Users, groups and mailboxes

Cloud > Users lists everyone in every connected tenant. Open a user to see their account at a glance and change it from the Actions menu.

The users list#

Each row shows the Name and sign-in address, Source (Cloud only or Active Directory), Tenant, Type (Member, or a badge for Admin, Guest, Shared mailbox or Room), Sign-in (Can sign in or Blocked), MFA (Registered, or Not known in tenants without Entra ID P1), Licences and Last sign-in. Shared mailboxes, rooms and other accounts that are not people show a dash for MFA, because nobody signs in to them.

Filter by source, tenant, type, VIP, sign-in, MFA and department, or type in the filter box. The Views menu has ready-made views:

A tenant's Users tab shows the same list for one tenant, with Everyone, Guests, Guests not signing in and Deleted across the top and Invite guest beside them. Users synced from Active Directory carry a Synced badge (see Hybrid Active Directory). Guests and deleted users are covered in Mailboxes, guests and message trace.

Note: MFA registration and last sign-in dates need Entra ID P1. Without it they show as Not known, never as "none".

The user panel#

Click a user to open the side panel. It shows:

• Customer, Tenant, the matching Contact, Sign-in, MFA, Last sign-in and whether they are a VIP (Mark as VIP).
• Profile: job title, department, manager, office, mobile, usage location, when the account was created and the password last changed, and whether it is cloud-only or synced from on-premises Active Directory. For a synced user, an Active Directory section shows the account as the domain controller has it.
• Devices: the computers they use, are signed in to, or that Intune lists as theirs, with a quick way to remote in.
• Admin roles for administrators, then MFA methods, Licences and Groups, and the Sites this person can access.
• Backup: whether their mail, OneDrive, calendar and contacts are protected, with Back up now and restore.
• Mailbox: type, address, size against its quota, whether it is shown in the address book, and any forwarding, with Trace their mail and Their quarantine.
• Access to other mailboxes and data: the mailboxes and calendars this person can open or send as.
• Conditional Access that applies to this person: the policies that apply to them, or may (depending on the app, place, device or risk, said in words), each linked to the policy. Report-only ones are marked. See Conditional Access policies in detail.
• Recent sign-ins worth a look: failed, legacy or risky sign-ins, with Full sign-in log (see Sign-ins, apps and policies).
• Changes made here: anything changed for this user through Tenvara, and anything scheduled for them (for example access that ends on Friday).

The same card appears on the contact's page when the user's address matches a contact of that customer.

Making a change from the Actions menu#

Press Actions in the panel. Mailbox and Account open their own submenus. Changes that need input open a small form first, then the change dialog shows what will happen. See Making changes safely for previews, confirmation, approval and undo.

Block sign-in also signs the person out: the dialog has Also sign them out everywhere, ticked, so the sessions they are signed in with now end on every app and device straight after the block. Untick it only if you have a reason to leave them signed in. A scheduled block signs them out when it runs.

Block sign-in is refused for the tenant's emergency access accounts, which are the way back in when everything else fails. For an administrator, or an account something signed in as without a person in the last 30 days (a scanner, a flow, a script), it asks you to type the account's name before it goes ahead, and the preview shows its last sign-ins.

Every change dialog also has When, time limit and ticket, to run it later, undo it by itself at a set time, or note it on a ticket. See Bulk, scheduled and time-limited changes.

A few things worth knowing:

• Reset password and Temporary Access Pass can make one or take one you choose, then show it to you once, text it to the person, or email a one-time link to someone such as their manager. Tenvara never stores them.
• Reset password has Sign them out everywhere and its own When, time limit and ticket section in the form. The switch is on to start with when the account looks at risk (Microsoft rates the person at risk, or an account threat about them is open); otherwise the preview says their current sessions stay alive.
• Reset MFA removes every registered method but keeps the password; the user registers again at their next sign-in. A Temporary Access Pass helps them do that.
• Require MFA adds the person to the tenant's MFA group or the Conditional Access policy that requires MFA, so they must use MFA from their next sign-in. The first time, the dialog asks which group or policy to use and remembers the answer (it is also on the tenant's Settings tab, under Require MFA). A policy is only ever changed by adding the person to the people it includes. Someone the policy leaves out is refused, and someone already covered, or a tenant using security defaults, changes nothing.
• Send MFA registration instructions emails the person how to set up MFA, with Microsoft's own link, at their mail address (or their contact's). Nothing changes in the tenant; it is logged and noted on the ticket like any change.
• Assign licences shows the free seats from the last sync and warns when there are none or the user has no usage location.
• Remove licences leaves licences given through a group alone (Microsoft refuses to remove those directly). Convert to shared mailbox first converts their mailbox before the licence goes, and if that fails the licence stays.
• Resetting the password or MFA of an administrator, or changing membership of a group that can hold administrator roles, is treated as high risk and needs an administrator's approval if you are not one.
• For users synced from on-premises Active Directory, password resets, blocks, groups and details are made on the customer's domain controller once hybrid Active Directory is set up for the tenant. Until then the preview says the change cannot be made and links to the set-up.

