Onboarding Tenants

You onboard every tenant through the portal chat, there’s no separate console or “add tenant” form. Tell Hal what you want in plain language and he walks the rest.

A tenant connects in one of two ways, both in the chat. Hal can create the credentials himself: he registers the app registration in a Microsoft 365 tenant, or is authorized by domain-wide delegation in a Google Workspace, from a consent you give in chat. Or you build the registration or service account yourself, as the manual pages describe, paste its credential on Settings, and confirm it with Hal; then Hal creates nothing in the tenant.

Let Hal create the credentials

In your MSP portal, open the chat and tell Hal what you want:

“Add Acme Corp’s Microsoft 365 tenant.”

Hal will walk you through:

1. Signing in to the tenant with a Global Admin account (Microsoft 365 / Entra ID) or a Super Admin account (Google Workspace).
2. Confirming the tenant identity, Hal reads the tenant’s display name and verified domains and asks you to confirm.
3. Creating the credentials, in Microsoft 365 Hal registers his app and grants its read-only permissions, from the consent you authorized in step 1; in Google Workspace the delegation you add in your Admin Console is the credential, and Hal checks that it works.
4. Starting ingestion, Hal opens the log source, runs the first poll cycle, and reports back when events are flowing.

See the Assisted Onboarding overview for the full flow and the exact OAuth scopes used.

Connect a registration you built

Tell Hal in chat that you are building, or have built, the registration or service account for the client:

“Connect Acme Corp’s Microsoft 365 tenant with a registration I built.”

1. Hal opens a paste box for that client on Settings → Microsoft 365 or Settings → Google Workspace, open for 24 hours, and gives you the steps. For Microsoft 365 they include the name the registration takes, so ask him before you build it, or rename it to that name.
2. You build it, if you have not yet, as Manual: Microsoft 365 or Manual: Google Workspace describes.
3. You paste the credential into that box, never into chat: the tenant ID, the client ID and the secret’s Value for Microsoft 365, or the key file and the super admin Hal acts as for Google Workspace. Hal holds what you paste for an hour, so tell him done within it; after that, paste it again.
4. Hal checks it with Microsoft or Google before anything is stored, shows you the tenant, and stores it only after you confirm. What he refuses, and what connects with a partial read, is on each manual page.
5. Starting ingestion, as above: ask Hal to start, and he opens the log source.

Events flow into the portal within a few minutes, and the Logs → Sources page shows per-tenant health.

Questions? Contact us.