Overview
Tenant Manager shows data from the last sync of each tenant. This article shows you how to start a sync yourself, check when a tenant last synced, and read the warning that a sync leaves behind.
For what a sync reads and how Tenant Manager handles failures, see How data sync works.
Business value
Syncing on demand lets you see a change in Microsoft 365 in Tenant Manager without waiting for the next scheduled sync. For example, you can check a newly granted permission or a license change straight away.
Prerequisites
Before you start, make sure you have at least one connected tenant. See Connect a Microsoft 365 tenant.
Required permissions
You need the Manage tenants permission on the tenant. The Owner and Contributor roles include it. The Reader role doesn't. For details, see Roles and permissions in Tenant Manager.
Anyone with access to the tenant can read Last synced and the sync warning.
How it works
A sync copies data from Microsoft 365 into Turbo360, and every page reads that copy. This section covers when syncs start and how Tenant Manager shows their progress.
Syncs start in four ways. Each connected tenant syncs automatically every 6 hours. A sync also starts right after you connect a tenant, and right after you save a new client secret for it. You can start a sync yourself at any time.
Each sync, automatic or manual, sets the next automatic sync for 6 hours after it starts. Hover over Sync to see the time of the next automatic sync, or that it is due now. While a sync is queued, the tooltip reads "Sync queued. Waiting for it to start." While it runs, the tooltip reads "Getting the latest data for this tenant from Microsoft."
When you start a sync, Tenant Manager queues it and shows that the tenant is syncing. While a sync is queued or running, the Sync button in the page header, which has a refresh icon before its label, reads Syncing. When the sync finishes, it reloads the tree and the open page. A tenant runs one sync at a time, so a second request while one is running doesn't start another.
A sync updates the data saved in Tenant Manager. It never changes anything in Microsoft 365.
A sync doesn't check the expiry date you entered for the client secret, so it still runs after that date passes. The sync stops working once Microsoft rejects the secret, and the warning icon shows Microsoft's own error.
The page header shows Last synced with the date and time, or Never synced. While a sync is queued or running, the header shows Syncing in place of Last synced. A tenant group has no sync time, because its totals add up the last sync of each tenant inside it. On a tenant group, the header shows "Waiting for a tenant sync to start…" or "Syncing tenants here…" while a tenant inside it is queued or syncing.
Tenant Manager records a manual sync in the user activity log. It doesn't record scheduled syncs.
A tenant with logged issues counts as failing
Any issue that a sync logs makes the tenant failing, not only an error that stops the sync. Examples are an audit log that can't be read, billing prices that can't be read, and Microsoft Entra ID group owners, sign-in activity, or multi-factor authentication (MFA) data that can't be read.
A report on a failing tenant is abandoned and nothing is sent. Generation history says why. Automation is blocked for it too. A tenant that is missing only AuditLog.Read.All or RoleManagement.Read.Directory is also treated as failing, so its reports are abandoned and automation is blocked. A missing Reports.Read.All or CallRecord-PstnCalls.Read.All does not make a tenant failing.
A tenant without Microsoft Entra ID P1 is not failing because of it. Its sync finishes cleanly, it isn't logged as a missing AuditLog.Read.All permission, and reports include the tenant.
Steps
You start a sync from the tenant's page header or from its context menu in the tree view. You read sync status in the header of the same page.
Sync a tenant now
This procedure starts a sync for one tenant instead of waiting for the next scheduled sync.
- In the tree view of Tenant Manager, select the tenant.
- In the page header, select Sync. You can also open the tenant's context menu ( ⋮ ) in the tree view and select Sync now.
- In the Sync tenant dialog, read the message, and select Continue.
Tenant Manager confirms that a sync is queued for the tenant and that the data updates when it finishes. While the sync runs, the Sync button reads Syncing. If a sync is already running, Tenant Manager tells you so instead. When the sync finishes, the page reloads with the new data.
Check when a tenant last synced
This procedure shows you how fresh a tenant's data is.
- Select the tenant in the tree view.
- Read Last synced in the page header.
