--- title: "Understanding tenant groups" slug: "understanding-groups-and-tenants" updated: 2026-11-02T06:53:54Z published: 2026-11-02T06:53:54Z canonical: "docs.turbo360.com/understanding-groups-and-tenants" --- > ## Documentation Index > Fetch the complete documentation index at: https://docs.turbo360.com/llms.txt > Use this file to discover all available pages before exploring further. # Understanding tenant groups ## Overview Tenant groups and tenants are the two building blocks Tenant Manager uses to organize your Microsoft 365 environment. A tenant is one connected Microsoft 365 tenant. A tenant group collects related tenants and shows one set of totals for them. Every page in Tenant Manager hangs off this structure, so it helps to understand it before you work with recommendations, alerts, or roles. ### Business value Tenant groups let you look at several tenants as one portfolio, for example all the tenants that belong to one subsidiary or one customer. Totals and findings roll up across the tenants in a tenant group, so you do not add figures together by hand. Access can follow the same structure, because a role can be limited to a single tenant group or tenant. ## How it works Tenant Manager arranges tenant groups and tenants in a tree that you navigate from the sidebar. The tree has one root tenant group at the top. The root tenant group contains tenant groups and tenants, and tenant groups can contain other tenant groups. Every tenant sits in exactly one tenant group. The first tenant group you create when you connect your first tenant becomes the root tenant group. If you set up Tenant Manager from the account setup wizard, the root tenant group is named Tenant Manager. This section explains what each node is and what the tree allows. ### Tenants Tenants represent connected Microsoft 365 tenants. A tenant is connected with an app registration in Microsoft Entra ID, using either the tenant ID, client ID, and client secret of that app registration, or a service principal that is already saved in your account. The name you give a tenant is only a label in Turbo360. It does not rename anything in Microsoft 365. Under each tenant, a **License management** area holds the pages **Overview**, **Explore**, **Optimization**, **Alerts**, and **Reports**. ### Tenant groups Tenant groups hold a name and an optional description. You can nest tenant groups to any depth. A tenant group has a single **Overview** page that adds up the tenants inside it. It shows totals, which are the seats, users, and cost for all the tenants together and for each tenant, and findings, which are the issues found across the tenants, each naming the tenants it affects. A tenant group has no **Explore**, **Optimization**, **Alerts**, or **Reports** page. Those belong to individual tenants. ### Moving and deleting Moving and deleting let you reorganize the tree. A tenant can be moved to another tenant group, and a tenant group can be moved together with everything under it. Moving a tenant group or tenant also changes who can see it, because users see only what their access covers. It changes no tenant data. The root tenant group cannot be moved or deleted, but you can rename it. A tenant group cannot be moved into itself or into one of its own nested tenant groups. Warning: Deleting a tenant group also deletes every nested tenant group and every tenant inside it, and you cannot restore them from Tenant Manager. Move any tenant you want to keep to another tenant group first. ## Key characteristics Tenant groups and tenants follow a small set of rules that apply wherever you create or connect them. - **Unique names:** tenant group names are unique across Tenant Manager, not only within a parent tenant group, and so are tenant names. - **One tenant, one connection:** the same Microsoft 365 directory cannot be connected twice through the same app registration. Connecting it twice would sync one tenant as two and count every seat and cost twice. - **One service principal, one tenant:** a saved service principal connects one tenant. It can also be used by other Turbo360 modules, so rotating its client secret changes it for them too. - **Service principal kept:** when a tenant is deleted, its service principal stays in Settings > Service principals, so you can reuse it. - **Last sync totals:** tenant group totals add up each tenant's last sync. A tenant group has no sync time of its own and no **Sync** button. ## How it relates to other concepts Tenant groups and tenants shape how several other parts of Tenant Manager behave. | Concept | Relationship | | --- | --- | | Data sync | Each tenant syncs on its own schedule. Tenant group totals add up the last sync of every tenant inside the tenant group. | | Recommendations and savings | Recommendations, tasks, and automations work on one tenant at a time. A tenant group has no Optimization page. | | Alerts and incident escalation | You set up alerts on each tenant. A tenant group has no Alerts page. | | Roles and permissions | A role can apply to the whole module, to a tenant group, or to a single tenant. The assignment nearest to a node decides what a user can do there, and actions outside the access you were given are refused. | ## Related articles - [What is Tenant Manager?](https://docs.turbo360.com/docs/what-is-tenant-manager) - [How data sync works](https://docs.turbo360.com/docs/how-data-sync-works) - [Alerts and incident escalation](https://docs.turbo360.com/docs/alerts-and-incident-escalation) - [Roles and permissions in Tenant Manager](https://docs.turbo360.com/docs/tenant-manager-roles-and-permissions)