Overview
This article collects the default values, schedules, caps, and fixed rules that apply across Tenant Manager. Use it as a quick lookup when you need to know how often something runs, how far back it looks, how many items it keeps, or what you cannot change. Each row names the feature article that explains the behavior in full.
Business value
Knowing the defaults and limits up front saves time when you plan a rollout or explain a result. You can tell a colleague why a figure is a few hours old, why an alert fired at a certain point, or why an automation removed nothing, without opening several articles.
How it works
Tenant Manager works from stored data. Each connected tenant syncs on a fixed schedule, and recommendations, alerts, reports, and automations read what the last sync saved. Most defaults can be changed on the alert, report, or automation they belong to. A few values are fixed, and the tables below say which. In this article, a tenant group is a container in the tree view that holds tenant groups and tenants. Microsoft Entra ID groups are the groups synced from your directory.
Where a setting has its own article, you will find the steps to change it there. Times differ by place. Schedules for alerts, reports, and automations use the Background activity time zone from General settings. Alert history and Generation history show times in your browser time zone. Alert emails show the alert time in UTC. Dates and times inside report files and report messages are in UTC.
Connection, sync, and data
This section covers how often data refreshes, what makes a tenant fail a sync, and how Tenant Manager counts users, licenses, and activity. For the full picture, see How data sync works and Understanding tenant groups.
| Area | Setting | Default or limit |
|---|---|---|
| Sync | Automatic sync | Every 6 hours for each tenant, counted from the start of the previous sync, whether it was automatic or manual. You can't change the interval. |
| Sync | Other ways a sync starts | Right after you connect a tenant, right after you save a new client secret, and when you start one. |
| Sync | Syncs at the same time | One per tenant. If a sync is already running, Tenant Manager does not start a second one. |
| Sync | Failed sync | The data from the last successful sync is kept. Last synced still shows that sync. |
| Sync | Failing tenant | Any logged sync issue makes a tenant failing, including a tenant that is missing only AuditLog.Read.All or RoleManagement.Read.Directory. A missing Reports.Read.All or CallRecord-PstnCalls.Read.All does not make a tenant failing. A report on a failing tenant is abandoned and nothing is sent, and automations are blocked for it. |
| Sync | Client secret expiry date | A sync does not check the date you enter. It stops working once Microsoft rejects the secret. The date drives the Client secret expiry alert and the Expired badge. |
| Sync | Client secret expiry badge | Shown on the Tenants page when the secret expires within 30 days. |
| Sync | Change tracking history | Each sync reads up to 30 days of the audit log, or about 7 days without Microsoft Entra ID P1. Changes older than that when the tenant first syncs are never recorded. History is never purged. |
| Connection | Supported clouds | Commercial and GCC tenants. GCC High, DoD, and China tenants aren't supported. |
| Connection | Same directory twice | The same directory can't be connected twice through the same app registration. A second app registration is allowed, with a warning that seats would be counted twice. |
| Connection | Fields fixed after connecting | A tenant's Microsoft Entra ID and client ID can't be changed. |
| Connection | Service principal names | Friendly names must be unique across the service principals saved in your account. |
| Tenant groups and tenants | Tree shape | One root tenant group. Tenant groups can hold tenant groups and tenants, nested to any depth. Each tenant sits in exactly one tenant group. |
| Tenant groups and tenants | Root tenant group | Can't be moved or deleted. |
| Tenant groups and tenants | Names | Tenant group names are unique across the whole module, and so are tenant names. |
| Tenant groups and tenants | Deleting | Deleting a tenant group also deletes every nested tenant group and every tenant inside it. You can't undo a delete from Tenant Manager. Nothing changes in Microsoft 365. |
| Tenant groups and tenants | Pages | A tenant group has only an Overview page. A tenant has Overview, Explore, Optimization, Alerts, and Reports. |
| Tenant groups and tenants | Whole-module actions | Adding a tenant at the root and creating a top-level tenant group need access to the whole module. |
| Data | Trial licenses | Never counted in cost. They can't be given a price. |
| Data | Data freshness | Pages show data from the last sync, not live Microsoft 365 data. |
| Data | Idle seat on Overview | A paid seat held by a user who is disabled or has had no activity for 90 days, based on last activity. This period is fixed. |
| Data | Renewal horizon on Overview | 90 days ahead. License renews in N days is Soon when under 30 days away and Review from 30 to 90 days. |
| Data | Client secret finding on Overview | Client secret expires in N days is Soon when the secret expires within 30 days. Client secret expired is Now. |
| Data | Inactive line on Explore and Optimization | Default 30 days. You set it in Filter settings, and your browser remembers it. |
| Data | Never signed in on Explore and Optimization | Enabled accounts older than 7 days with no sign-in of either kind (interactive or background) on record. |
