Connect Tenant

365 Pro Toolkit reads and manages Microsoft 365 through its own app registration in your tenant. Connecting a tenant is what creates that registration and stores its credentials, and nothing in the product works until at least one tenant is connected.

There are two ways to do it:

• Guided sign-in. You sign in as a Global Administrator, approve one consent prompt, and the toolkit creates and configures the app registration for you. This is the recommended method.
• Manual. You create the app registration yourself in the Entra portal, grant its permissions, and enter the details into the toolkit. Use this where the guided sign-in cannot run.

You can connect as many tenants as you like, by either method, and mix the two.

Before you start

• A Global Administrator account for the tenant you are connecting.
• 365 Pro Toolkit installed and running, open in a browser.
• Both methods start from Settings > Connections.

Guided sign-in

1. Go to Settings > Connections and click Add Tenant.
2. Sign in with a Global Administrator account of the tenant you are connecting. Make sure it is the right tenant: the account you sign in with decides which tenant gets connected.
3. Review the consent prompt and accept it. It asks for permission to create and manage app registrations, read your organization details, and assign directory roles, which is what the toolkit needs in order to set its own registration up.
4. Wait while the toolkit works. It reports what it is doing: setting up the app registration, then saving the connection. If it says it is waiting for Microsoft to finish granting permissions, leave it. New grants can take a few minutes to become effective, and the toolkit retries until they do.
5. The tenant appears in the list on the Connections page and its first sync starts automatically.

The account you signed in with becomes the toolkit's Owner the first time it signs in to the app. The Owner has full access and adds everyone else under Settings > Access Control.

What this creates in your tenant

A single-tenant app registration with a client secret, holding the Microsoft Graph application permissions listed under Permissions, plus the Exchange Exchange.ManageAsApp permission and the Exchange Administrator directory role. Admin consent for all of it is granted as part of the same flow.

Reconnecting

Each tenant row has a Reconnect button. It re-runs the sign-in to refresh the registration's permissions, which is what you use after an upgrade that added a new permission. No synced data is lost. Sign in as a Global Administrator of that same tenant.

Manual

Use this method when the guided sign-in is not an option, for example in a tenant that blocks third-party multi-tenant applications, or in a sovereign cloud.

1. Create the app registration

1. In the Microsoft Entra admin center, go to Identity > Applications > App registrations and click New registration.
2. Give it a name, such as 365 Pro Toolkit.
3. Under supported account types, choose Accounts in this organizational directory only.
4. Leave the redirect URI empty. The toolkit signs in as the application itself and never redirects to it.
5. Click Register.
6. On the overview page, copy the Application (client) ID and the Directory (tenant) ID. You need both later.

2. Add the Microsoft Graph permissions

1. Open API permissions > Add a permission > Microsoft Graph > Application permissions.
2. Add every permission listed under Permissions. They are all application permissions, not delegated ones.
3. Click Grant admin consent for [your organization] and confirm. Each permission should then show Granted in the status column.

3. Add the Exchange permission and role

Exchange reporting and the mailbox tools need a permission and a directory role, not just the permission.

1. Still under API permissions > Add a permission, open the APIs my organization uses tab and search for Office 365 Exchange Online.
2. Choose Application permissions and add Exchange.ManageAsApp.
3. Grant admin consent again.
4. Go to Identity > Roles & admins > Roles & admins, open Exchange Administrator, click Add assignments, and search for your app registration by name. Service principals do not appear unless you search, so type the name in full.

Without the directory role Exchange returns an access error even though the permission is granted.

4. Create a client secret

1. Open Certificates & secrets > Client secrets > New client secret.
2. Set a description and an expiry.
3. Copy the secret Value straight away. It is only shown once, and you cannot retrieve it afterwards.

Note the expiry date. When a secret lapses the tenant stops syncing, so put a reminder somewhere. The toolkit's Applications reports can tell you what is expiring once the tenant is connected.

5. Enter the details in the toolkit

1. Go to Settings > Connections and click Manually add.
2. Fill in the Directory (tenant) ID, Application (client) ID and Client secret you collected above.
3. On a new install you are also asked for an Owner account. See below.
4. Click Add tenant. The toolkit signs in with the details to prove they work before it saves anything, so a wrong value is reported here rather than failing silently later.

The Owner account

On a new install the manual form asks for the sign-in name of the account that will administer the toolkit, for example admin@contoso.com.

It asks because the guided sign-in knows who ran it and can make that person the Owner by itself. An app registration you created has no signed-in administrator attached to it, so the toolkit has no way to work out who should be let in. If nobody is named, nobody can sign in at all.

The account is looked up in the tenant before anything is saved, so a name that does not exist is an error on the form rather than an install nobody can get into. Once saved it has full access to the toolkit and can add everyone else under Settings > Access Control.

You are only asked on a new install. Adding a second or third tenant later does not ask, because the toolkit already has an Owner and adding a tenant is not a way to change who that is.

6. Check the permissions

Each tenant row on the Connections page has a Check permissions button. Run it after adding the tenant. It compares what the registration actually holds against what the toolkit needs and names anything missing, which is quicker than finding out from a failed sync.

If it reports a permission you know you granted, wait a minute and run it again. Fresh grants take a little while to become effective.

Permissions

These are the Microsoft Graph application permissions the toolkit uses. The guided sign-in grants all of them; with the manual method you add them yourself.

Plus Exchange.ManageAsApp on Office 365 Exchange Online, with the Exchange Administrator role, as described above.

Files.ReadWrite.All is broad, covering every OneDrive and document library in the tenant, because Microsoft Graph has no narrower file scope for application access. Nothing but the OneDrive copy tool uses it. The OneDrive reports come from usage reports, which are read only.

SharePoint and OneDrive advanced features

SharePoint and OneDrive management needs certificate authentication rather than a client secret, so it is a separate one-time step per tenant. On the Connections page, each tenant has an Enable button under SharePoint & OneDrive Advanced Features. It runs its own consent and installs the certificate for you.

The certificate expires. The Connections page shows the expiry date and warns you from 30 days out, with a Renew certificate button beside it.

This step uses the same guided sign-in as Add Tenant, so it needs that sign-in to be available in the tenant.

Troubleshooting

"No access to 365 Pro Toolkit" after connecting. You are signed in to Microsoft but not on the toolkit's own user list, which is separate from anything in Entra. Being a Global Administrator does not grant access by itself. On a guided connect the Owner is the account that ran the connect; on a manual one it is the account named in the Owner field. Sign in as that account, then add everyone else under Settings > Access Control.

A permission shows as missing right after you granted it. Admin consent takes a few minutes to become effective across Microsoft's services. Wait and check again.

Exchange reports fail but everything else works. The Exchange Administrator directory role is missing. The Exchange.ManageAsApp permission on its own is not enough. See step 3.

A tenant stops syncing after months of working. The client secret has expired. Create a new one and enter it with Manually add using the same tenant and client ID, which updates the stored credentials in place. Tenants connected by the guided sign-in can use Reconnect instead.

The wrong tenant got connected. The tenant is decided by the account you signed in with, not by anything you choose in the toolkit. Delete it from the Connections page and connect again, signing in with an administrator of the tenant you meant. Deleting removes the connection and that tenant's synced data.