How to use the Connect Microsoft wizard
Make one Global Admin sign-in and the Connect Microsoft wizard checks, lesson by lesson, that your own Microsoft connection and its three apps are really working, so mailboxes, client tenants, dispatch calendars and CyberSentry can all use it.
Browse
On this page
How to do it
Open Settings, then System, then Setup Wizards, and click Connect Microsoft.
The page is called Guided setup and shows "Recommended next" with the first wizard you have not finished. Connect Microsoft sits under the Integrations group and is first in the setup order. It has 4 lessons.
Read the introduction and click Start the lessons.
If you have started before, the button reads "Continue: lesson" with the next lesson number, and "Review the lessons" once all are done. The wizard remembers your place in this browser. Back and Next let you read ahead without acting.
Lesson 1, Connect Microsoft as admin: click Open Microsoft setup and sign in as a Global Admin.
On the Microsoft page, click Connect Microsoft as Admin and sign in with a Global Admin account on your own tenant. A regular user or a guest sign-in either fails outright or shows Microsoft's "Need admin approval" screen. Back in the wizard, click Re-check. The lesson shows Verified when the connection is real, and then Mark verified turns on.
Note: Mark verified stays off until the check passes. A lesson cannot be ticked off on faith.Lesson 2, Create your app registrations: check it is green, or open app creation.
The guided setup creates the MSP Runtime and Client Access apps right after you connect, so most people find this lesson already green. If it is not, click Open app creation, run Run Azure App Creation on the Microsoft page, then click Re-check.
Lesson 3, Mail Auth app ready: create the third app and re-check.
Mail Auth exists for one thing: mailbox sign-ins go through it. Create it from the same app-creation section, then Re-check. Once it is green, the Connect your mailboxes wizard can do its work.
Lesson 4, How this runs day to day: read it and click Got it.
A health check runs every morning at 5 AM against your apps. It watches for permission changes, for credentials close to expiring, and it tests each client tenant that has consented to confirm the grant still holds. When it warns you, open the Microsoft page and run the one-click re-consent or rotate the credential there. That is usually a once-a-year job, plus a re-consent whenever a release adds a Microsoft permission.
When the last lesson is done, click See what's next.
The page says "All steps reviewed" and counts how many lessons you applied and skipped. Exit leaves the wizard at any point.
What you will have
- Connect your own Microsoft tenant with one Global Admin sign-in.
- Have the MSP Runtime, Client Access and Mail Auth apps created and checked.
- Know what the morning health check watches, and what to do when it warns you.
Why it works this way: How to use the Connect Microsoft wizard
Much of what the portal does with the outside world can flow through Microsoft: the client tenants you sync users and licenses from, the calendars dispatch books techs onto, the sign-in data CyberSentry watches, and, if your mail runs on Microsoft 365, the mailboxes that send and receive ticket email. All of it hangs off one connection to your own Microsoft tenant.
That connection is three apps with one job each. MSP Runtime reads your own tenant. Client Access reads the client tenants you consent later. Mail Auth is what Microsoft 365 mailboxes connect through. Forwarded mail does not need it.
Each lesson that says Verified has been checked against the real connection, so green means Microsoft is ready, not just clicked through.
Other ways to do this: How to use the Connect Microsoft wizard
Do it on the Microsoft page without the wizard
Open Integrations, then Microsoft Entra ID (the article What the Microsoft Entra ID and Mail pages show tours that page). Connect as an admin, then run app creation. The wizard is the same setup with a check after each part.
If it did not work: How to use the Connect Microsoft wizard
- A lesson says "Not connected yet": finish the linked step on the Microsoft page, then click Re-check.
- Microsoft shows "Need admin approval": the account is not a Global Admin on that tenant, or the tenant allows only a Global Admin to approve new apps. Sign in again with a Global Admin account on your own tenant. A regular user or a guest account from another tenant will not work.
- The Mail Auth lesson stays red: run app creation again on the Microsoft page and re-check.
Questions this page answers
What does the Connect Microsoft wizard do?
It walks you through connecting your own Microsoft tenant with one Global Admin sign-in, creating the MSP Runtime, Client Access and Mail Auth apps, and checking each against the real connection.
Who can run the Connect Microsoft wizard?
A Super Admin or Admin in your portal, signing in to Microsoft with a Global Admin account on your own tenant.
Why does Connect Microsoft say Not connected yet?
The lesson checks the real connection. Finish the linked step on the Microsoft page, then click Re-check. Mark verified turns on only after the check passes.
Do I need Connect Microsoft if my mail is forwarded?
No. Forwarded mail does not need the Mail Auth app. You still need Connect Microsoft for client tenant sync, dispatch calendars and CyberSentry.
Was this helpful?