Tenants overview
The Tenants page provides an overview of all your tenants. It shows the number of users, consent status, and provides access to admin consent for the different On Demand modules.
On the Tenants page, each tenant tile lists the number of users in the tenant. The user count is divided into Cloud only and Hybrid users. Hybrid users are Microsoft identities that can access both on-premises and cloud-based resources.
A tenant houses the users in a company and the information about them. You must add a Microsoft 365 tenant to manage the tenant properties using an On Demand module.
Applications used to manage tenant properties must participate in the consent flow provided by Microsoft Entra. ID This means a Global Administrator must provide admin consent when adding a tenant to On Demand. Admin consent is granted on behalf of the Microsoft Entra ID organization.
In addition to the standard Microsoft Entra tenant, you can also add a B2C tenant. On the Tenant page, B2C tenants can be distinguished by the following icon next to the tenant name:
For more information on B2C tenants, see this Microsoft help page.
Adding tenants
When you add a tenant, you must have Microsoft Entra ID Global Administrator credentials in Microsoft Entra ID since part of the process of adding a tenant is done in the Microsoft Azure portal.
The Microsoft Entra ID Global Administrator role is the top level administrator role and has access to all features. By default, the person who signs up for an Microsoft Entra ID subscription is assigned the Global Administrator role for the tenant. Additional users can be assigned to the Global administrator role.
If you are in the U.S. region, once you select Tenants and click Add Tenant, you must select the type of tenant you are adding, whether commercial, GCC, or GCC High. When you click Add Commercial or GCC Tenant (or Add GCC High Tenant) you are redirected to the Microsoft tenant administration login page where you must log in with the Global Administrator credentials for the tenant.
If you are in any other region, you select Add Tenant and are immediately redirected to the Microsoft tenant administration login page where you must log in with the Microsoft Entra ID Global Administrator credentials for the tenant. After successful authentication, the Consent Grant dialog is displayed. You must confirm the consent grant.
GCC or a GCC High tenants are available only for deployments in the U.S. region.
Microsoft 365 GCC tenants are typically used by US public sector organizations and the contractor organizations that service them.GCC High tenants provide Microsoft 365 services that adhere to additional US Department of Defense security requirements. Customer eligibility to GCC High tenants is restricted.
Admin consent is required to add a tenant to On Demand. Since only an Microsoft Entra ID Global Administrator can grant admin consent, you must be able to provide Microsoft Entra Global ID administrator credentials for the tenant you are adding.
|
• |
Click Add Commercial or GCC Tenant |
Click Add GCC High Tenant
If you click Edit Consents on a GCC or GCC High tenant tile, in addition to the domain name and the tenant ID, you will also see the country code for the tenant.
At a later date, if you change the display name of the tenant or the default domain name in Microsoft Entra ID, you can refresh the tenant in On Demand to immediately update the name. When you refresh the tenant, On Demand rereads the tenant information from your Microsoft Entra tenant to synchronize with the On Demand stored data.
To refresh the tenant, display the Tenants page and click the refresh icon 
that displays beside the tenant name on the tenant tile.
Managing admin consent permissions
Once you add a tenant, you are redirected to a page that lists the permissions that will be granted. You must click Accept and provide admin consent for the On Demand application. Once the Global Administrator adds a tenant to On Demand, an application record is created in the tenant indicating that admin consent has been provided.
For security, when you first add a tenant, only the minimum permission settings are granted. Some modules require additional permissions for specific activities. Once a tenant has been added to On Demand, you can grant additional permissions on the Tenant Consents page.
On May 19, 2022, On Demand introduced a new consent experience using Microsoft Authentication Library (MSAL) which required that consent be regranted for modules that use delegated permissions. For details about MSAL, see About the Microsoft Authentication Library (MSAL) .
To open the Tenant Consents page, click Tenants in the navigation page and click Edit Consents on the tenant tile.
You can view the specific permissions for each On Demand application by clicking View Details. You can also see the last time that consent was granted and which On Demand user granted the consent.
About admin consent status
On the Tenant Consents page, you can view the module admin consent status for each tenant that you have added. The process of approving the use of an application for the Microsoft Entra ID organization by the Microsoft Global administrator is referred to as admin consent. A Microsoft Global administrator must provide admin consent when granting consents to any application listed on the page.
When a tenant is first added, On Demand requests base admin consent permissions. Some modules can function using the base permission set while other require a higher level of admin consent permissions.
When you grant consent in On Demand, a service principal is created in your tenant. Some On Demand modules require that a role be assigned to the service principal. The role is needed to support specific module functionality. For example, after granting consent for the Exchange Online PowerShell consent type, you must assign the Exchange Admin Role. This role is needed to perform Exchange tasks such as linking mailboxes to users and deleting mail-enabled groups.
