Work with each tenant separately
Choose a client in the Tenant box. Each page uses that tenant, and every change window names it.
For MSPs
Microsoft 365 and Azure Management for MSPs
A Windows desktop application for MSPs. Add each client's tenant once, then work on each tenant separately. Set it up from a blueprint, keep a change log and build client reports in your brand.
What you get
The same setup for each client
A blueprint says what a client's tenant should have. Apply it to add what's missing.
Reports in your brand
A Word document and an Excel workbook for each client, from a template with your look and the client's name and logo.
A record of each change
Each tenant's change log records the change, the command sent, who made it and the values before and after.
Work in 1 client's tenant at a time
Add each tenant once, then choose it in the Tenant box. Pages work with that tenant and connect when they need to.
- To add a client's tenant, sign in once as an administrator of the tenant and choose the access. Altivane registers itself there, grants admin consent, assigns the roles and tests each service. Get started has the steps.
- To sign in with a guest or partner account in the client's tenant, enter the tenant's domain or ID first.
- Choose each client's access: Reports, which is read only, Helpdesk, Manage, Everything or Custom. Review the permissions and roles for each option before granting access.
- Each tenant has its own folder under the output folder, with its reports, documents, workflow files and change log.
- Helpdesk tasks, such as resetting a password or issuing a Temporary Access Pass, run on the users you select. Each new password or pass is shown once, and never kept.
Onboard a client from a blueprint
A blueprint is a YAML file that describes what a tenant should have: accounts, groups, admin roles, sign-in policies, device policies, shared mailboxes and sites.
- Start from a sample, such as Client Onboarding. Each sample asks for what it needs when you preview it, such as the client's name.
- Applying a blueprint adds what's missing and updates anything that differs. It never deletes anything or removes a member, owner, licence, assignment or permission.
- Use the same blueprint for the next client: select their tenant, preview, then apply. Applying it again adds only what's still missing.
- A new Conditional Access policy is report-only unless the blueprint turns it on, and every sample keeps its policies report-only.
- A blueprint needs the tenant to sign in with a certificate. Each change it makes goes in the tenant's change log, with the blueprint's name.
- Admin roles, role-assignable groups, eligible members and owners, and SharePoint sites, such as Client Onboarding's hub site, need Everything as the tenant's access. Manage covers accounts, groups, admin units, named locations, Conditional Access, Intune and Exchange Online.
Client reports in Word
Build documents creates a Word document and Excel workbook for each selected client, using that client's template. It processes clients in sequence.
- Scorecard reports rate what they find as OK, Warning or Critical, against thresholds you can change, and each has a section in the client's document.
- Set your brand in a template. Each client can have its own template, client name and logo.
- You can also run reports separately. They write each tenant's tables to an Excel workbook, where you can filter and export them.
- AI summaries stay off until you add your own provider and key in Settings, turn summaries on there, and enable them for each tenant. Names and detail tables are never sent.
Reports and documents on a schedule
Windows Task Scheduler runs reports, builds documents and runs workflows without a window, with the same settings, tenants and templates as the app.
- Choose the tenants a scheduled run includes in Altivane's list of tenants, or name them for 1 run with
--tenants. - A scheduled workflow makes its changes only when its command line adds
--apply. - Each run writes a log, and Task Scheduler shows the exit code as the task's last run result.
- Scheduled runs need certificate sign-in, and Altivane activated for the Windows user the task runs as.
Controlled changes, with a change log
A change runs from a window that shows what it does, the items it applies to and the tenant it goes to. Nothing is sent until you select Run.
- Enter never runs a change that blocks or removes something, such as Wipe a device.
- Unless it's turned off in Settings, every change that's sent goes in the tenant's change log: the change, its target, the values before and after where they can be read, the command, who was signed in, and which Windows account and computer made it.
- Each change log is a CSV file in the client's folder, ready to open in Excel.
- Altivane never sends a change again when it isn't sure whether the first try worked.
What stays on your computer
Altivane runs on your computer, and keeps what it reads and writes there. There is no Altivane cloud service holding your clients' data.
- Reports, documents, workflow files and change logs go to the output folder, with a folder for each tenant, so you decide where they live and who can read them.
- Altivane never holds a tenant password. The sign-in cache, the licence and AI keys are encrypted for your Windows account.
- Besides Microsoft's services for the tenant, it connects only to the licensing service, the update service when you select Help > Check for updates, and your AI provider if you turn summaries on. Nothing about a tenant is sent to the licensing service.
- The diagnostic log is never sent anywhere. A support bundle is a .zip file saved where you choose, and you decide whether to share it.
- For a client's security questionnaire, the data processing and security statement ends with short answers to the usual questions.
How it works
Add, choose, then work
Add each client
Sign in to the tenant once as an administrator, and choose the access.
Choose the tenant
Every page then works with it.
Set up, change, report
Changes go in the client's change log, and files in its folder.