Making changes safely

Every change Tenvara makes in a customer's tenant, whether from a user, group or mailbox, a starter or leaver, or a fix to a finding, goes the same way: a preview, a confirmation that matches the risk, a record of what was there before, and a way to undo it. For users synced from Active Directory the same happens on the customer's domain controller (see Hybrid Active Directory).

The change dialog#

When you choose an action, the dialog shows:

• The action and its risk level, for example Destructive.
• The target and tenant, such as "hannah.walker@pembertonrhodes.law in Pemberton Rhodes Solicitors LLP".
• What will happen: plain lines built from what Tenvara last read, without calling Microsoft. For example, which MFA methods will be removed, how many free seats are left, or a warning that an address is outside the organisation.
• Whether the change can be undone.
• When, time limit and ticket, folded away until you need it (below).

Changes that need details (a group, a password option, an address) ask for them first and show the preview when you press Continue. Press the button named for the change (for example Add to group) to go ahead, or Cancel to leave it.

Some changes have tick boxes beside the preview, such as Also sign them out everywhere on Block sign-in. Changing one shows the preview again. A change made together with another (the sign-out after a block, or converting a mailbox before its licence goes) is logged as its own change with the same ticket, but it is confirmed and approved as part of the one you asked for, and the result says what both did.

Changes that allow more than now#

A change to a tenant setting is compared with the value the tenant has now. When it allows more than now (sharing from existing guests to anyone, guests from limited to the same as members, a Conditional Access policy from enforced to report-only, or putting back a looser value with undo), the first line of the preview says so and the confirm dialog shows a warning above What will happen, naming each part that loosens with its value now, for example "This allows more than now: anyone with the link can open files (now: only people in the organisation and existing guests)." A change that loosens one part and tightens another counts as loosening. It is logged as loosened, so the change log and the activity show who allowed more and when.

When the tenant already has the value you chose, the preview is one line, "No change: ... is already ...", and nothing is sent to Microsoft.

When, time limit and ticket#

• When: Now, or Later at a date and time on the customer's clock. The button becomes Schedule.
• Time limit: Undo it by itself at a set time, for temporary access. Only for changes that can be undone.
• Ticket: Link a ticket of the tenant's customer. When the change finishes, an internal note on the ticket says what was done, and you can log your time there too.

See Bulk, scheduled and time-limited changes for the details.

Risk levels#

The Change Microsoft 365 switch#

Each role in Settings > Roles and permissions has a Change Microsoft 365 switch. With it off, a person can hold Microsoft 365 Manage and still change nothing in a tenant: every change above routine is refused with "Your role does not allow changes in Microsoft 365". That covers single changes, bulk changes, starters and leavers, and fixes. A scheduled change is checked when it is scheduled and again when its time comes, and a change an administrator approved still runs as the person who asked, so it is refused if their switch was turned off in the meantime. Use it for people who should see everything about a customer's tenant without being able to touch it. See What each role switch controls.

When a change becomes high risk#

A change also becomes high risk when it affects more than 25 objects or more than one tenant, when it resets the password, MFA or Temporary Access Pass of someone who holds an administrator role, or when it changes membership or ownership of a group that can hold administrator roles.

Asking for approval#

When a technician starts a high-risk change:

1. The dialog asks for a reason.
2. The request goes to Home > Approvals, like every other approval in Tenvara, and is listed under Cloud > Changes, the Approvals tab, too. Approvers are told in the app and by email, and a request nobody answers expires (Settings > Microsoft 365, the Timings tab, under Changes and approvals). People who only work with some customers see only those customers' requests.
3. An administrator approves or turns it down. On approval the change runs as the person who asked, and one approval covers every target of a bulk change.

Administrators' own high-risk changes run straight away. Only an administrator can schedule a high-risk change for later.

Credentials are shown once#

New passwords and Temporary Access Passes appear once, in the result of the change, unless you chose to text them to the person or email a one-time link that shows them once. They are never saved in the change log, activity or tickets.

The one exception is a new starter: the password and pass are held encrypted for the person who started the starter, on the run's page, until they dismiss them or 24 hours pass. See Starters and leavers.

The change log#

Cloud > Changes lists every change made to your customers' tenants through Tenvara, newest first. Each row shows When, the Change, what it was On, the Tenant, By whom, How (from a technician, a starter or leaver, a fix, an approval, a schedule or an undo), the Ticket it was for and the Result. Changes made in Active Directory carry an Active Directory badge. Filter by when, change, tenant, person, how and result. The Approvals tab lists requests waiting for an administrator, at any age, and those decided in the last 14 days (the Decided view has every decided one), and the Scheduled tab what is waiting for its time.

A tenant's Actions tab shows the same log for one tenant.

Open a change to see what it was before and after, Microsoft's response, and the message. A failed change keeps Microsoft's own words so you can see why.

Undo#

Most changes record how to put things back:

To undo:

1. Open Cloud > Changes (or the tenant's Actions tab).
2. Open the change and choose undo. The undo is itself a logged change.
3. For a whole run, such as a leaver, undo the run: every reversible step is put back, newest first.

Undoing a destructive or high-risk change needs an administrator.

Warning: Some changes cannot be undone: a new password, removed MFA methods, signing someone out, removed mobile devices, unlocking an account, and deleting a distribution list. The dialog says so before you continue.

After a change#

The changed user, group or mailbox is read from Microsoft again straight away, so the screen is right without waiting for the next sync. After a change to a tenant setting, the security settings are read again 30 seconds later so the findings see Microsoft's answer. Every successful change also appears on the customer's timeline.