Setting up 365 Tenants: consent, permissions and roles
Which licences 365 Tenants needs, how consent to the two apps works, which roles Conbool sets itself and what to do after an extension.
Requirements
- A Microsoft 365 tenant connected to Conbool.
- An administrator of this tenant to consent to the apps.
- In Conbool, one of the three permissions of the product: view, manage or roll out. The account owner grants them through roles.
365 Tenants reads from the tenant's licences what each area additionally needs. Anything the tenant is not licensed for is neither written nor counted as a deviation.
| Area | Needs in the tenant |
|---|---|
| Conditional Access, named locations, password protection | Entra ID P1, included for example in Microsoft 365 Business Premium |
| Entries on sign-in and user risk | Entra ID P2 |
| Exchange Online | Exchange Online |
| Safe Attachments for SharePoint, OneDrive and Teams | Defender for Office 365 |
| Intune | a licence that includes Intune |
| Microsoft Teams | a licence that includes Teams |
The two apps
- Read. Captures settings and detects changes. Changes nothing in the tenant. Snapshots, history, comparison and deviations need only this app.
- Roll out. Writes approved templates to the tenant. Needed only for rollouts.
You consent under 365 Tenants → Settings → Connection with Consent. Microsoft opens a separate window for this. Sign in there with an administrator of this tenant.
Check shows whether every expected permission has arrived. If one is missing, the page names it and the affected areas show as “Not checked”. 365 Tenants also checks every consent itself once a day.
Roles
Exchange Online, Teams and password protection accept calls from an app only if it holds a role in the tenant. Conbool sets these roles itself as soon as you allow rollouts, and only on its own apps:
| Role | App |
|---|---|
| Global Reader | Read |
| Exchange Administrator | Roll out |
| Authentication Policy Administrator | Roll out |
| Teams Administrator | Roll out |
If a role is missing, set it under Settings → Connection with Set Exchange roles. If the permission for that is still missing, Consent again appears next to it. Microsoft usually needs 15 to 60 minutes until the roles take effect. Until then, Exchange shows as “Not connected” in the overview.
After an extension
Since 25 October 2026, 365 Tenants also reads and writes Intune, Teams and further settings of Exchange, Defender and Entra. Both apps need new permissions for this. If you consented earlier:
- Click Check under Settings → Connection. The page names the missing permissions.
- Renew consent for both apps.
- Set Exchange roles so that the new roles are added.
Until then, 365 Tenants does not read the new areas. Everything else continues as before.
Automatic snapshot
Under Settings → Automatic snapshot you choose the interval: every 4 hours, every 12 hours or daily. Every snapshot reads all areas.
Revoking consent
Both consents can be revoked at any time in the Entra portal under Enterprise applications. 365 Tenants then reads and writes nothing, and the captured state remains visible. The apps are listed there as “Conbool 365 Tenant Manager” and “Conbool 365 Tenant Manager Change”.