Concepts

Templates, profiles, and tenants

The three building blocks that decide what runs on a device and for which client, and when you actually need a tenant.

4 min readUpdated Jul 31, 2026

The short version

Three things decide what happens when you provision a device:

Three things decide what happens when you provision a device, each one built from the layer beneath it:

Steps compose into templates; templates specialise into profiles
Stepsthe catalogue

Individual actions: install Windows, register with Autopilot, set the language. You pick them, you don't script them.

Templatesreusable, ordered, versioned

A bundle of steps in a fixed order. Authored once, used across many clients.

Profileswhat a technician picks

A template tailored for one client, with its own values and optional add-ons.

A tenant is a separate idea: it represents one client's Microsoft environment. You only need one connected when a profile does something inside Microsoft, most commonly Autopilot. More on that below.

Steps

A step is one unit of work: "install Windows 11", "register the device with Autopilot", "set keyboard to Belgian", "install an application". Each step comes from StageReady's built-in catalogue; you don't script them.

Some steps run on the device (via the USB), and some run on the StageReady backend (like registering a device with Microsoft). You don't have to worry about which is which. You just arrange them.

Templates

A template is an ordered list of steps you can reuse across many clients. Instead of rebuilding the same setup every time, you define it once.

There are two kinds:

  • Base template: the spine of a build (e.g. "Standard Windows 11 laptop"). A profile starts from exactly one base template.
  • Addon template: an extra set of steps you can layer on top (e.g. "HR tools", "Dell BIOS settings", "SAP"). A profile can include several addons.

Templates have a lifecycle: Draft → Published → Archived. Once a version is published it's frozen, so a job that's already running is never changed underneath you. Editing a template later creates a new revision; existing jobs keep the version they started with.

Editing a template never touches a running job

A job freezes its template revision the moment it starts. You can publish a new revision mid-build without any risk to devices already provisioning.

Profiles

A profile is what you actually assign to a client and what a technician selects at code-generation time. It takes a base template and makes it real for a specific situation by combining:

  • a base template (and optionally one or more addons),
  • variable values, admin-set settings like Language = Dutch.

Profiles can also inherit from a parent profile and store only the differences. So you might have a company-wide base profile, and per-client child profiles that only change the language and add one addon. No copy-paste.

Template vs profile in one line: a template is the reusable recipe; a profile is that recipe tailored for a client and ready to run.

Variables

A variable is a named value an admin sets ahead of time, which steps reference as a token like {{Language}}. Values resolve from the most general to the most specific, organisation → tenant → profile, so a profile's value wins over the tenant's, and the tenant's wins over the organisation default.

That precedence is what lets one template serve every client: set Language = English once at the organisation level, then override it to Dutch on the one client that needs it, without touching the template or forking anything.

Tenants

A tenant is one client organization's Microsoft 365 / Entra ID environment. An MSP manages many. In StageReady, tenants do two jobs:

  1. Microsoft access. When a step needs to act inside a client's Microsoft environment (register a device with Autopilot, assign it in Intune, add it to an Entra group), StageReady uses that tenant's connection. See CIPP and delegated access for how those connections work.
  2. Scoping. Technicians are assigned to the tenants they're allowed to work with, and profiles are made available per tenant.

Do you actually need a tenant?

Only if a profile does something inside Microsoft.

  • Doing Autopilot (or Intune / Entra steps)? Then yes. You need that client's tenant connected with credentials, because StageReady has to talk to their Microsoft environment to register the device.
  • Just installing Windows and applying local settings (language, keyboard, region, timezone, local admin) with no Microsoft enrolment? Then no Microsoft access is needed. You can run against a single placeholder/sample tenant without connecting any credentials at all.

In other words: tenants are about Microsoft integration and access, not about provisioning itself. For now the main reason to add real client tenants is Autopilot and delegated access. If that's not part of your flow yet, one sample tenant is enough to get going, and you can connect real client tenants later when you start enrolling devices.

Where to go next