1 tenant at a time
Choose the client in the Tenant box. Every page works with that tenant, and a change's window names it.
For MSPs
Microsoft 365 and Azure Management for MSPs
A Windows desktop application for MSPs. Add each client's tenant once, then work in 1 tenant at a time: set it up from a blueprint, see each change before it runs, and build the client's report in your brand.
What you get
The same setup for each client
A blueprint says what a client's tenant should have. Preview it, then apply it to add what's missing.
Reports in your brand
A Word document and an Excel workbook for each client, from a template with your look and the client's name and logo.
A record of each change
Each tenant's change log has the change, the command sent, who made it, and the values before and after.
Work in 1 client's tenant at a time
Add each client once. Then choose it in the Tenant box, at the top left: every page works with that tenant, and connects to it when it needs to.
- To add a client's tenant, sign in once as an administrator of the tenant and choose the access. Altivane registers itself there, grants admin consent, assigns the roles and tests each service. Get started has the steps.
- To sign in with a guest or partner account in the client's tenant, enter the tenant's domain or ID first.
- Choose the access for each client: Reports, which is read only, Helpdesk, Manage, Everything or Custom. Each option can list its permissions and roles before anything is granted.
- Each tenant has a folder of its own in the output folder, with its reports, documents, workflow files and change log.
- Helpdesk tasks, such as resetting a password or issuing a Temporary Access Pass, run on the users you select. Each new password or pass is shown once, and never kept.
Onboard a client from a blueprint
A blueprint is a YAML file that says what a tenant should have: accounts, groups, admin roles, sign-in policies, device policies, shared mailboxes and sites.
- Start from a sample, such as Client Onboarding. Each sample asks for what it needs when you preview it, such as the client's name.
- Preview reads the client's tenant and changes nothing. It shows what's already there and what's missing.
- Apply adds what's missing and updates what differs. A blueprint never deletes anything, or removes a member, an owner, a licence, an assignment or a permission.
- Use the same blueprint for the next client: select their tenant, preview, then apply. Applying it again adds only what's still missing.
- A new Conditional Access policy is report-only unless the blueprint turns it on, and every sample keeps its policies report-only.
- A blueprint needs the tenant to sign in with a certificate. Each change it makes goes in the tenant's change log, with the blueprint's name.
- Admin roles, role-assignable groups, eligible members and owners, and SharePoint sites, such as Client Onboarding's hub site, need Everything as the tenant's access. Manage covers accounts, groups, admin units, named locations, Conditional Access, Intune and Exchange Online.
Client reports in Word
Build documents writes a Word document and an Excel workbook for each client you tick, from the template that client uses. They build 1 after another.
- Scorecard reports rate what they find as OK, Warning or Critical, against thresholds you can change, and each has a section in the client's document.
- Set your brand in a template. Each client can have its own template, client name and logo.
- Reports also run on their own, to an Excel workbook for the tenant, with each table in a grid to filter and export.
- AI summaries are off until you set them up: your own provider and its key in Settings, summaries turned on there, and turned on for each tenant that should have them. Names and detail tables are never sent.
Reports and documents on a schedule
Windows Task Scheduler runs reports, builds documents and runs workflows without a window, with the same settings, tenants and templates as the app.
- Choose the tenants a scheduled run includes in Altivane's list of tenants, or name them for 1 run with
--tenants. - A scheduled workflow is a test run unless its command line adds
--apply. - Each run writes a log, and Task Scheduler shows the exit code as the task's last run result.
- Scheduled runs need certificate sign-in, and Altivane activated for the Windows user the task runs as.
Controlled changes, with a change log
A change runs from a window that shows what it does, the items it applies to and the tenant it goes to. Nothing is sent until you select Run.
- Enter never runs a change that blocks or removes something, such as Wipe a device.
- A workflow can be test run first: it reads the tenant and lists each change it would make, without making it.
- Unless it's turned off in Settings, every change that's sent goes in the tenant's change log: the change, its target, the values before and after where they can be read, the command, who was signed in, and which Windows account and computer made it.
- Each change log is a CSV file in the client's folder, ready to open in Excel.
- Altivane never sends a change again when it isn't sure whether the first try worked.
What stays on your computer
Altivane runs on your computer, and keeps what it reads and writes there. There is no Altivane cloud service holding your clients' data.
- Reports, documents, workflow files and change logs go to the output folder, with a folder for each tenant, so you decide where they live and who can read them.
- Altivane never holds a tenant password. The sign-in cache, the licence and AI keys are encrypted for your Windows account.
- Besides Microsoft's services for the tenant, it connects only to the licensing service, the update service when you select Help > Check for updates, and your AI provider if you turn summaries on. Nothing about a tenant is sent to the licensing service.
- The diagnostic log is never sent anywhere. A support bundle is a .zip file saved where you choose, and you decide whether to share it.
- For a client's security questionnaire, the data processing and security statement ends with short answers to the usual questions.
How it works
Add, choose, then work
Add each client
Sign in to the tenant once as an administrator, and choose the access.
Choose the tenant
Every page then works with it.
Set up, change, report
Changes go in the client's change log, and files in its folder.