Tenants and the tenant page

Every connected tenant has its own page with the users, licences, security findings, groups, Teams, SharePoint sites, domains, mailboxes, sign-ins, apps and policies Tenvara read from it, the features Tenvara uses there, and your team's own notes.

The tenant list#

Cloud > Tenants lists every tenant with its Customer, Connection status (with Consent again when it needs to consent to new permissions), Accounts, MFA (the share of people with an MFA method registered, or Not known without Entra ID P1), Licences (assigned out of bought) and Last sync. When Microsoft refuses an area of a tenant, Last sync says so on one line, and its tooltip names each refused area. Filter by customer, connection and tags, choose columns, and save views.

Click a tenant to open its page.

The tenant page#

The page sits under Cloud > Tenants. The header shows the tenant name, its status, its tags (Add a tag), the Customer, main Domain, Connected by (how it was really connected: Admin consent, partner access, or Not connected yet) and Last sync (which also names any area Microsoft refused, for example "Microsoft refused the service health feed", and says "Microsoft is throttling this tenant until" a time while Microsoft holds it back). Beside them:

• Follow, to be told about changes to this tenant.
• Make a presentation makes a Microsoft 365 security review deck for the tenant's customer, to present, export or publish. See Presentations.
• Sync now reads every area from Microsoft straight away (queued). Keyboard shortcut S. While a sync of the tenant is already running, it says "A sync is running; your re-check runs straight after it."
• More actions (the ... button): Copy a new consent link, Copy Microsoft tenant id, Mute security alerts... (for a noisy migration, until a time you set), Exclude from automation and Remove tenant.

The tabs are (the ones that do not fit are under More):

A feature that is turned off hides its tabs.

Notes#

The Notes card on the overview is your team's own words about the tenant: who to call, what is unusual, what the next person should know. Press Add notes (or Edit once there are some). Notes are never sent to Microsoft, and the card shows who changed them last.

Domains#

The Domains tab lists every domain in the tenant with its Status (verified or waiting), what it is Used for (email, Teams), where its DNS is hosted and when Tenvara first saw it. Open a domain to see the records Microsoft asks for: the verification record while it waits, and the mail records once verified, each with whether it is in the DNS already. A domain left waiting for verification for more than seven days becomes a finding.

Teams and SharePoint#

• Teams lists each team with its owners, members, guests and channels (private and shared ones too), its privacy and when it was made, with an Archived view. Open a team to add, rename or delete channels, change owners and members, change what members and guests may do, archive it, or open it in Teams. New team makes one from a Microsoft 365 group the tenant has, or a new group with its owner and members. Starter templates can add new starters to teams.
• SharePoint shows the tenant's storage against Microsoft's allowance (1 TB plus 10 GB for each licensed user) and the tenant-wide sharing setting, then every site with its storage, files, last activity and sharing, with Shared externally and Inactive views. Open a site to see and change who can use it through its group. Tenvara raises an alert when storage passes 90%.

App secrets and certificates#

The Apps tab has an Expires column and an Expiring in 60 days view. Open an app to see every secret and certificate with its end date. When an app's newest secret or certificate ends within 30 days, Tenvara raises a warning (critical within 7 days, and once it has lapsed), and clears it when a new one is added. Microsoft's own apps are never judged, and Tenvara's own app is labelled as yours.

Licensed for#

The Licensed for block on the overview lists what Microsoft says the tenant has: Entra ID P1, Entra ID P2, Intune, Exchange Online, Defender for Office 365 and the Audit log. This decides what can be checked. For example, sign-in logs and Conditional Access need Entra ID P1, and risky users need P2. A check that needs something the tenant does not have is shown as not applicable rather than failing.

Licences#

The Licences tab lists every subscribed licence with Bought, Assigned, Unused and Status, using friendly names (for example Microsoft 365 Business Premium rather than SPB). Microsoft's free and self-service offers, which it lists with huge seat counts, are shown apart and never counted as bought licences.

When the customer's licences are billed through a licence source, a second table compares them: Supplied, what the tenant has, Assigned, Unused, Orphaned (supplied but not in the tenant), Over, Reclaimable and the Waste a month in money. See Reconciling against Microsoft 365.

Tenvara raises an alert when a tenant has more of a licence assigned than it bought, and clears it when it is back within.

Groups#

The Groups tab lists every group with its Kind (Security, Microsoft 365, Dynamic, Distribution list, Mail-enabled security), Members and Owners. Filter by kind.

• Press New group to create a security, Microsoft 365, dynamic (with a membership rule, needs Entra ID P1), distribution or mail-enabled security group.
• Open a group to see its members and owners, add and remove them, edit its name, description and visibility, or delete it.
• Distribution lists and mail-enabled security groups are changed through Exchange. Dynamic groups keep their own membership, so people cannot be added or removed by hand.
• A deleted Microsoft 365 or security group can be restored with undo; a deleted distribution list cannot.

Sync#

Tenvara reads each tenant in areas, each on its own schedule:

Each area of each tenant is read on its own, and long areas are read in short steps, so one big tenant never holds up the rest. A sync stopped part-way, by a restart or an error, carries on where it stopped rather than starting again, and tenants' syncs are spread across each interval instead of all starting at once. A newly connected tenant's first sync reads its whole last week of sign-ins.

After every sync the security checks run again. Sync now runs every area at once. Areas that belong to a feature that is turned off are not read. The intervals are in Settings > Microsoft 365, the Timings tab.

Tenvara paces what it asks of Microsoft so it stays within Microsoft's limits for each tenant. When Microsoft still asks it to slow down, that tenant's area waits and the rest carry on; the tenant list, the tenant page and the customer's Microsoft 365 tab say "Microsoft is throttling this tenant until" the time Microsoft gave, and the sync catches up afterwards without failing. A step that fails part-way is tried again from that step, not from the start of the area. To see when each area ran and why one waited, open the tenant's Sync timeline tab. See The sync timeline and Microsoft throttling.

Re-checks after a change#

A fix or a change (a security fix, a new team, a site) asks for the areas it touched to be read again. Asking while a sync of the tenant is queued or running never loses the re-check:

• If the area has not been read yet, the re-check joins the sync already queued, so a security fix followed by a new team is one sync.
• If the area is being read at that moment, it is read again straight after, once, however many changes came in meanwhile.

Sync history#

The Settings tab shows the Sync history, newest first: each area by name (Directory, Security settings, Exchange, Sign-ins and risk, Email (DKIM), Intune and devices, Teams and SharePoint, Configuration, Service health, SaaS apps, and Purview and Copilot where AI readiness is on, each on its own line), when it ran, how long it took, how many requests it made and what it read. A run made for a re-check says what it re-checks after ("Re-check after: ..." with the fix or change), and a run with another queued behind it says a re-check runs straight after it. Parts Microsoft would not give are listed, so a gap is never mistaken for a clean result.

When Microsoft refuses one area#

Sometimes Microsoft refuses one area of a tenant (service health, for example) while everything else reads. The tenant stays connected: only a failed sign-in or a failed basic read of the tenant counts as access refused. The refused area gets one warning of its own (one for every tenant when Microsoft refuses the same area at most of them), its tab says what has not been read and since when, with Consent again where missing permissions are the cause, and the warning clears by itself on the area's next good read.

Note: A user who disappears from Microsoft is kept as deleted, never removed, and nothing is removed after a failed or empty read. Intune devices are linked to your Tenvara devices within the customer, by Entra device ID, then serial number, then name; nothing new is created in Devices. See Devices linked to Intune.