Tenant Administration User Guide
A step-by-step reference for reseller partners hosting and managing an EMM365 SMB tenant. Covers every tab under the Administration section of the application.
Tenant Administrators
Tenant Administrators have full access to the Administration area of EMM365. Use this tab to view who currently holds the Tenant Administrator role, grant it to additional users, and remove it when no longer needed.
The user also needs an F1 license assigned to access the Exostar app and tenant administration capabilities.
Tenant Configuration
Tenant Configuration contains the core system parameters for your EMM365 tenant. Most fields are pre-populated by Exostar during setup. As a reseller/tenant admin, you will primarily use this screen to verify settings and update the purchase links and locale.
The Tenant Configuration screen displays the core system parameters for your EMM365 tenant. Most fields are pre-populated by Exostar during setup and do not require changes.
| Field | Description | Notes |
|---|---|---|
| Tenant Type | Indicates the tenancy model (e.g. Multitenant for SMB). Set by Exostar at provisioning. | Read-only |
| Service Account Email | The Microsoft 365 service account associated with this tenant. | Set by Exostar — do not change |
| Service Account ID | Unique identifier for the service account in Azure AD. | Set by Exostar — do not change |
| Invitation URL | Required by the Microsoft invitation API for redirection during the invitation process. | Set by Exostar — contact Exostar to update |
| Issuer | MAG identity issuer string used for authentication. | Set by Exostar — do not change |
| IAM SP ID / Display Name | Service Provider identifiers for MAG integration. | Set by Exostar — do not change |
| M365 Application Display Name | Name of the M365 application registered in Azure. | Set by Exostar — do not change |
| Azure B2B Members Group ID | Used for license management in enterprise tenants configured as Standard (not Multitenant). Set by Exostar at provisioning. | Set by Exostar — do not change |
| Azure B2B Guests Group ID | Azure AD group for external/guest users (Partners). | Set by Exostar — do not change |
| License Purchase Link | URL displayed when a sponsor needs to purchase additional licenses. Update to your reseller purchase page. | Reseller-managed |
| Storage Purchase Link | URL displayed when additional storage needs to be purchased. Update to your reseller purchase page. | Reseller-managed |
| Trial Purchase Link | URL for converting trial subscriptions to paid. Update to your reseller purchase page. | Reseller-managed |
| Locale | Sets the language used for automated actions that are not a result of a user action in the UI, such as sending an email when provisioning a pending user. | Reseller-managed |
| Domain Authentication Source Validation | Determines whether partner domains will be automatically or manually configured when added. When set to Automated, domains are configured to authenticate using Exostar MAG — recommended for Multitenant tenants. | Reseller-managed |
| Sensitivity Protection | Not currently supported. Leave set to Disabled. | Not supported — do not change |
| Storage Quota (GB) | Relates to a feature that is not currently supported. Must remain set to 0 and should not be changed. | Not supported — leave at 0 |
| Attachment Size Limit (MB) | Sets the maximum file size that can be sent using the Send File Externally feature. Constrained by implementation — must not exceed 25 MB. | Reseller-managed — max 25 MB |
Tenant Domains
Tenant Domains is a registry of all email domains associated with this tenant. Domains are added automatically when a sponsor domain or partner domain is registered — there is no general need to add them manually here. The primary purpose of this tab is to configure and verify the authentication source for each domain, as authentication is configured per domain.
Do not change the Authentication Source once users from that domain have been invited. Changing it after users have been provisioned can break their ability to authenticate.
Tenant Features
Tenant Features controls product capabilities at the tenant level. Settings here apply globally to all sponsors on the tenant — they cannot be overridden at the sponsor level. Sponsor-level features (under Sponsor Features) are separate and reflect what individual sponsors have purchased or enabled.
Tenant Features control product capabilities at the tenant level. These settings apply to all sponsors on the tenant and cannot be overridden at the sponsor level. Sponsor-level features (configured separately under Sponsor Features) are additive — they reflect what a specific sponsor has purchased or enabled, not an override of tenant settings.
