MSPs onboarding a client
Hand over the as-built document on day one, in Word, ready to edit into your own binder, with your cover and logo.
Microsoft 365 Tenant Documentation
The as-built document of your tenant, written by one run.
A new client, a finished engagement, an audit next month: someone has to write down how the Microsoft 365 tenant is set up. GlacierPoint Atlas reads identity, sign-in and access, mail flow, mail protection, devices, collaboration and licensing in one run, and writes the dated document: numbered sections in plain sentences, tables and six diagrams, as a PDF and a Word file.
You need a Windows computer and a Microsoft 365 administrator account. Details below.
Read-only: nothing in your tenant is changed
No mail, file, message or sign-in log is ever read
Every sentence comes from the run, none from a template guess
The first page after a run
The cover and one paragraph on the state of the tenant.
The tenant, the date, the person who ran it, and how many sections, pages and diagrams follow. Then a paragraph written from the facts: how many users are licensed, how mail enters and leaves, what signs in under what conditions, how many devices are managed.
After a run
ExampleContoso: 10 sections, 31 pages, 6 diagrams.
412 users, 388 licensed and 24 not. Mail enters through one third-party gateway and leaves directly. 23 Conditional Access policies govern sign-in, 19 of them enabled. 297 devices are managed under 6 compliance policies.
- 3 Sign-in and access23 policies, 4 named locationsFigure 3
- 4 Mail flow2 inbound connectors, 1 gatewayFigure 4
- 7 Devices297 managed, 6 compliance policiesFigure 7
contoso.com, an example tenant. Dated, with the name of the person who ran it.
What you need
- A Windows computerWindows 10 or Windows 11, 64-bit, for the app. It is a single program, with nothing else to install.Get the app
- A Microsoft 365 administrator accountA run asks for read permissions only. An administrator who can consent for your organization grants them once.Every permission, by name
- Exchange Online PowerShellFor the mail flow and mail protection sections. A section whose module is missing is printed as a one-page notice that names it.The modules
- A computer that is on, for scheduled runsWatch and MSP write a new document every month from a Windows task on a computer of yours. A run missed while it was off starts at the next sign-in.Scheduled runs
The document
Ten numbered sections, in the same order every time.
Every section opens with its diagram or its headline table and a plain description, then the settings as tables, then a note for anything the sign-in could not read.
Tenant overview
The organization, its domains, the workloads in use, the subscriptions, and who holds which administrator role.
Figure: Tenant topology: domains, workloads in use, administrator roles
Identity and directory
Users and groups by count and kind, applications and service principals, on-premises synchronization, federation and cross-tenant access.
Figure: Identity sources: on-premises sync, federation, guest access
Sign-in and access
Conditional Access policies, named locations, authentication methods and strengths, security defaults.
Figure: Conditional Access map: who, from where, to what, with what grant
Mail flow
Accepted and remote domains, connectors, transport rules, DKIM, SPF, DMARC and MX as published, forwarding.
Figure: Mail flow: inbound and outbound paths through connectors and gateways
Mail protection
Anti-spam, anti-malware, anti-phish, Safe Links and Safe Attachments, preset policies, quarantine, allow and block lists.
Figure: Protection pipeline: the order mail passes the filters
Information protection
Sensitivity labels and their policies, data loss prevention, retention.
Second release: until then a one-page note names the module it needs
Devices
Intune compliance, configuration, enrollment, update rings, app protection, filters and roles, with device counts.
Figure: Device management: enrollment paths, compliance to Conditional Access
Collaboration
SharePoint and OneDrive sharing, Teams meeting, messaging and external access.
Second release: until then a one-page note names the module it needs
Licensing
Subscriptions, seats, assigned and unassigned, service plans on or off.
Administrators and support
Directory role members, partner (GDAP) relationships, service principals that hold directory roles.
Figure: Shown in the figure of section 1
Sections 6 (information protection) and 8 (collaboration) ship in the second release, because each needs a PowerShell module you install. Until then they print as a one-page note that names the module, so the numbering never changes. An appendix closes the document: the change log since the previous document, the register of what was not collected, and a glossary.
