Customer onboarding checklist

Who should use this checklist

Recommended onboarding order

1. Create or select the customer tenant

   Confirm the ITDR tenant record, customer name, primary domain, and implementation owner before connector work starts.

2. Invite the customer tenant admin

   Give the right person access so they can review setup status, reports, and connector health.

3. Connect Microsoft — auto-managed (recommended)

   One Global Admin sign-in provisions a dedicated app registration in the customer tenant with Graph, Office 365 Management, Exchange and Teams permissions in a single consent. Covers ingestion, detection, response actions and posture; no separate Office 365 or posture-credential steps, and the secret rotates itself. Use delegated or app-only mode only when the customer cannot allow app creation or insists on registering the app themselves.

4. Validate the Microsoft connection

   Confirm the connector shows Active, the permissions-granted count matches the consolidated set, and organization plus sample identity data appear in ITDR.

5. Authorize Office 365 Management (delegated and app-only modes only)

   Auto-managed connectors already include this. For delegated mode run the separate Office 365 consent; for app-only mode add the Office 365 Management APIs resource to the app registration. Without it the mailbox-rule detections cannot fire.

6. Run the first sync

   Start ingestion and review connector status, warning buckets, and last-run timestamps.

7. Validate telemetry

   Confirm identity inventory, sign-in signals, audit data, alerts, incidents, and Secure Score where available.

8. Confirm posture (auto-managed) or add posture credentials (other modes)

   Auto-managed connectors provision the Microsoft 365 posture connector automatically and queue the first scan; just confirm it appears under Posture. For delegated or app-only connectors, or for Azure subscription posture, add credentials manually as described in the posture credentials article.

9. Configure notification channels

   Add Slack, Teams, or PagerDuty routing so alerts, incidents, connector degradation, and response-action outcomes reach the customer or partner operations channel.

10. Generate the first report

    Create a one-time assessment or weekly report and confirm that the findings match the customer environment.

11. Test the assistant with grounded prompts

    Ask a few operational questions and verify that answers include evidence, caveats, and relevant tenant context.

Customer setup packet

Collect these values before the implementation session. Do not paste secrets into tickets, email threads, or chat channels unless your organization has approved that secret-sharing process.

Validation gates

• Identity inventory loads with expected users, groups, and basic tenant metadata.
• Sign-in, audit, alert, or incident signals appear for the expected time window.
• Office 365 Management lane is authorized and shows import activity when workload audit data is in scope.
• Secure Score or security posture data appears where Microsoft permissions and tenant licensing support it.
• Posture findings appear for the expected provider, subscription, or Microsoft 365 scope.
• First assessment or weekly report can be generated and exported.
• Assistant answers include tenant-specific evidence, source references, and clear caveats when data is missing.

Minimum vs full access path

If customer approval is blocked by permission concerns, start smaller and expand after the first value is proven.

First questions to ask the assistant

Use questions like these after connector data and posture findings are available. Good answers should cite evidence and explain what data is missing.

• What should we focus on first across this tenant security posture?
• Which identities should we investigate first and why?
• Where are the largest MFA or conditional access gaps?
• Are our Microsoft and posture connectors healthy?
• Summarize this tenant risk for an executive review.

Completion handoff

Keep this handoff free of raw secrets. Reference the approved vault, ticket, or customer-owned secret channel when credentials are required.

Customer tenant:
Microsoft tenant ID:
Connector mode:
Graph authorization:
Office 365 authorization:
First sync status:
Posture provider:
First report generated:
Assistant validation prompt:
Open issues: