

1. Click Reports in the sidebar — you will see a list of tenants sorted by client and name
2. Click the View button on the tenant row. TenantTool initiates an OAuth flow against that tenant's Azure AD — a consent page may appear on first use
3. A progress indicator shows while data is fetched from Microsoft Graph. Large tenants may take 15–30 seconds
4. The report opens with summary stat tiles at the top, followed by tabs for each domain area
5. Click Export HTML to download a self-contained file you can share or archive

Report tabs

Tab	Content
Entra ID	User counts, MFA adoption, guest accounts, admin roles, SSPR status, conditional access policies overview and licence summary
Exchange	Mailbox statistics, shared mailboxes, distribution lists, mail connectors and hygiene settings
Teams	Teams and channels count, guest access settings, meeting policies and external access configuration
SharePoint	Site collection list, storage usage, sharing settings and external access policies
Intune	Enrolled devices by platform, compliance status, configuration profiles with issues, and stale sync alerts
Conditional Access	List of all CA policies with enabled/disabled state, targets, grant controls and detected gaps

Note: Reports connect live to Microsoft Graph — no data is cached. Each time you open a tenant report, the latest data is fetched.

---

Automatic Reports

Roles: Admin · L1 · Report (view & run) — Admin only: create / edit / delete

Automatic reports run on a schedule and send results by email. They are grouped by report type on screen. Use the header row to collapse or expand each group.

Available report types

Report type	Description
O365 Client Report	A comprehensive overview of the tenant's Microsoft 365 health — users, licences, mailboxes, security posture and more — sent as a formatted HTML email
Check Exclusion Group Member	Lists current members of security groups matching a configured name pattern, with the date and actor UPN of the most recent addition within the last 30 days

Creating a schedule (Admin only)

1. Click "New schedule" — the creation form slides in at the top of the page
2. Select the tenant this schedule will run against
3. Choose the report type
4. Configure recipients: From address · To — Client (optional) · To — Provider (comma-separated for multiple)
5. Set the recurrence and time: Daily / Weekly / Monthly / Quarterly / Yearly, and the local time of day. A specific first run date is optional — leaving it empty calculates the next occurrence automatically
6. Click Save. Toggle the switch in the first column to enable or disable without deleting

Running a report immediately

1. Click the ▶ play button on the schedule row
2. Optionally enter a test email address to redirect the report to yourself only
3. Click Run — a spinner shows while the report generates; a toast confirms the result

Viewing execution history

Click the history clock icon on a schedule row to see the last 50 executions (start time, duration, error details). Click All history at the top of the page for the combined last 100 executions across all schedules.

Tip — Debug mode: When enabled on a schedule, the raw source data is attached to the email for troubleshooting. Use only temporarily — it makes emails significantly larger.

---

Tenant Configuration

Roles: Admin · L1 (configurable per page — see Page Access in My Organisation)

The Tenant Config section groups all pages that read or apply settings to a tenant. Access to each sub-page is controlled per client by the Admin via the Page Access matrix.

Section	Description
Policies Provisioning	Deploy and synchronise Gold or Standard configuration policies to a tenant in one step
Identity	New tenant onboarding, user management (create, disable, reset password) and group management (members, owners)
Device	Review and manage device compliance policies and Intune device settings
Intune	Manage Intune configuration profiles, compliance baselines and remediation policies
Mail	Review Exchange Online settings — connectors, transport rules, DKIM, anti-spam baselines
SharePoint	Manage SharePoint Online sharing settings, site access policies and storage quotas
Teams	Configure Teams policies, guest access, external calling and meeting settings

⚠️ Warning: Tenant Config pages connect live to the tenant and can modify settings. Always confirm the target tenant before saving changes.

---

Tools

Roles: Admin · L1 · Report — no tenant connection required

The Tools section provides standalone utilities that work entirely in the browser or on locally uploaded files.

Mail Header Analyzer

Diagnoses email delivery by parsing raw email headers. It surfaces SPF, DKIM and DMARC authentication results, builds a hop-by-hop routing diagram, calculates per-hop delays, and decodes Microsoft antispam headers.

How to use:

1. Get the raw headers — In Outlook: open message → File → Properties → Internet headers. In Outlook Web: ⋮ → View message details. In Gmail: ⋮ → Show original
2. Upload or paste — Upload a .eml file with the Load .eml file button, or paste the raw headers text into the text area
3. Click Analyze — Results appear immediately (no server call)
4. Read the results — Authentication summary (SPF / DKIM / DMARC), routing diagram with delays, hop-by-hop details, antispam header breakdown, and full raw header list

Domain Tools

Combines DNS lookup and WHOIS information for any domain. Useful for verifying MX records, SPF / DKIM / DMARC DNS entries, registration details and NS propagation.

How to use:

1. Type the domain name (e.g. contoso.com) in the search field
2. Select the query type: DNS lookup, WHOIS, or both
3. DNS records appear in a formatted table; WHOIS shows registrar, registration and expiry dates, and nameservers

Intune Log Analyzer

Parses a local IntuneManagementExtension.log file and surfaces Win32 app deployment results, PowerShell script executions, Proactive Remediation outcomes, and all errors and warnings — with health check indicators at the top.