| Data | Explore grids | 100 rows on a page. The Excel download on Users, Groups, and Licenses holds every row that matches your filters, not only the current page. |
| Data | Change history on a user record | Up to 500 changes. The rest are in Change tracking. |
| Data | Explore column choices | Remembered in your browser. Other people have their own choices. |
| Data | Evaluation duration | Set per tenant. It applies to swaps, service license removals, Idle Copilot, and group license changes. When empty, sign-ins and Copilot use 30 days, SharePoint and OneDrive 60, and desktop Office, Teams, and calls 90. Sign-ins are capped at 30 days and calls at 90, because Microsoft does not keep older data. |
| Data | Top license wastages | Up to 10 paid licenses with unused seats, lowest utilization first. |
| Data | Currencies | Amounts on screen show in one currency: the billing currency of your tenants when they all share one, otherwise US dollars, converted at the daily exchange rate. Reports and alert emails price each license in its own currency and show one subtotal for each currency. |
Optimization, automation, and alerts
This section covers tasks, the two license removal automations, and the five alert types with their escalation. For the full behavior, see Recommendations and savings, License removal automation, and Alerts and incident escalation.
| Area | Setting | Default or limit |
|---|---|---|
| Tasks | Open requests | One open request at a time for each person and license. |
| Tasks | Approving | Approve applies the change in Microsoft 365 immediately. You can't undo it from Tenant Manager. If Microsoft refuses the change, the task becomes Failed. |
| Tasks | Failed tasks | You can't approve or decline a Failed task. Make the change yourself and use Mark as done, or raise the request again. |
| Tasks | Editing | You can't edit a task after it is raised. |
| Tasks | Purchase changes | No role can approve them. Use Trigger notification, then Mark as done. |
| Tasks | Mark as done | Turbo360 doesn't check that the change was made. You can move a task back to not done only if you closed it with Mark as done. |
| Tasks | Excluded users | No task or automation removes a license or Microsoft Entra ID group access from them. Adding is still allowed. |
| Tasks | Ignoring a recommendation | Hides it for everyone in the account, always or until a date you choose. Restore brings it back for everyone. |
| Tasks | Notification recipients | Commas send each person their own email. Semicolons send one email to everyone. |
| Tasks | Annual savings | The monthly figure multiplied by 12. |
| Tasks | Overbought confidence | High when at least half of the purchased seats are unused, Medium when at least a fifth, Low otherwise. |
| Automation | Available automations | Two for each tenant: Remove licenses from disabled accounts, and Remove licenses from inactive accounts. You can't create others. |
| Automation | Run time | Once a day at midnight in the Background activity time zone. You can't change it, and there is no Run now. |
| Automation | Disabled accounts | No days setting. Removes every license, paid or free, that is assigned directly to a disabled account. |
| Automation | Inactive accounts | Default 30 days with no activity. |
| Automation | Most accounts one run may act on | Default 100. A run that would change more accounts removes nothing and says so in its history. |
| Automation | Keep licenses that include a mailbox | On by default. |
| Automation | Data freshness | A run removes nothing when the last good sync is older than 24 hours or the tenant is failing. |
| Automation | Run history | Latest 200 runs, newest first. |
| Automation | Who is told | A new automation uses the account's notification defaults, if any are set. Otherwise nobody is told until you add a recipient or a channel. |
| Alerts | Alert types | Five: Disabled user with license, Inactive user with license, License seat shortage, License expiry, and Client secret expiry. |
| Alerts | Basis | Every alert reads the data from the last sync. |
| Alerts | Until you set a recipient | An alert can't be switched on without a notification channel or a recipient email address. On private hosting, a notification channel is required. |
| Alerts | Severity | Can't be changed. It shows in incident details and notification emails. |
| Alerts | Check frequency | Disabled user, Inactive user, and License seat shortage let you choose from every 30 minutes up to monthly. License expiry and Client secret expiry run daily at 00:00 and can't be changed. |
| Alerts | Incidents | Each due check that finds the condition raises its own incident. Incidents are never closed automatically, even when the condition clears. A person acknowledges or closes them. |
| Alerts | Download records from notifications | On by default. Client secret expiry has no records file. |
| Alerts | Records in notifications | Emails list at most 10 records for each section, and chat messages list 5. The full list is in the records file. |
| Alerts | Alert history | The newest 200 incidents for each alert. |
| Escalation | Rules in a policy | At least one and up to five. A new policy starts with one rule that escalates after 5 minutes. |
| Escalation | Repeat | If no one acknowledges, the policy can repeat 1 to 5 times. |
| Escalation | Default Escalation Policy | You can view it but not edit or delete it. Deleting another policy moves its alerts to the Default Escalation Policy. |
| Escalation | Scope | Policies belong to the account. You can't create a policy for one tenant only. |
The five alert types start with these defaults. For all options, see Alert types and thresholds.
