A tenant's setup in 1 file
Users, groups, admin units, named locations, Conditional Access, Intune policies, scripts and app assignments, shared mailboxes, lists, contacts and SharePoint sites.
Blueprints
Set Up a Client's Tenant from 1 File
A blueprint says what a tenant should have. Preview shows what's already there and what's missing, and Apply adds the rest. It never removes anything.
What you get
Admin roles through PIM
Role-assignable groups, each eligible for a set of admin roles, so an admin activates a role only when it's needed.
A preview first
Preview reads the tenant and changes nothing. Each row says what applying would do, and why when it can't.
Adds, never removes
Apply adds what's missing and updates what differs. Applying it again adds only what's still missing.
How it works
Write, preview, then apply
Start from a sample
Or a blank file. The editor lists any problems.
Preview
Enter the values it asks for, and review the rows. Nothing changes.
Apply
Each change goes in the change log.
A blueprint is a YAML file
Each object has a key, such as staff, that other objects name it by. Parameters ask for values when you preview, such as the client's name.
blueprint: 1
name: Staff and helpdesk
description: Staff, a PIM helpdesk group and a report-only sign-in policy.
parameters:
client: { label: Client name, required: true }
admin: { label: Admin account's sign-in name, required: true }
entra:
groups:
breakGlass: { name: Break Glass Accounts, existing: true }
staff: { name: "${client} Staff", members: ["${admin}"] }
helpdesk:
name: "PIM ${client} Helpdesk"
roleAssignable: true
members: ["${admin}"]
roles:
- { role: Helpdesk Administrator, as: eligible, for: P365D }
conditionalAccess:
staffMfa:
name: Require MFA for staff
state: reportOnly
users: { include: [staff], exclude: [breakGlass] }
apps: { include: [All] }
grant: { require: [mfa] }| Section | What it declares |
|---|---|
parameters | What to ask for when you preview. ${name} puts a value in, and ${tenant. is the tenant's own domain |
entra | Users, guests, groups, admin units, named locations and Conditional Access. A user or group takes admin roles, eligible or active |
intune | Compliance policies, configuration profiles, settings catalogue and endpoint security policies, scripts, and assignments for apps already in the tenant |
exchange | Shared, room and equipment mailboxes, distribution, mail-enabled security and dynamic lists, and contacts |
sharepoint | Communication and team sites, with their owners, members, visitors and sharing |
changes | Changes from the change catalogue that add or set something, such as keeping sent items in a shared mailbox |
- A person who isn't in the blueprint is named by their sign-in name or address.
- An object marked
existing: truemust already be in the tenant. The blueprint adds to it, such as members, but never makes or changes it. - A new Conditional Access policy is report-only unless the blueprint says
state: on. - The editor lists anything that's wrong under Problems, with its line.
- Build with AI can write a first draft from your description, through your own AI service.
Preview, then apply
A preview lists a row for each object and each link, such as a member of a group or an admin role, with what applying would do.
| Action | What it means |
|---|---|
| Create | The object isn't in the tenant and would be made |
| Update | The object is there, and some of what the blueprint declares is different. Detail says what |
| Add | A link to add, such as a member, an owner, a licence or an assignment |
| No change | Already in place |
| Can't | Can't be done, and Detail says why. Rows that need it can't be done either |
| Not read | The tenant couldn't be read for this row, and Detail says why |
- Apply works in order: Entra ID first, then Intune, Exchange Online, SharePoint and the changes.
- Nothing is sent for a row that's No change. A row that can't be done, or waits on a row that failed, is skipped.
- The confirmation names what needs care: rows that give admin roles, turn a policy on, stop enforcing one or trust more addresses in a named location.
- Each change goes in the tenant's change log, with the blueprint's name.
- Passwords for new accounts are shown once, at the end.
Adds and updates, never removes
An update changes only what the blueprint declares. A value left empty keeps the tenant's.
- A blueprint never deletes anything, or removes a member, an owner, a licence, an assignment or a permission.
- A group keeps the members the blueprint doesn't name, and a named location keeps its other ranges.
- An existing group, admin unit or dynamic list keeps its rule, and an existing site keeps its sharing. Detail says when a rule differs.
- An existing Intune or Conditional Access policy keeps its settings. A blueprint changes only a Conditional Access policy's state.
Start from a sample
Each sample asks for what it needs when you preview it, such as the client's name or an admin's sign-in name. Every sample keeps its Conditional Access policies report-only.
| Sample | What it adds |
|---|---|
| Client Onboarding | An emergency access account, staff and Windows device groups, a report-only policy that requires MFA outside the office, Windows compliance, a time zone script, a shared mailbox, an all staff list and a hub site |
| Client Site | A communication hub that staff can read, and a team site for the client's documents |
| Device Baseline | Compliance policies for Windows, macOS and iOS, and a script that sets the time zone on Windows devices |
| PIM Admin Groups | Role-assignable groups, each eligible for a set of admin roles, and a group that holds Global Reader |
| Report-Only Conditional Access | Common sign-in policies, all report-only: MFA for admins, everyone and guests, legacy authentication and other countries blocked, and a compliant device for Office 365 |
| Shared Mail and Lists | Shared mailboxes for accounts and enquiries, a meeting room, an all staff list and a contact for the outside accountant |
Before you apply
A blueprint previews and applies on 1 tenant at a time, the one you selected.
- The tenant needs certificate sign-in. A blueprint doesn't preview or apply on a tenant that signs in interactively.
- Admin roles, role-assignable groups, eligible members and owners, and SharePoint sites need Everything as the tenant's access. Manage covers accounts, groups, admin units, named locations, Conditional Access, Intune and Exchange Online.
- A workflow can apply a blueprint with its Apply a blueprint step. The step makes no new accounts: apply a blueprint that makes accounts from Altivane's Blueprints page.