How to use:

1. Locate the log file on the device: C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\IntuneManagementExtension.log
2. Upload the file — click Choose .log file (up to 50 MB supported)
3. Read the results — six stat tiles summarise the log; five tabs break down the analysis:
   • Checks — health indicators (log freshness, error rate, deployment failures)
   • App Deployments — each Win32 app with success / failed status
   • Scripts — PowerShell script execution results
   • Remediations — Proactive Remediation detection and remediation outcomes
   • Errors & Warnings — filterable list of all error and warning log entries

---

User Management (Admin only)

The Users page lets you manage who can access TenantTool. Access it from the top-right settings menu → Users.

Inviting a new user

1. Click "Invite user"
2. Enter the email address — the invitation will be sent here
3. Select a role: Admin, L1, or Report
4. Assign to a client (optional) — limits visibility to that client's tenants only; leave empty for platform-wide access
5. Click Send — the user receives an activation email and clicks the link to set their password

Tip: Invitation links expire after 7 days. Use the Resend button on the user row to generate a new link.

Managing existing users

From the action buttons on each row:

• Edit — change the role or client assignment
• Resend invitation — resend the activation email
• Delete — permanently removes the account

Passkeys (WebAuthn)

TenantTool supports WebAuthn passkeys as a second factor or primary authenticator (if enabled in My Organisation). Users register their own from their profile page. Admins can view and remove registered passkeys from the Users page.

---

My Organisation (Admin only)

Access from the top-right settings menu. Contains four tabs.

Organisation tab

Sets the organisation name, logo and timezone. The timezone affects how scheduled report times are displayed and interpreted.

Email (SMTP) tab

Configures the outgoing mail server used for invitation emails, password resets and automatic report delivery.

Field	Description
SMTP Host	Server address (e.g. smtp-relay.brevo.com)
Port	Typically 587 for STARTTLS
Username / SMTP Key	Credentials from your email provider
From address	The sender address displayed on all emails
From name	Display name (e.g. TenantTool)
SSL / TLS	Enable STARTTLS (recommended)

Click Send test to send a test email to your own account and verify the settings before saving.

Security tab

• WebAuthn / Passkeys — set the origin URL for passkey registration (must match the exact URL users access TenantTool from)
• Session timeout — maximum session duration in minutes before re-authentication is required

Page Access tab

Controls which Tenant Config pages are visible to L1 users, per client. Each cell can be toggled independently — for example, granting a client's L1 team access to Identity without giving them access to Mail or Teams settings.

Note: Changes to Page Access take effect immediately on the next page load.

---

Logs & Security (Admin only)

Platform Logs

Real-time application logs for the TenantTool server — errors, warnings and informational events. Use this to diagnose SMTP failures, authentication errors and report generation issues. Logs are streamed live and can be filtered by log level.

Audit Log

A structured, read-only record of every significant action performed by any user — invitations sent, tenant reports viewed, schedules created or deleted, configuration changes applied.

Tip: Platform Logs are the first place to look when an automatic report fails or an email is not received. Look for ERROR entries around the scheduled run time.

---

Clients (Admin only)

Clients represent the organisations whose tenants TenantTool manages. Each client groups one or more tenants and can have dedicated L1 users scoped to it.

Creating a client

1. Click Clients in the sidebar
2. Click "New client" and fill in the name, timezone and optional logo (appears on generated reports)
3. Add tenants from within the client's detail view
4. Invite or re-assign L1 or Report users to this client from the Users page

---

Common Workflows

Check a tenant's security posture (Admin · L1)

1. Go to Reports and click the tenant's View button
2. Review the Entra ID tab — check MFA adoption %, admin role count and guest account count
3. Review the Conditional Access tab — verify all critical policies are enabled and look for flagged gaps
4. Click Export HTML for a shareable snapshot

Set up a new monthly report (Admin)

1. Go to Automatic Reports and click "New schedule"
2. Select the tenant, choose O365 Client Report, set recurrence to Monthly
3. Add the client's email in To — Client and your team's email(s) in To — Provider
4. Pick an execution time when Graph API load is low (e.g. 06:00 local)
5. Use the ▶ play button with your own email as override to verify the report before enabling
6. Toggle the schedule switch to On

Diagnose a failed email delivery (Admin · L1)

1. Open Tools → Mail Header Analyzer
2. In Outlook: open the message → File → Properties → Internet headers. Copy the full text
3. Paste into the text area and click Analyze
4. Check Authentication — red chips indicate SPF / DKIM / DMARC failures
5. Check the routing diagram — orange/red hops indicate relay or filter delays
6. Check Antispam headers — SCL and CAT values explain spam or quarantine classification

Diagnose an Intune app deployment failure (Admin · L1)

1. Copy IntuneManagementExtension.log from the device (C:\ProgramData\Microsoft\IntuneManagementExtension\Logs\)
2. Open Tools → Intune Log Analyzer and upload the file
3. Check the Checks tab for health indicators
4. Open the App Deployments tab and filter to Failed
5. Use the Errors & Warnings tab and search by the app's GUID for full error context

Onboard a new colleague (Admin)

1. Go to Settings → Users and click "Invite user"
2. Enter the colleague's work email and select the appropriate role (L1 or Report)
3. Assign to a client if they should only see specific tenants; leave empty for full access
4. Click Send — they receive an activation email
5. Configure Page Access in My Organisation if specific Tenant Config pages need to be unlocked for their client

---

TenantTool Internal User Guide · For questions, contact your TenantTool administrator