Skip to main content

Initial Tenant Onboarding

This is the complete, per-customer process — run it once per new customer tenant, after the CET2 instance itself is deployed and reachable.

1. Receive customer requirements​

Collect the information checklist: tenant ID, primary domain, consent administrator, RBAC requirements.

2. Confirm app registrations​

Both App 1 (Portal) and App 2 (Data) must already exist, and the portal's public URL must be a registered redirect URI on App 1. See Azure App Registrations.

3. Confirm Graph permissions​

App 2 (Data) holds the Graph application permissions required for the features you're enabling for this customer.

4. Confirm CET2 configuration​

AzureAd and Cet2 settings are in place (see Configuration); GET /api/health returns ok.

The customer's Global Administrator performs two things:

  1. Admin-consent App 2 (Data) in their own tenant. CET2's onboarding flow (Tenants → Onboard) generates the admin-consent URL and probes whether app-only Graph access now succeeds.

  2. Assign directory roles, if enabling sensitive actions. If user disable/enable or Temporary Access Pass will be used for this customer, the Global Administrator (or a Privileged Role Administrator) assigns:

    • User Administrator — to disable/enable non-admin users
    • Authentication Administrator — to issue Temporary Access Passes

    to App 2 (Data)'s service principal, in the Entra admin center under Roles and administrators. This step is deliberately manual — assigning a directory role to an application is a significant privilege grant that should always be a conscious action by the customer's own administrator, not something automated on their behalf.

6. Register the tenant​

In CET2, go to Tenants → Onboard, enter the customer's tenant ID. The onboarding probe confirms app-only Graph access reaches the tenant, then adds it to the tenant registry.

7. Validate live data​

Open the new tenant's Dashboard and Devices pages. There is nothing to "populate" — everything is read live from Graph the moment the tenant is registered and consented.

8. Assign RBAC​

In Access Control, look up the customer's users or groups (the lookup searches their own directory) and assign a role — typically Customer Administrator for their IT lead, or Service Desk Analyst for their support staff — scoped to this tenant only.

Until this step, any of the customer's users who sign in will see "Your access hasn't been set up yet" — this is deny-by-default working as intended, not a fault.

9. Hand off​

Customer users sign in at the portal URL with their own Entra account. The first sign-in triggers a one-time consent prompt; after that, they see only their own tenant, scoped to exactly the permissions their assigned role grants.

Continue to Validation Testing.