| Alert | Default trigger | Default schedule | Severity |
|---|---|---|---|
| Disabled user with license | Any disabled account with a paid license. | Weekly, Monday at 09:00 | Critical |
| Inactive user with license | No activity for 30 days. Accounts under 30 days old are skipped. | Weekly, Monday at 09:00 | Warning |
| License seat shortage | Warning at 10 or fewer available seats. Error at 5 or fewer. | Every 30 minutes | Warning, Critical at the error line |
| License expiry | 30 days before expiry. | Daily at 00:00, fixed | Warning, Critical when a purchase has lapsed |
| Client secret expiry | 30 days before expiry. | Daily at 00:00, fixed | Critical |
Reports, pricing, and access
This section covers the three reports, the emails Tenant Manager sends, the price catalog, and who can do what. For the full behavior, see Reports in Tenant Manager, Global price catalog, and Roles and permissions in Tenant Manager.
| Area | Setting | Default or limit |
|---|---|---|
| Reports | Reports offered | Three: User report, License report, and Cost report. You can't add, rename, or delete reports. They are set up for each tenant. |
| Reports | Default schedule | Weekly, Monday at 09:00, as PDF. You can choose weekly or monthly, with times in half-hour steps in the Background activity time zone from General settings. |
| Reports | Formats | PDF or Excel. Excel has one sheet named Rows. |
| Reports | Data basis | The data from the last sync. Generate now does not start a sync. |
| Reports | Activity window | Set by No activity for more than (days) on each report. The default is 90 days, and the report file reads "Last N days". |
| Reports | Notification | A report can't be saved or generated until it has a notification channel or a recipient email address. |
| Reports | Abandoned run | A report covers one tenant. If that tenant has a disconnected connection or a failing sync, the run is Abandoned and nothing is sent. Generation history says why. |
| Reports | Download links | A Download report link in a message stays valid for several days. Generation history offers a Download link in the File column, or shows Not stored when the file was not kept. Download report from notifications is off by default. |
| Reports | Generation history | The newest 50 runs for each report. |
| Reports | Logo | A custom logo applies to PDF only. |
| Reports | Recipient email addresses | Not available on private hosting. Use a notification channel instead. |
| Emails | Who receives them | Only the recipients and channels you set, or the Turbo360 team for access requests. See Notification emails. |
| Pricing | Custom price | A price per seat per month. It applies to every tenant in your scope that holds the license, and replaces the invoiced price. |
| Pricing | Who can set a price | The Turbo360 account owner, and anyone whose Owner role covers the whole module. An Owner on a single tenant group or tenant can't. Everyone else can view. |
| Pricing | Licenses that can't be priced | Trial licenses. |
| Pricing | Invoiced prices | Read from the tenant's Microsoft Customer Agreement billing account: the most recent charge for each license in the last 12 months, as a monthly price per seat. Enterprise Agreement, MOSA, and CSP billing give no seat prices, so a custom price is the only price. |
| Access | Roles | Owner, Contributor, and Reader are built in. You can add custom roles. A custom role can't use a built-in name. |
| Access | Role scope | The whole module, a tenant group with everything beneath it, or a single tenant. The nearest assignment decides. |
| Access | Availability | Off by default. On SaaS, the Turbo360 team switches it on after you request access. On private hosting, it is available when your license file includes it, and you request access to get a license file that includes it. |
| Access | Plan | Tenant Manager follows the license tier of your account. Usage shows under Settings > License consumption. |
| Access | User activities | Entries are kept for 30 days. You can't edit or delete them. |