Install a client/downstream tenant

Define the domain and display name of your tenant.

The baseline is an M365 tenant that contains a set of configurations to which your tenants will align.  

Remember that you must associate a baseline with your tenant.

Choose the method by which Configuration Manager authenticates into the tenant: Service Account or Delegated Authentication.

This is an important choice and should be aligned with your organization's security posture. Don't be caught unprepared! Refer to our guide to help you decide.

A Service Principal is required to assist in tenant authentication and configuration management. 

Configuration Manager will create one in the tenant at install time. If you would prefer, you can bring your own custom service principal!

Enable this option if you have an Azure subscription in the tenant and would like Configuration Manager to manage the configurations associated with that subscription. 

Choose which group of users has the authority to approve or reject changes made to the tenant configurations. Please note that the default one is ”Contributors”.

Configuration Manager offers the ability to choose where your Sync operations run through the agent pool feature. While syncs typically run on Microsoft-hosted agents by default, you can select self-hosted agents for enhanced control and security compliance.

Agent pools can be selected either from the Sync page as well. 

Checking this box will restrict Syncs to only perform export operations. No preview operations will be conducted, and configuration deployments will not be attempted for this tenant, ensuring a more stable overall operation.

From the dropdown menu, select whether you want this type of backup to occur solely for scheduled Syncs or for both scheduled and manual Syncs.