Microsoft 365 overview

Microsoft 365 lives in the Cloud area, which brings every customer's tenant into one place. Tenvara reads each tenant on a schedule, checks its security against one baseline, lets you make everyday changes to users, groups, mailboxes, Teams and SharePoint, runs starters and leavers (in the cloud or in the customer's own Active Directory), and looks after the email authentication (SPF, DKIM, DMARC, MTA-STS) of every customer domain. It also manages Intune, keeps every version of each tenant's configuration, holds tenants to your own baselines, finds the apps people use, keeps an inventory of every enterprise app across your tenants with a kill switch, and answers signs of a compromised account.

You choose per tenant which of these Tenvara does. See Choosing features and consent.

Note: The Cloud area needs the Microsoft 365 module. A new install starts with the service desk; switch the module on in Settings > Modules.

How it works#

• One app registration. You register one multi-tenant app in your own Entra tenant and enter it once in Settings. Every customer consents to that app, and Microsoft 365 backup uses the same connection, so a customer admin only approves once. Tenvara checks the registration itself every day and tells you what is missing. See Connecting a tenant and App registration health and Fix it for me.
• Features you choose. Backup, audit, changes, email security, licence sync, security monitoring, coverage reports and hybrid identity are separate features. The consent asks only for what the chosen features need, and a feature can be turned on or off later from the tenant's Features tab.
• Sync reads, screens show the mirror. Tenvara reads each tenant in areas (directory, security settings, Exchange, sign-ins, email and the rest) on a schedule. Each area of each tenant is read on its own and long areas are read in short steps, so a slow or broken tenant never delays the others and quick checks never wait behind a big sync. A sync stopped part-way (a restart or an error) carries on where it stopped, and tenants' syncs are spread across each interval rather than all starting together. Screens, checks and reports read what the last sync saw. A change you make goes to Microsoft and the changed object is read again straight away.
• Not known is never a pass. When Microsoft will not give something (a missing licence, a permission, an outage), Tenvara records it as not known and says so. A check with no data is shown as Not known, never as passing.
• Every change goes through the change log. A change shows a preview first, asks you to type the name for anything destructive, can need an administrator's approval, and is recorded with what it was before so it can be undone. It can run now or at a set time, undo itself after a time limit, and add a note to its ticket. See Making changes safely.

The Cloud sidebar#

Open Cloud from the rail. The sidebar starts with Overview (the page described below), then the Microsoft 365 and Across tenants groups, and Intune.

Microsoft 365

• Tenants: every connected tenant, with its accounts, MFA, licences and last sync.
• Users: everyone in every tenant. The Views menu has Administrators, No MFA, Blocked but licensed, Guests, Not signed in for 90 days, At risk, Guests not signing in and VIPs.
• Findings: every security check across all tenants.
• Starters and leavers: new accounts and leavers, run now or later.
• Changes: every change made through Tenvara, with undo. Its tabs are Changes, Approvals and Scheduled.
• Email security: every customer mail domain and its DNS checks, with a Report inbox tab for DMARC and TLS report mail.

Across tenants

• Threats: signs of a compromised account. See Account threat response.
• Security reports: posture, compliance, threat and MFA reports and an executive summary, as PDF or CSV, sent now or on a schedule (the Report schedules tab).
• Forwarding and Inbox rules across every tenant.
• SaaS apps: see SaaS discovery.
• Apps across tenants: every enterprise app in every tenant, the kill switch, the cleanup review and approved apps. See Apps across tenants and the kill switch and App cleanup, approved apps and the watchlist. In the Company edition this item is Enterprise apps.
• Service health, with the tabs Issues and Message centre.
• Configuration backup: every tenant's settings kept as versions, with a Changes to review tab. See Configuration snapshots.
• Tenant baselines: see Baselines and drift.
• Sync timeline: how long each tenant's sync takes and which areas run late, with the tabs Slowest tenants and Areas running late. See The sync timeline and Microsoft throttling.

Intune

• Intune is one page with the tabs Overview, Devices, Policies, Apps, Autopilot, BitLocker and LAPS, Templates, Bundles and Template updates. See Intune and Autopilot, GDAP, LAPS and BitLocker, Importing the OpenIntuneBaseline and Intune template bundles and updates.

Cloud settings at the bottom opens Settings > Microsoft 365: the app registration and its health, partner access, checks, starter and leaver templates, email security, timings, Intune, contacts, configuration and baselines, service health, SaaS discovery, account threats, alerts, the default features, your own apps, the App watchlist and Approved apps.