- Hover over it to read a reminder that the data comes from the last sync and isn't live from Microsoft.
To compare every tenant at once, open Settings > Tenants (needs Manage tenants) and read the Last synced column.
Read a sync warning
This procedure shows you why a sync didn't complete cleanly.
- Select the tenant in the tree view.
- Look for the amber warning icon next to Last synced in the page header. To check every tenant at once, open Settings > Tenants (needs Manage tenants) and look for the red error icon next to the date in the Last synced column. The tree view shows no icon.
- Hover over the icon to read the issues from the last sync.
- Fix the cause, and then select Sync.
Neither icon tells a failed sync apart from a sync that finished with issues. Both only show that issues were logged.
Typical issue messages say that the client secret is wrong or has expired, or that Microsoft is still throttling the requests after four attempts. When Microsoft throttles, the sync stops and the next scheduled sync tries again.
Common causes are a missing Microsoft Graph permission and an expired client secret. For permissions, see Connect a Microsoft 365 tenant. For secrets, see Managing Microsoft 365 tenants.
Permission behavior
What you can do depends on your role and your scope.
- Without Manage tenants on the tenant, Sync and Sync now are disabled. Hover over them to see "You are not authorized to perform this operation".
- With Manage tenants, the Sync tooltip also shows when the next automatic sync is due.
- If the tenant is outside your Tenant Manager access, Tenant Manager refuses the sync and says so.
Example scenario
Kenji Watanabe, a systems engineer at Datum, asked the company's Microsoft 365 admin to grant AuditLog.Read.All to the Tenant Manager app registration. Until then, Last activity showed "Not known" for everyone in the tenant.
After the admin grants consent, Kenji selects the Datum tenant and selects Sync. He selects Continue in the Sync tenant dialog. A few minutes later, the page reloads, Last synced shows the new time, and sign-in dates appear.
Limitations
- A tenant group has no Sync button. Sync each tenant on its own.
- The Tenants grid in Settings has no Sync column. Start a sync from the tenant page or from the tree view.
- You can't change the 6-hour automatic interval.
- You can't start a second sync for a tenant while one is running.
Troubleshooting
-
Sync is disabled.
Cause: your role doesn't include Manage tenants on the tenant.
Fix: ask an administrator who can manage Tenant Manager access, such as a module owner, to grant the permission. -
Tenant Manager shows "A sync is already running".
Cause: the tenant is already syncing.
Fix: wait for it to finish. The page reloads by itself. -
Tenant Manager shows "The sync could not be started. Nothing has been changed."
Cause: Tenant Manager could not queue the sync.
Fix: try again after a few minutes. If it continues, contact Turbo360 support. -
A warning or error icon appears next to Last synced.
Cause: the last sync logged one or more issues. The icon is an amber warning icon on the tenant page and a red error icon on the Tenants list. Neither tells you whether the sync failed or finished with issues. A tenant without Microsoft Entra ID P1 doesn't get the icon because of that.
Fix: hover over the icon to read the issues, fix the cause, and then select Sync. -
Last synced doesn't change after a sync.
Cause: the sync is still queued or running, or it failed. While a sync is queued or running, the header shows Syncing instead of Last synced and the warning icon. A failed sync keeps the data from the last successful sync.
Fix: wait until the Sync button stops reading Syncing, and then check Last synced and the icon next to it. If the sync failed, fix the issue it reports and sync again. -
Sync shows "This tenant cannot be synced: it is being deleted, or its saved credential is no longer in Settings."
Cause: the tenant is being deleted, or its saved service principal was removed.
Fix: reload the page. If the tenant still shows, select Edit and enter a working client secret, or delete the tenant and connect it again.
FAQs
-
Does a sync change anything in Microsoft 365?
No. A sync only reads from Microsoft 365 and updates the data saved in Tenant Manager. -
Does Tenant Manager sync a tenant when I connect it or replace its client secret?
Yes. Both start a sync right away, without asking for confirmation. -
Why is there no Sync button on a tenant group?
A tenant group has no data of its own. Its totals add up the last sync of each tenant inside it.