Create the customer organization / container in TMS.

If you do not have permission to create it at the right level, or do not know what you’re doing (exactly) then open a ticket with CET.  The ticket will need to contain:

If performing some testing, in production, ensure that the container is created under the ‘Readiness‘ container.

You will need to decide the type of container from this list:

Tenant Customer

These have no child/children containers. The end-customer, a single Office 365 tenant.

Partner

This is for partners. This container can’t contain other partners, but can contain other types of container.

Distributor

This is for resellers/distributors. They don’t have any services on top of the product. Distributors can contain all other types of partner.

Multi-tenant customer

This is for end-customers, and means that multiple container can be added beneath it.

(Other restrictions will be included as we learn about them).

If you add a container to TMS, it means that you will be the first System Administrator in the new organization. If you raise the ticket to CET, remember to include yourself as requiring access so that you can continue with the steps to onboard the customer.

Quadrotech lead account (ie you; the person driving the onboarding) will logon to the Nova TMS portal, where they will invite the first customer account. This first account should be an administrator account in the customer tenant, otherwise SSO can not be configured. They’ll give the account appropriate roles.  Ensure the invite is sent to the users SMTP address. (Might be the same as UPN, might not)

Roles are described here. It is highly likely that the first account should be given System Administrator rights (so that account then be used to add additional accounts)

The customer account will get two emails. These are shown below, take a look at them and go to the instructions below the two emails.

First email

When there are no other users associated with the organization / container (which should be the case since the container was just created) the customer-user receives an email inviting them to associate.

The email looks like this:

Second email

This email invites the specific user.

The email looks like this:

Have the customer open the first email, and follow the link. It will take them to this page:

The customer should choose the second option. This relates to QTID.

The customer will then be asked to accept permissions, as shown below:

The customer will now be redirected to the Portal page. If it is not the case then go here.

The customer can now logon to the platform, but will not have access to anything.  The invite is not complete until the user logs Into Nova. Once they do login the invitation will change to an association when you view it on the tenant in TMS:

Once logged in, the tenant should show as connected in TMS.

Make sure that the account logs in, refreshing the page in TMS will ‘never’ get the tenant to show as ‘connected’. It’s triggered by that login activity.

If you make a mistake when logging on with admin for the tenant e.g. your account does NOT have the correct rights see article to correct this.

To provision Reporting in Nova, follow the steps in this article

To setup Delegation & Policy Control contact CET using the form in the DPC channel in the Nova Support team. You will need:

• • The OrgID for the tenant. This is in the URL for the tenant:

• • Which region is needed (US or EU)
  • The name of the tenant
  • Whether it’s a customer or partner
  • Which environment it should be created in (production, development, staging)
  • Ensure that Martin Svancarek is made a System Administrator.

Refer to the DPC backend hierarchy training for more information. If this is a single tenant for a customer then the OrgID of the tenant itself is needed. If this is a partner or a customer with multiple tenants, it will probably need to be the OrgID from a higher level of the tree structure. Remember a DPC backend can not be nested under a DPC backend.

This steps only needs to be done for new deployments. Adding tenants to an already deployed DPC backend is automated.

Once you have completed the on boarding of both the customer container, then you will need to authorise the licensing of the products the customer has bought or activate a trial.

The licensing for the product will be one (or more) of the following

A trial license for either (trial licenses are by default licensed for a month):

• • DPC
  • Service monitor
  • Reporting.
  • Adoption Accelerator

Add appropriate subscriptions, based on the customer’s needs.

Subscriptions can be seen on the ‘Subscriptions’ tab:

Delegation & Policy Control can operate in trial mode. See more here.

Around 30 minutes after configuring DPC you will be able to perform the remainder of the configuration. This includes the following which are all performed in DPC.

• • Authorizing the application (so we can use the Graph API)

• • Adding a service account (so we can use PowerShell). Service Account requirements are described here.
  • Helping the customer configure their dashboard
  • Inviting other users with other roles, from the customer organization
  • Setting up policies

Remember to review the jobs within DPC. In a small tenant the jobs will run to do an initial data collection, and they’ll execute quickly. For a large tenant these jobs may take some time.