Overview
An access and permission strategy decides who can view, change, and approve things in Tenant Manager, and on which tenants. This article covers the practices that keep access narrow, keep license changes accountable, and keep Turbo360 from making changes you did not intend.
Business value
Limiting each person to the access they need reduces the risk of unintended license changes. You can let one team review recommendations while a smaller group approves the changes that are applied in Microsoft 365, and you can keep unrelated tenants out of reach.
How it works
Every user in Tenant Manager has a role assigned at a scope. The role defines what the user can do, and the scope defines where. Tenant Manager has three built-in roles, Owner, Contributor, and Reader, and you can create custom roles with the exact permissions a team needs. A scope can be the whole module, a tenant group together with everything beneath it, or a single tenant. The assignment nearest to a tenant group or tenant decides what a user can do there.
Two layers decide whether a change reaches Microsoft 365. The first is the Tenant Manager role of the person, in particular the Approve license tasks permission. The second is the permission that your Microsoft Entra administrator granted to the app registration of each tenant. A change needs both, so you can keep a tenant read-only even for people who can approve tasks elsewhere. For the roles, see Roles and permissions in Tenant Manager.
Key practices
Follow these practices when you assign roles, create custom roles, and connect tenants.
1. Assign each role at the narrowest scope that does the job
Users with access to only part of the tree cannot open anything else, and the assignment nearest to a tenant decides what they can do there. Adding a tenant at the root and creating a top-level tenant group need access to the whole module, so a role scoped to a tenant group or tenant cannot do them.
2. Use the Reader role for people who only need to look
Reader has Read on Overview, Explore, Optimization, Alerts, and Reports, and none of the management permissions. Assign Reader on one tenant group or tenant to give a team a view of its own tenants. See Limiting access to a tenant group.
3. Keep Approve license tasks off ordinary custom roles
Approving a task makes the change in Microsoft 365 straight away, and you cannot undo it from Tenant Manager. Anyone with the permission can approve a task, including the person who raised it. Owner and Contributor include it, so assign those roles to a small group of approvers. A reviewer role with Manage on Optimization can add recommendations to tasks, while Approve and Decline stay disabled.
4. Keep Manage users off ordinary custom roles
A person with Manage users can add, edit, and remove users and change their permissions, so they decide who else gets access. Among the built-in roles, only Owner includes it. A custom role with Manage users can assign existing roles but cannot create, edit, or delete roles. In the tree, the person can grant only the tenant groups and tenants they can manage.
5. Grant Microsoft Graph write permissions only on tenants where changes should apply
The read permissions that the connection needs are enough for Tenant Manager to show licenses, users, and groups for a tenant. Without the matching write permission for a type of change, Approve stays disabled on those tasks for that tenant. Use Trigger notification to send the task to your IT team, or Generate PowerShell script to run the change yourself. To allow approvals, ask your Microsoft Entra administrator to grant the write permission. Turbo360 notices a granted or removed permission within about 5 minutes, so Approve can become available a short time after you grant a permission, and can stay available for a short time after you remove one. License removal automation follows the same rule, and syncing the tenant does not speed it up. The permissions for each type of change are listed in Connect a Microsoft 365 tenant.
6. Choose the role for every node when you use Specify custom permissions
The role defaults to Reader, and Owner is not offered. Granting a tenant group, or choosing its role, copies down to everything beneath it, so check the nodes under a tenant group before you finish. If you use Assign user role or Assign group role from the Security menu of a node instead, the default role is Contributor, so check it there too.
7. Treat Manage groups as permission to delete tenants
Deleting a tenant group also deletes every nested tenant group and tenant inside it, so Manage groups includes Manage tenants. The Owner and Contributor roles both include these permissions. Grant them on the narrowest tenant group that does the job, and give people who only need to look the Reader role.
Example scenario
A regional IT team at Orchard Lane Education needs to review license recommendations for its own tenants, and Tariq Aziz, who owns Tenant Manager there, sets up the access. He adds the team lead with Specify custom permissions, turns on the switch for the team's tenant group, and leaves the role as Reader. The role copies down to every tenant in that tenant group, and he checks the nodes beneath it before he finishes.
For the people who add recommendations to tasks, Tariq creates a custom role with Manage on Optimization and leaves Approve license tasks off. He keeps Owner and Contributor for himself and one deputy, who approve changes. He asks his Microsoft Entra administrator to grant the license write permission on two of the three tenants. On the third, Approve stays disabled, and the team uses Trigger notification to send tasks to the IT team.
Limitations
- A role scoped to a tenant group or a tenant cannot add a tenant at the root or create a top-level tenant group. Both need access to the whole module.
- Anyone with Approve license tasks can approve a task, including the person who raised it.
- A custom role with Manage users can assign existing roles but cannot create, edit, or delete roles.
- In Specify custom permissions, the role defaults to Reader and Owner is not offered.