Overview
Tenant group design decides how Tenant Manager arranges your connected Microsoft 365 tenants and who can see each part. This article covers the practices that keep the tree easy to read, safe to change, and aligned with how your organization works.
Business value
A tenant group structure that matches your organization lets you read seat totals and findings for one subsidiary, region, or customer at a time. The same boundaries can limit who sees what. Planning the structure before you connect many tenants also reduces later moves, and every move changes who can see the moved tenant group.
How it works
Tenant Manager arranges tenant groups and tenants in a tree with one root tenant group at the top. Each tenant sits in exactly one tenant group, and a tenant group can contain nested tenant groups. For the full model, see Understanding tenant groups.
The practices in this article follow from four properties of the tree. A tenant group adds up the last sync of every tenant inside it, including the tenants in its nested tenant groups. Explore, Optimization, Alerts, and Reports belong to each tenant, so a tenant group has only an Overview page. Names must be unique across the whole module. Moving and deleting change who can see a tenant group and what Tenant Manager keeps.
Access follows the same tree. A role can apply to the whole module, to a tenant group together with everything beneath it, or to a single tenant, and the assignment nearest to a node decides. See Access and permission strategy.
Key practices
Follow these practices when you create, name, move, and delete tenant groups, and when you manage the credentials that tenants share.
1. Mirror your real structure with one tenant group for each subsidiary, region, or customer
Each tenant group shows one set of totals and findings for the tenants inside it, so the structure you choose decides which numbers you can read at a glance. Nested tenant groups add a level, for example a Benelux tenant group inside a Western Europe tenant group.
2. Work in the tenant, not the tenant group, for Optimization, Alerts, and Reports
A tenant group has no Explore, Optimization, Alerts, or Reports page, and it has no Sync button. Before you rely on a total, check the Last synced shown in the header of each tenant's own page, or look for "Not syncing" and "Not synced yet" findings on the tenant group Overview. Select a finding to open the tenant it names.
3. Give every tenant group and tenant a name that is unique across Tenant Manager
Names must be unique across the whole module, not only within a parent tenant group. Add the region or customer to the name so that similar tenant groups do not collide.
4. Name the root tenant group for your whole organization
The first tenant group you create in Group details of the Set up Tenant Manager dialog becomes the root tenant group. You cannot move or delete it, and selecting it shows totals for every tenant in the account. You can rename it later: open its context menu ( ⋮ ) and select Edit.
5. Check who has access before you move a tenant group or tenant
Open the context menu ( ⋮ ) of the tenant group or tenant, select Move, and read the confirmation. Users whose access was given on the current parent no longer see it, and users with access to the destination can. Seat and license numbers count under the new parent straight away, and no tenant data changes.
6. Know which other Turbo360 modules use a tenant's service principal before you replace its client secret
Replacing a tenant's client secret updates the saved service principal, so any other Turbo360 module that uses the same service principal gets the new secret too. The tenant you edit syncs right away.
7. Move the tenants you want to keep before you delete a tenant group
Deleting a tenant group deletes every nested tenant group and tenant inside it, and Turbo360 stops syncing each tenant. Nothing changes in Microsoft 365, and you cannot undo a delete from Tenant Manager. If you connect a tenant again, it starts from a new sync and its earlier data does not return.
Deleting a tenant group deletes everything inside it. Review the confirmation, which lists how many tenant groups and tenants the delete includes, before you select Delete.
Example scenario
Tasman Cloud Services manages Microsoft 365 for several customers, and Sofia Marinescu sets up its Tenant Manager tree. She names the root tenant group "Tasman Cloud Services", creates one tenant group for each customer, and adds each customer's tenants inside it. Kestrel Logistics has two tenants, so she names them "Kestrel Logistics Australia" and "Kestrel Logistics Singapore", which keeps every name unique across Tenant Manager.
Later, Kestrel asks her to move the Singapore tenant under a new tenant group for its Asia team. Before she selects Move, she reads the confirmation. Users who were given access on the current parent no longer see the tenant, and users with access to the new tenant group can. She gives the Asia team access on the new tenant group, and the seat and license numbers count under the new parent straight away.
Limitations
- A tenant group has only an Overview page and no Sync button. Explore, Optimization, Alerts, and Reports belong to each tenant.
- Names must be unique across the whole module, not only within a parent tenant group.
- You cannot move or delete the root tenant group.
- Deleting a tenant group deletes every nested tenant group and tenant inside it, and you cannot undo a delete from Tenant Manager.