Bulk changes#

Select several rows in the users list to Block, Allow sign-in, Sign out, Reset MFA or Remove licence in one go, or use More to assign licences, change groups, reset passwords, set the usage location, update a field or start leavers. For destructive ones you type the number of people to confirm. More than 25 people, or people in more than one tenant, goes to an administrator for approval. Import users makes new users from a CSV file. See Bulk, scheduled and time-limited changes.

Mailboxes#

A tenant's Mailboxes tab has views across the top: Mailboxes, Forwarding, Inbox rules, Permissions (who has access to which mailbox) and Mail contacts, with a count on each. Worrying ones come first. New makes a shared mailbox, a room or equipment mailbox, or a mail contact.

• Mailboxes lists each mailbox with its Type (User, Shared, Room, Equipment), Size and how much of its quota is Used, Archive, Attention (for example Forwards or 1 suspicious rule), Automatic reply, Rules and Access (people with full access or send as). Click one to open its side panel with its storage, addresses, calendar access, send on behalf, mail apps, forwarding, rules and permissions. See Mailboxes, guests and message trace.
• Forwarding is one list of everything that sends mail on: forwarding set on the mailbox and inbox rules that forward or redirect. Addresses outside the tenant's verified domains are marked as outside.
• Inbox rules lists every rule, suspicious and enabled ones first.

Suspicious inbox rules#

Sync marks a rule as suspicious, conservatively, when it forwards or redirects to an outside address, moves mail into RSS Feeds, RSS Subscriptions, Conversation History, Notes, Junk Email or Deleted Items, or deletes mail from particular senders. Ordinary filing is not flagged.

Every enabled suspicious rule raises an alert, and its severity is judged with who made the rule, when and how (from the audit log and the tenant's sign-ins), not only by what it does:

• Critical is kept for the patterns attackers use: forwarding or redirecting outside the organisation, deleting mail or hiding it in RSS Feeds, Conversation History or Junk, a name made to be missed (such as "." or two letters), a rule made by an app, a rule made around a risky sign-in, or one made or changed recently (14 days to start with, Inbox rules count as new for in Settings > Microsoft 365, the Timings tab, under Mailboxes and mail).
• An old rule that files mail inside the mailbox, made by its owner in Outlook from a place they sign in from, is a Warning or information.
• Words alone, such as "invoice" in the rule's conditions, never make a rule critical.

The alert shows the rule's Age, who it was Made by and what it was Made with (Outlook, an app, the address it came from), and its Raised by link opens Inbox rules filtered to that mailbox with the rule open beside it, with Mark as expected and Disable right there.

To deal with one:

• Not wanted: open the mailbox and disable the rule. Rules are disabled, never deleted, because a rule is evidence of what happened. The leaver process can also disable all of a person's rules.
• Wanted: choose This rule is fine (mark as expected) on the alert, or Mark as expected on the rule. The alert is resolved as expected and the rule only alerts again if its conditions, actions or folder change. You can do this for many alerts at once from the alerts list, and for every current rule of a mailbox in one go.

Resolve on an alert whose rule still exists asks first, because the alert would come back: choose Mark as expected, Resolve anyway or Cancel. Resolve anyway keeps the alert quiet until the rule changes or for 30 days, whichever comes first. The time is Resolving a rule alert anyway holds it for in Settings > Microsoft 365, the Timings tab, under Mailboxes and mail.

A mailbox's own forward to an outside address can also be marked as expected: Mark as expected on the Forwarding view, with a reason. It holds for that destination only, so a change of destination is judged again.

Groups#

Group membership can be changed from the user (Add to group, Remove from group, Remove from all groups) or from the group itself on the tenant's Groups tab, where you can also paste many addresses to add or remove at once and change a mail-enabled group's mail settings. See Tenants and the tenant page.