Management access
Allow RevoCloud to change customers' tenants (block sign-in, reset passwords, licences, groups, offboarding), and what it asks Microsoft for.
Updated
RevoCloud reads tenants by default. Management access lets it change them too. It's off until you turn it on, because write access to every customer's tenant is a bigger risk than read access.
Turn it on
- Settings → Integrations → Microsoft 365: switch Management access on (owners and admins).
- Click Update permissions so your workspace's app carries the write permissions. If you registered the app yourself, add the permissions listed under "What it asks Microsoft for" in Entra instead.
- Each customer's administrator consents again: the customer's Microsoft 365 card and its Microsoft 365 page say Re-consent to manage until they have. Send them a new consent link from the customer's Settings → Integrations.
What it asks Microsoft for
| Permission | What needs it |
|---|---|
| User.EnableDisableAccount.All | Blocking and unblocking sign-in |
| User-PasswordProfile.ReadWrite.All | Resetting a password |
| User.RevokeSessions.All | Signing a user out everywhere |
| LicenseAssignment.ReadWrite.All | Adding and removing licences |
| GroupMember.ReadWrite.All | Adding and removing group members |
| Exchange.ManageAsApp (Exchange Online) | Mailbox steps of offboarding, and the PowerShell console's Exchange commands |
| RoleManagement.ReadWrite.Directory (delegated, used once) | Giving your app the Exchange Administrator role in the tenant when its administrator consents. The sign-in's token is used in that moment and never stored |
Microsoft also limits changes to administrator accounts: blocking or resetting an administrator may need a directory role for your app in that tenant. When Microsoft refuses, Revo says so and nothing changes.
Who can do what
Reading tenants needs See customers' Microsoft 365 tenants (owners, admins, technicians and analysts). Changing them needs Manage customers' Microsoft 365 users (owners, admins and technicians). Both can be limited to selected customers. Every change is in the tenant's history and the audit log, with what it changed.
Turn it off
Switch it off and RevoCloud's actions stop at once. Click Update permissions to take the write permissions off your app too.