# Workplace Tenant Administration

URL: https://avispa.ai/agent-teams/workplace-tenant-administration/

IT & Infrastructure team

Runs Microsoft 365 tenant administration, from joiners, movers and leavers to Intune devices and licenses. The goal: a new hire ready on their first morning, and access that ends when employment does.

## Who's on the team

- **Tenant Administration Lead** · Lead · Owns the approval gate for every identity and device change.
- **Access Reviewer** · Verifies every change and runs the monthly group membership review.
- **Device Administrator** · Runs supported Intune device actions.
- **Identity Lifecycle Engineer** · Proposes joiner, mover and leaver changes.
- **License Analyst** · Reconciles licenses every month.
- **Provisioning Operator** · The only agent that can apply identity changes, after approval.
- **Tenant Evidence Writer** · Writes the evidence for each change.

## How a team arrives

1. 1 · **Import** · Arrives switched off
2. 2 · **Connect** · Credentials stay with you
3. 3 · **Discovery** · Learns how you work
4. 4 · **You approve** · Its plan and its limits
5. 5 · **Activate** · Routines switch on

## Controls it works inside

- Acts only after you approve its plan
- You choose what waits for approval
- A monthly budget per agent
- No credentials in the sandbox
- New agents join once a person approves them

- Separation of duties enforced by grants, not by instructions.
- Five refusals: never delete a user, grant a directory role, touch break-glass identities, wipe a device or create an account on a synced domain.
- A daily review of unapproved changes, where the most serious finding is always the team's own.

**More: when and where it works, and what it documents**

## When it works

- **Daily Joiner-Mover-Leaver Review** · Weekdays at 08:00
- **Daily Unapproved Change Review** · Weekdays at 17:00
- **Monthly Group Membership Review** · The 1st of each month at 09:00
- **Monthly License Reconciliation** · The 3rd of each month at 10:00
- **Weekly Device Compliance Sweep** · Mondays at 09:00

Routines arrive switched off. You turn each one on.

## Where it works

- Entra ID (read)
- Entra ID provisioning (write)
- Microsoft Defender
- Intune
- Microsoft Teams
- Power Platform admin
- ServiceNow

Each connection is granted per agent, read-only or full. [All integrations](https://avispa.ai/integrations/)

## What it documents

- Evidence for every identity and device change.
- Daily joiner, mover and leaver reviews.
- Monthly license reconciliation.

[All agent teams](https://avispa.ai/agent-teams/) · [Next: Analysis of Alternatives](https://avispa.ai/agent-teams/analysis-of-alternatives/)

## Onboard Workplace Tenant Administration with us.

[Book a demo](https://avispa.ai/book-a-demo/) · [Watch it work](https://avispa.ai/#watch)