Skip to content
Documentation
Getting Started
Onboarding Tenants

Onboarding Tenants

You onboard every tenant through the portal chat — there’s no separate console or “add tenant” form. Tell Hal what you want in plain language and he walks the rest.

There are two ways to get a tenant’s credentials in place, and both run through chat:

  1. Hal creates them for you — Hal registers the app registration or service account in the client tenant on your behalf, from a consent you authorize.
  2. You create them, then paste them to Hal — if you’d rather build the app registration or service account by hand, you do that in the client’s admin console and paste the resulting values into Hal’s chat.

Option 1 — let Hal create the credentials (recommended)

In your MSP portal, open the chat and tell Hal what you want:

“Add Acme Corp’s Microsoft 365 tenant.”

Hal will walk you through:

  1. Signing in to the tenant with a Global Admin account (Microsoft 365 / Entra ID) or a Super Admin account (Google Workspace).
  2. Confirming the tenant identity — Hal reads the tenant’s display name and verified domains and asks you to confirm.
  3. Creating the credentials — Hal registers the app or service account and grants the required read-only permissions, from the consent you authorized in step 1.
  4. Starting ingestion — Hal opens the log source, runs the first poll cycle, and reports back when events are flowing.

See the Assisted Onboarding overview for the full flow and the exact OAuth scopes used.

Option 2 — create the credentials yourself, then paste them in

If you followed the Microsoft 365 Token Setup or Google Workspace Token Setup and built the app registration / service account by hand, open the portal chat and tell Hal you have existing credentials. He’ll ask for the values you recorded — the directory/client IDs and secret for Microsoft 365, or the service-account key and admin email for Google Workspace — and you paste them into the chat. Hal validates them against the provider, opens the log source, and starts ingesting.

Either way, events flow into the portal within a few minutes, and the Logs → Sources page shows per-tenant health.

Questions? Contact us.

Audit Logging Prerequisites (M365 and Entra ID)