| Feature | Description | Default |
|---|---|---|
| Email Forwarding | Ensures IAM users in GCC High receive Microsoft-initiated emails. When enabled, IAM users (partners and sponsors) are invited to the tenant as members, given an F1 license and an email account. Emails are forwarded to the user’s alternate email address. Should be enabled in GCC High; do not enable in Commercial tenants. | On |
| License Limit Enforcement | When enabled, invitation of users in excess of available licenses for the sponsor is not permitted. When disabled, user invitation is not restricted by the number of licenses available. | On |
| Storage Metrics | When enabled, storage usage is calculated and displayed on the Teams Report and License tab for each sponsor. When disabled, storage usage is not calculated or displayed. | On |
| Licensed Users Report | When enabled, the Licensed Users Report is available on the Reports tab, displaying all pending and provisioned users invited by the sponsor. When disabled, the report is not available. | On |
| Server Side Operations for Reports | When enabled, report operations such as sorting, filtering and pagination are executed on the server. Should be on by default; only disable if there is a server-side processing issue. | On |
| Storage Quotas | When enabled, sets the storage quota for each team to the default storage quota for the tenant. Tenant administrators can add storage exceptions for teams that require additional storage. When disabled, storage quotas are set per Microsoft. Not currently supported — do not enable. | Off |
| Channel Management | Allows Team Managers and Sponsor Admins to view and add themselves to private channels on their team. When enabled, the Channel Management tab is visible under Manage Teams. When disabled, the tab is hidden. | On |
| Deleted Team Management | Allows Sponsor Admins and Tenant Admins to restore teams that have been deleted. When enabled, the Deleted Teams tab is visible under Administration and teams that were soft deleted can be restored. When disabled, the tab is hidden. | On |
| User Trend Report | Allows enterprise customers to view user trends (total users, change since previous day, partner vs. sponsor, etc.). When enabled, the report is available on the Reports tab for Standard and Premium configurations. When disabled, the report is hidden. | Off |
| Active Directory to Database Sync | When enabled, user profile information stored in the custom database is updated regularly to reflect user account information in Active Directory. When disabled, user profile information in the database is not updated automatically. | On |
| Sponsor Utilization Report | Provides a summary of usage statistics for each sponsor in the tenant such as license and storage usage and availability, number of sponsor and partner users, number of teams, etc. When enabled, visible to tenant admins on the Reports tab. When disabled, hidden for all users. | On |
| Remove Partner Domains | When enabled, an action column is displayed on the Domain Management tab allowing tenant admins and sponsor admins to remove partner domains when the associated user count is 0. When disabled, the option to remove partner domains is hidden. | On |
| Site Level Special Permissions | When enabled, special permissions including the ability to restrict downloads can be applied at the site level using the Permissions tab under Manage Teams. When disabled, the Permissions tab is hidden. | On |
| Delete Sponsor Domain Data | When enabled, admins can delete all data associated to a Sponsor Domain. Should be enabled in test environments only and used after offboarding is complete to delete the sponsor domain entirely. | Off |
| Archived Team Management | When enabled, teams can be archived (e.g. soft-delete) via an Archive Team tab displayed under Manage Teams. Archived Teams can be deleted or restored on the Archived Teams tab under Administration. When disabled, these tabs are hidden and teams cannot be archived. | On |
| Display UPNs | When enabled, User Principal Name (UPN) is displayed on User Management search results and the Licensed Users Report. When disabled, UPN is not displayed in these places. | On |
| SharePoint Audit Report | When enabled, the SharePoint Audit Report appears in the Reports menu for sponsor admins and tenant admins to retrieve SharePoint audit data for a selected team. When disabled, the report is not available. | On |
| OWA Management | DO NOT ENABLE IN BAES UK Tenant. When enabled, Outlook Web Access (OWA) is disabled by default for all users. Tenant admins can grant and remove mailbox access to individual users via the OWA Management tab under Administration. Users given mailbox access require an F3 license which is granted using this process. Requires a special security group with M365 F3 license assignment. Disabling does not re-enable mailboxes. Do not enable without guidance from Exostar. | Off |
| Automatic Export | When enabled, team managers and sponsor admins can choose (via checkbox on Team Details) to have messages sent to the team’s inbox automatically exported to the team when the file drop feature is enabled. When disabled, the checkbox is hidden and messages aren’t exported automatically. | On |
| Compliance Documents | When enabled, sponsor admins can download documentation on the Compliance Documents tab to aid their compliance during audit assessments. Documents available on the Compliance Documents tab are uploaded and managed by Exostar tenant admins. When disabled, the Compliance Documents tab is hidden. | Off |
| Copy Exostar Link | When enabled, the SharePoint file ECB menu includes the option “Copy Exostar Link” which generates a link to the document with parameters appended to support Exostar authentication. When disabled, this menu item is hidden. | On |
| Block Download By Default | When enabled, sponsor admins can choose whether downloads are blocked by default for new teams and private channels using the Settings tab under Administration. If Supplier Collaboration is enabled, supplier collaboration admins can choose whether downloads are blocked by default for new supplier sites using the Settings tab under Supplier Collaboration. When disabled, the setting is not visible and downloads are not blocked by default. | On |
| Permitted Users when Download is Blocked | When enabled, the Permitted Users column is displayed on Manage Teams/Permissions and allows Team Managers and Sponsor Admins to allow exceptions for specific users who require download access when download is blocked. The column is hidden when disabled. NOTE: This feature is not designed to be turned off after it has been enabled — any exceptions previously defined will remain active even if the feature is later disabled. | On |
| Offboarding | When enabled, the Offboarding tab is displayed under Administration allowing tenant admins to perform bulk actions when offboarding a customer. NOTE: This feature is not intended for use in enterprise tenants. | On |
| Administrative Actions | When enabled, the Administrative Actions tab is displayed under Administration and allows tenant admins to perform backend operations. | Off |
| Site Permissions Report | When enabled, the Site Permissions Report appears under the Reports tab, providing sponsor admins with a holistic view of all SharePoint sites in their enclave and the associated download permissions settings for each site. When disabled, the report is hidden. | On |
| Localization | When enabled, the localization dropdown is available in the application layout to allow users to select their preferred language. | On |
| EMSD Bundle Tracking | When enabled, tenant admins can indicate that a sponsor has purchased the EMSD bundle. The EMSD Bundle checkbox is displayed on the Onboard New Customer form, Add Sponsor modal, and Edit Sponsor modal. The EMSD column is displayed on the Sponsors grid and Sponsor Utilization Report. When disabled, the EMSD Bundle checkbox and column are hidden throughout the application. ⚠ Requires Exostar’s Managed Secure Desktop application to be deployed in the tenant before enabling. | Off |
Onboard New Customer
Use this screen to provision a new sponsor (customer organization) onto the tenant. This is the primary way reseller partners add new customers to their SMB tenant. Completing this form creates the sponsor, sets up their initial license count, and invites their first administrator.
