Customers & onboarding
Legacy tenants and upgrading to modular onboarding
Customers connected before modules existed use a single Collector app. They keep working; upgrading gives least-privilege apps, no certificates and a guided wizard.
- Who can do this
- Admin or Owner
- Plan
- All plans
- Time
- 5 minutes for the customer
What a legacy tenant is
Before modular onboarding, every tenant approved one read-only app, M365Assessments Collector (application ID 83a56eb5-8a95-493b-8d41-1544aafc40dd). These customers keep running assessments unchanged. Their page shows the Upgrade to modular onboarding card and, once consent is active, a Step 2 (for Exchange, Defender, Purview and Teams): assign Global Reader card with manual instructions.
Why upgrade
- One app per workload with least-privilege permissions, instead of one app with every permission.
- No certificates or secrets at all: the engine signs in with workload identity federation.
- A guided wizard that also assigns the read-only Global Reader role, instead of manual steps.
- Optional modules, including Power Platform, which is only available with modular onboarding.
Steps
Open the customer. On the Upgrade to modular onboarding card, select Choose modules.
Pick the modules and select Generate onboarding link. Send the link to the customer's Global Administrator (guide for customer administrators).
Assessments keep running on the Collector app until the administrator approves Core. From then on only the module apps are used.
After the upgrade, the customer can delete the M365Assessments Collector enterprise app: Entra admin center › Enterprise applications › M365Assessments Collector › Properties › Delete.
Important
Once Core has been approved, the customer never falls back to the Collector app. If the Core consent is later revoked, assessments stop with “Admin consent required” until it is granted again.
Last updated