Microsoft ecosystem
Connecting client tenants
How StageReady connects to a client's Microsoft environment — app-registration credentials today, CIPP and delegated access on the roadmap.
When a connection is needed
StageReady only needs access to a client's Microsoft environment when a profile does something inside it — most commonly registering a device with Autopilot. If you're only installing Windows and applying local settings, no connection is required. See do you actually need a tenant?
App-registration credentials (today)
The way you connect a tenant today is with per-tenant application credentials. Those secrets live only in Azure Key Vault and are read just-in-time when a job needs them — never stored in our database, in configuration, on the USB, or on the device. StageReady asks only for the access it needs to provision and enroll devices. See the security model for the full picture.
CIPP and delegated access (on the roadmap)
Many MSPs manage their clients through CIPP, an open tool for running many client tenants from one place, built on GDAP — Microsoft's Granular Delegated Admin Privileges. GDAP lets an MSP act inside a client tenant with limited, scoped rights instead of standing admin access.
Connecting through CIPP so you can reuse the delegated access you already manage — rather than configuring credentials tenant by tenant — is planned, not yet available. If that's important to your workflow, mention it on a demo and we'll share where it is on the roadmap.
Least privilege, always audited
However a tenant is connected, StageReady asks only for the access it needs, and every action is written to a permanent audit trail. More in the security model and the Microsoft ecosystem overview.