The counts beside each item show what needs a look (for example, the number of critical findings beside Findings).

Note: Every framework's controls against every tenant are in Governance and compliance > Microsoft 365 frameworks. A tenant's own Findings tab also has its Frameworks view.

Reading the overview#

The top row sums up every connected tenant:

• Tenants: how many are connected, with any waiting for consent underneath.
• Accounts: every account across the tenants, split into people, guests, blocked accounts and shared, room and service accounts, with how many are licensed.
• MFA registered: the share of people with an MFA method. Shared mailboxes, rooms, Bookings calendars and the directory sync account are not people, so they are never counted as people without MFA. People in tenants without Entra ID P1 are counted as not known, because Microsoft does not report their registration.
• Licences: assigned out of bought, with the number bought and unused. Microsoft's free and trial offers are left out of the totals.

Security posture shows the Average score across scored tenants, Critical findings, the average Secure Score as a share of Microsoft's maximum, and Security events this week (new admins, policy changes, app consent). Below that, Lowest scores lists the tenants that need the most work and Worst findings lists the most serious failing checks, with how many tenants fail each. Click any of them to open it.

Email security sums up the customer domains: how many have problems, how many need attention, the share passing DMARC and the messages reported in the last seven days, a count per check and how many domains are at each DMARC stage.

Tenants that need a look lists any tenant refusing Tenvara, failing to sync, waiting for consent or with a GDAP relationship ending soon, with what Microsoft said. A tenant that needs to consent to new permissions shows Consent again. Recent changes shows the latest changes made through Tenvara.

Where else Microsoft 365 shows up#

• Customer page: the Cloud tab has a Microsoft 365 page with the tenant summary, findings, users, licences, email domains and recent changes, and a block with the tenant's open threats, configuration changes to review, baseline drift and high-risk apps.
• Contact page: the contact's Microsoft 365 account (matched by email address), with the same Actions menu as the user panel.
• Ticket: the requester's Microsoft 365 account in the right-hand column, with the same Actions menu. A change made for a ticket adds an internal note to it. See Bulk, scheduled and time-limited changes. A ticket raised from a Microsoft 365 alert about someone (a suspicious inbox rule, say) also shows an Affected user card: the person linked to their user panel, their sign-in state, risk, last sign-in and a summary of the last 7 days of sign-ins, the rule where there is one, and Sign out everywhere, Reset password, Block sign-in and Disable this rule for people who manage Microsoft 365. Each change is noted on the ticket, and a change sent for approval from the ticket comes back to it.
• Device page: the Microsoft 365 block on the device's Overview tab shows Intune's record of the device once the two are linked, with the Intune remote actions and its BitLocker keys and LAPS password. The device list has a Managed by Intune column and filter. See Devices linked to Intune.
• Search (Ctrl K or Cmd K): go to Cloud pages, connect a tenant, find a user, reset a password, block a user, start a new starter or leaver, and find a device's BitLocker key or LAPS password.

Alerts#

Microsoft 365 raises alerts into the normal Alerts list, so your alert rules can turn them into tickets:

Once a day Tenvara can also raise an alert for each tenant where people asked for quarantined mail to be released, and an alert when a licence your starter templates use has run out.

Tenvara also raises alerts for audit events you choose in Settings > Microsoft 365, the Alerts tab (credentials added to an app, a high-privilege grant, guests invited, an account allowed to sign in again, an administrator's password reset, users or licences changed outside Tenvara and more), each on or off with its severity, for every customer or per customer. A tenant can be muted until a set time, for example during a migration. Changes made by Tenvara itself never count as "outside Tenvara", and activity by your own app that lines up with Tenvara's own jobs is labelled as expected. Tenvara's own app receiving the directory roles it asked for when a tenant is connected is a line on the timeline, not a detection.

Each kind of alert can be switched on or off and given its own severity in Alerts > Alert types.

Permissions#

Microsoft 365 has its own permission area in Roles and permissions:

A role also has a Change Microsoft 365 switch. With it off, people in that role can still look at everything, but every change to a tenant is refused: single changes, bulk changes, scheduled changes when their time comes and changes an administrator approved for them. See Making changes safely.

High-risk changes are approved through the one approvals engine, so they appear in Home > Approvals with everything else.

Comparing what a customer is billed for with what their tenant holds is covered in Reconciling against Microsoft 365.