This screen provisions a new sponsor (customer organization) onto the tenant in a single step. It creates the sponsor record, sets the initial license count, and invites the first Sponsor Administrator.
| Field | Description | Required |
|---|---|---|
| Sponsor Domain | Primary domain for the new customer (e.g. acme.com). | Required |
| Sponsor Name | Display name for the customer organization. | Required |
| Licenses Purchased | Number of user licenses to allocate. | Required |
| Sponsor Administrator Email | Email of the first admin for this sponsor. Click Lookup to resolve their Exostar account. | Required |
| Exostar Account | The specific MAG account to assign the admin role to. Appears as a dropdown if multiple accounts are found. | Conditional |
| Welcome Team Name | Name of the default team created for the sponsor. This is a starter team for the sponsor admin — no other users are automatically added to this team. | Optional |
| Features Purchased | Check boxes for features this customer has purchased (e.g. Compliant File Drop, Send Externally). | Optional |
Sponsors
The Sponsors tab lists all customer organizations provisioned on your tenant. From here you can view their status, add new sponsors, edit their details, and deactivate or reactivate them.
Sponsor Features
Sponsor Features configures product capabilities at the individual sponsor level. These settings reflect what a specific sponsor has purchased or enabled — they are not overrides of tenant-level settings. Tenant Features apply globally; Sponsor Features are additive for a specific customer.
Sponsor Features configure product capabilities at the individual sponsor level. These reflect what a specific customer has purchased or enabled — they are not overrides of tenant-level settings. Tenant Features apply globally to all sponsors; Sponsor Features add to that baseline for a specific customer.
| Feature | Description |
|---|---|
| Compliant File Drop | Enables File Drop for this sponsor. Requires the tenant-level File Drop feature to also be enabled. |
| Send File Externally | Enables Send File Externally for this sponsor’s Sponsor Admins and Team Managers. |
User Management
User Management gives the Tenant Administrator visibility into all users across all sponsors on the tenant. You can search for users, view their provisioning status and sponsor associations, and delete them.
• Tenant Administrator — the user is removed from all sponsors and deleted from the tenant entirely.
• Sponsor Administrator — the user is only removed from that sponsor’s teams and data. If the user belongs to other sponsors, they remain active for those sponsors.
Sponsor Administrators
This tab provides a tenant-level view of all Sponsor Administrators across every customer organization. Use it to see who holds admin rights for each sponsor and to add or remove that role at the tenant level when needed.
Recommended workaround: Invite the user to a team first (the team invitation flow allows account selection), then add them as Sponsor Administrator afterward.
Domain Management
Domain Management controls which external partner domains are authorized to collaborate with a specific sponsor’s teams. Users from an authorized partner domain can be invited to the sponsor’s teams; removing a domain prevents future invitations from that domain.
Licenses
The Licenses tab is where you manage user license counts and storage allocations for each sponsor. You can view current usage, update purchased license quantities, and adjust storage as customer needs change.
Deleted Teams
The Deleted Teams tab is only visible when the Deleted Team Management feature is enabled under Tenant Features. It provides a safety net — teams that have been deleted can be restored from here within 30 days of deletion.
Archived Teams
The Archived Teams tab is visible when the Archived Team Management feature is enabled. Archiving a team preserves its content but removes user access. Archived teams can be restored or permanently deleted from this tab.
Settings
The Settings tab contains per-sponsor behavioral configuration for the EMM365 enclave. Select the sponsor domain first, then configure settings for that sponsor.
The Settings tab configures per-sponsor behavioral settings for the EMM365 enclave. Select the sponsor domain first, then configure settings for that sponsor.
| Setting | Description |
|---|---|
| Block download by default | When enabled, downloading is blocked by default for all newly created teams and private channels for this sponsor. The setting can be adjusted per team or private channel under Manage Teams → Permissions. |
Offboarding
The Offboarding tab is used ONLY when fully removing a customer organization from the tenant — for example, when a reseller customer does not renew. It performs bulk removal across five sequential steps. Complete them in order before deactivating the sponsor.