Tenants and roles
MDO works with many tenants from one sign-in. Each tenant is a Microsoft 365 organization, your own or a client’s, connected through Microsoft admin consent.
Connecting a tenant
Section titled “Connecting a tenant”See Getting Started. To add another tenant later, open the tenant switcher in the sidebar and choose Connect another tenant.
Switching tenants
Section titled “Switching tenants”The tenant switcher in the sidebar lists the tenants you have access to (press T to open it). Pick one and MDO shows that tenant’s data. With two or more tenants, All tenants shows them side by side.
Each tenant’s data is kept apart inside MDO by Postgres row-level security.
During the beta, each organisation has a limit on how many tenants it can connect, set by us. Ask if you need more.
Users and roles
Section titled “Users and roles”Open Users under Admin in the sidebar to manage who can work in a tenant.
| Role | What it can do |
|---|---|
| Owner | Every permission, including bulk deletes and bulk restores. |
| Admin | Everything except bulk deletes, bulk restores and the organization-level actions kept for the Owner. Admins can invite and manage users, connect tenants, configure storage, start backups, restore single policies, deploy baselines, change Settings › Apps and Settings › Compliance scope, and record compliance exceptions and attestations. |
| Deployer | Deploy, edit, repackage, roll back, uninstall and delete the apps MDO manages, upload custom apps, change app assignments, start an Intune sync and acknowledge policy changes. Can’t bulk-delete apps, start backups, restore policies, configure storage, manage users, record compliance exceptions or export the audit log. |
| Viewer | Read-only. Can see the tenant’s data and can’t change anything. |
MDO’s server checks the role on every request, so these limits apply whether someone uses the web app or calls the API.
Inviting a user
Section titled “Inviting a user”- Click Invite team member.
- Enter their email address and choose a role.
- Send the invite.
MDO emails an invitation. The address must be in your organization’s domain, in the domain of a connected tenant, or end in .onmicrosoft.com. The user signs in with their Microsoft work account.
Changing a role or removing a user
Section titled “Changing a role or removing a user”Each user row has a Change role button and a Remove button. Removing a user asks for confirmation, and they lose access straight away. You can’t change your own role, and the organization owner’s row can’t be edited.
Tenant settings
Section titled “Tenant settings”Settings under Admin has two tabs for the selected tenant:
- Compliance scope: which devices each standard scores. See Compliance.
- Apps: whether MDO creates groups for each app it deploys, the group name pattern, and whether the tenant has granted Group.Create. See Deploying apps.