Who it is for
The document you would otherwise bill days to write.
Consultants closing an engagement
Leave behind a dated record of how the tenant stood when you finished, and a change log when you come back.
Administrators facing an audit
Answer “how is it configured?” with a document whose every number comes from one run, and whose gaps are listed, not hidden.
How it works
Sign in, connect, run, document.
A Windows app does the reading with your own sign-in. The portal writes the document and keeps it for your team.
Sign in
Create your workspace with your work email: a six-digit code, no password. The free Preview starts at once.
Connect
Download the Windows app from the portal and start it. It shows a code, and an owner or operator of your workspace approves it.
Run
Sign in to Microsoft with your administrator account. The app reads the sections, looks up your domains’ mail records, and sends the result to the portal sealed.
Document
The portal writes the document as pages behind your sign-in, a PDF and a Word file. Add your notes and the next document prints them.
The change log
A new document every month, and what changed since the last.
With Watch and MSP, the app runs once a month on a computer of yours, and the portal mails your team when the new document is ready, with the number of changes in the subject.
- Added, removed and changed items by section, between the two newest documents
- The change log closes the document as its appendix
- Your notes are printed under their sections in every new document
New document mail
Example- From
- GlacierPoint Atlas
- Subject
- Contoso: new document, 9 changes
The November document of Contoso is ready. Since October:
- Require MFA for administrators3 Sign-in and accessAdded
- Inbound connector from the gateway4 Mail flowChanged
- Legacy mobile device policy7 DevicesRemoved
The PDF and the Word file are one click away in the portal.
Security
It reads your configuration. It changes nothing.
The document describes how a tenant is set up, so Atlas reads settings, policies and counts, and nothing that people wrote or received.
- Read-only. Every read is a read. The app has no write permission to your tenant’s data and never changes a setting.
- No vendor access. We hold no password, token, secret or certificate for any tenant. The app on your computer does the work, signed in as you.
- One write, named in advance. Scheduled runs need an app registration of your own in your directory, with read permissions only. You review every line before it is written, and you can remove it at any time. Nothing else is ever written to your tenant.
- Encrypted before it leaves your computer, and at rest. Each run is sealed on your computer before upload and stored encrypted by the portal.
With the other GlacierPoint products
Assess, capture, change, verify. Then write it down.
GlacierPoint Scan finds configuration weaknesses and sets priorities; GlacierPoint Snapshot preserves configuration history and recovers supported settings. Together: assess, capture the current configuration, make the approved changes, verify. GlacierPoint Atlas writes down how the tenant stands, as a dated document for the handover, the binder or the audit.
About GlacierPoint
GlacierPoint Technologies builds tools that keep Microsoft 365 and Windows environments known, safe and recoverable.
We started from a simple observation: most organizations don't know where their directory and tenant stand until something goes wrong, and the tools that could tell them are written for specialists. Our products put a clear answer in front of the people who have to act on it — a brief a leadership team can read, evidence an administrator can verify, and changes you approve one at a time.
Clarity
Plain-language reports and prices on the page. The same evidence sits behind every number.
Control
You authorize every collection and every change. Nothing runs in your environment without your sign-in, and every change our tools make records a way back.
Security first
Evidence is encrypted on your computer before it leaves. We never train AI on customer data, and support sees your data only when you grant it, for as long as you choose.
Pricing
Priced per tenant. Start free with the Preview.
Paid plans differ by how long they run, whether the document is written on a schedule, and how many tenants you look after. Never by what is read.
One-time $299 per tenant for 30 days; Watch $29 per month, $290 a year billed in advance; MSP $149 a month plus $19 a month per tenant. See the plans
Every workspace starts as the free Preview. Compare the plans in full, with the MSP plan’s monthly totals worked out.
See the document of your own tenant today.
The free Preview runs up to 2 times on one tenant: the summary, section 1 in full, and the headline tables and diagrams of the rest. Decide with your own tenant in front of you.