Skip to content

REAL-TENANT-ONBOARDING.md

Latest commit

 

History

History
177 lines (131 loc) · 4.84 KB

REAL-TENANT-ONBOARDING.md

File metadata and controls

177 lines (131 loc) · 4.84 KB
Raw

E8CR Squad — Real Tenant Onboarding (No M365 Dev Program Required)

Goal: Get all 5 bots running against a real tenant in ~30–60 minutes.

Path options

  1. M365 Business Premium trial tenant (recommended)
  2. Existing business tenant (least-privilege app registration)

0) Prereqs

  • Tenant Global Admin for initial consent
  • One dedicated app registration for E8CR (or per-bot apps)
  • Test endpoint(s) enrolled in Intune + Defender for Endpoint connected
  • Python 3.11+ on runner host

1) App registration (single app for all bots)

Create app registration in Entra:

  • Name: e8cr-squad-bot
  • Auth: Application permissions only (client credentials)
  • Secret: 6–12 month client secret (store securely)

Collect:

  • AZURE_TENANT_ID
  • AZURE_CLIENT_ID
  • AZURE_CLIENT_SECRET

2) Required Microsoft Graph permissions (Application)

Shared base (all Graph-backed bots)

  • Directory.Read.All
  • AuditLog.Read.All

VM+PM Bot

  • DeviceManagementManagedDevices.Read.All
  • DeviceManagementConfiguration.Read.All
  • SecurityEvents.Read.All (if used in tenant)

Identity Bot

  • Policy.Read.All
  • RoleManagement.Read.Directory
  • UserAuthenticationMethod.Read.All
  • User.Read.All

App Control Bot

  • DeviceManagementConfiguration.Read.All
  • DeviceManagementManagedDevices.Read.All
  • DeviceManagementConfiguration.ReadWrite.All (only if policy deployment is enabled)

EDR Operator Bot

  • SecurityAlert.Read.All (or Graph Security equivalent in your tenant)
  • SecurityIncident.Read.All (if incidents endpoint used)

Backup Bot (if Azure Backup path used)

Graph app perms above are not enough by themselves. Also assign Azure RBAC on Recovery Services Vault:

  • Backup Reader (read-only validation)
  • Backup Contributor (if actions are needed)

After adding permissions: Grant admin consent.

3) Environment variables

# Shared Graph creds
export AZURE_TENANT_ID="<tenant-id>"
export AZURE_CLIENT_ID="<app-id>"
export AZURE_CLIENT_SECRET="<client-secret>"

# Backup provider (optional: Veeam)
export VEEAM_BASE_URL="https://veeam-server:9398"
export VEEAM_USERNAME="backup-admin@domain.com"
export VEEAM_PASSWORD="<secure-password>"
export VEEAM_VERIFY_SSL="true"

# Backup provider (optional: Azure Recovery Services)
export AZURE_SUBSCRIPTION_ID="<subscription-id>"
export AZURE_VAULT_NAME="<vault-name>"
export AZURE_RESOURCE_GROUP="<rg-name>"

4) 30-minute validation sequence

Step A — Graph auth sanity

python3 skills/e8cr-vmpm/scripts/graph_auth.py

Expect: token retrieval success.

Step B — Run each bot in audit mode

VM+PM

python3 skills/e8cr-vmpm/scripts/graph_devices.py
python3 skills/e8cr-vmpm/scripts/graph_patches.py

Identity

python3 skills/e8cr-identity/scripts/entra_mfa.py
python3 skills/e8cr-identity/scripts/entra_roles.py
python3 skills/e8cr-identity/scripts/entra_ca.py

App Control

python3 skills/e8cr-appcontrol/scripts/intune_appcontrol.py --mode audit
python3 skills/e8cr-appcontrol/scripts/intune_macros.py --mode audit
python3 skills/e8cr-appcontrol/scripts/intune_hardening.py --mode audit

Backup

python3 skills/e8cr-backup/scripts/provider_dispatch.py --mode detect
python3 skills/e8cr-backup/scripts/provider_dispatch.py --mode fetch-jobs

EDR

python3 skills/e8cr-edr/scripts/defender_alerts.py --mode list

Step C — Generate reports

python3 skills/e8cr-vmpm/scripts/generate_report.py --input /tmp/e8cr-demo --output /tmp/e8cr-demo/weekly-report.html
python3 skills/e8cr-identity/scripts/demo_generate.py --output /tmp/e8cr-demo/identity --full-pipeline
python3 skills/e8cr-appcontrol/scripts/demo_generate.py --output /tmp/e8cr-demo/appcontrol --full-pipeline
python3 skills/e8cr-backup/scripts/demo_generate.py --output /tmp/e8cr-demo/backup --full-pipeline
python3 skills/e8cr-edr/scripts/demo_generate.py --output /tmp/e8cr-demo/edr --full-pipeline

5) Common failures and fixes

insufficient privileges

  • Missing Graph permission or no admin consent granted.

resource not found on Intune endpoints

  • Tenant not licensed/configured for Intune yet.

EDR alert endpoint empty

  • Defender for Endpoint not onboarded on test devices.

Backup provider not detected

  • Missing env vars for Veeam/Azure backup.

6) Security controls for production pilots

  • Use dedicated app registration (do not reuse admin apps)
  • Scope permissions to minimum set above
  • Rotate secret every 90 days
  • Log all bot actions and report generation
  • Start in read/audit mode first, then enable writes/response actions

7) Definition of “tenant ready”

Tenant is ready when:

  • Graph token retrieval works
  • All 5 bots return non-error audit output
  • At least 1 report generated from real tenant data
  • Access-control checks documented for Backup/EDR actions