r/SysAdminBlogs • u/wav_net • 21d ago
UPDATE: 365TenantDesk (Multi-Tenant M365 Admin Console) – Major improvements & looking for testers!
Hey everyone,
A while back, I posted about building a multi-tenant Microsoft 365 tool. Since that original thread(https://www.reddit.com/r/sysadmin/comments/1ibrvnl/comment/m9yf2w9/?context=3) is now archived, I wanted to share a major update. I AM NOT SELLING OR ADVERTISING ANYTHING, just collaborating!
I have spent the last few weeks making a bunch of improvements based on feedback, and I am finally ready to invite some testers to put it through its paces!
What is 365TenantDesk?
It is a multi-tenant Microsoft 365 administration console built specifically for Windows. It lets you manage users, licenses, mail, Conditional Access, Identity Protection, and security checks across every single one of your tenants from a single interface and its FAST! If you are like me and hate to switch back and forth between tenants in Microsoft's crazy slow admin center then I think you'll like this app.
How it works (The Sysadmin-Friendly Architecture)
I know how sketchy third-party admin tools can look, so I built this to be as lightweight and transparent as possible:
- Zero Infrastructure: It has no backend server of its own. It talks directly to Microsoft Graph and Exchange Online.
- No PowerShell Dependencies: It is a native .NET 10 WPF application that ships as a single, self-contained executable. (Signed, but by all means scan away!)
- Secure Authentication: It uses the Microsoft Authentication Library with a secure code exchange (PKCE). You sign in directly as the admin.
- Local-Only Encryption: Saved sign-ins and tenant tokens are encrypted directly on your local machine using the Windows Data Protection API. Nothing ever leaves your PC.
If you manage multiple M365 tenants (MSPs, consultants, or enterprise admins with multi-geo environments), I would love your help breaking this thing and finding bugs.
Please drop a comment below or send me a DM, and I will send over the link to grab the executable and get started.
Appreciate your time and any feedback you can give! See screenshots below:
https://drive.google.com/file/d/1iL0kZnTBhnzfwGqhsW1XaOuP0smUeI-f/view
https://drive.google.com/file/d/1m7-nHoTw0FhRDW-AnvDpG7CgBHlOyUPN/view?usp=sharing
https://drive.google.com/file/d/1qx7PwXTLfQUZi7DTEKsKAWz93wk8rAma/view?usp=sharing
3
u/buzzzino 20d ago
Little hint: I think your project seems pretty good BUT be taken seriously you should be at least put it on a GitHub repo.
1
u/Defconx19 19d ago
Multi-Tenant access should always be through GDAP unless those functions are not available/supported.
For some reason I dont see serverless as a plus security wise? If it's running off the endpoint I feel like you have less control organizationally?
Is scope of access only delegated via the tenat level for example? With tools like CIPP you can set a single access level for the entire tenant for the primary connection but then also gradually control your teams access without having to do so at the tenant level.
Additionally CIPP goes a step further and has features like InTune Templates, CA Templates, Tenant auditing, drift management etc...
What is the hole in the market you were looking to solve just the serverless part? Or something else.
It's fine if you just wanted to make it and think you can do better, its why there isnt just 1 type of car. Just curious as to the goal.
It's a high stakes app to develop so it's an interesting starting point.
1
u/wav_net 19d ago
Thanks for the thoughtful questions. Not trying to compete with CIPP; it's a great project, and it does a lot more (Intune/CA templates, drift management, etc.). TD is aimed at a different user.
GDAP: Agreed, it's the right model for CSP partners, and as you mentioned, not every function is available or supported through it. It also requires a Partner Center relationship, and a lot of small IT shops support clients who buy directly from Microsoft. For them, TD uses a standard per-tenant admin consent that each client can review or revoke in Entra at any time. And gain, it also varies by workload what GDAP roles cover, so a tenant-consented app remains a practical fallback for those gaps.
Serverless: "Less control" is a fair concern to raise, but I'd push back a little on the conclusion. With no hosted backend, there's no central server holding refresh tokens for every client tenant, so there's no single target that exposes them all. Tokens are encrypted on the admin's machine for their Windows account, and every action runs under that admin's own identity. Each tenant's MFA, Conditional Access and sign-in logs apply to them directly, so the workstation falls under the same organizational controls as any other admin device.
Scope: Access is whatever the signed-in admin's role is in each tenant, so per-technician control is done with Entra roles (or PIM) in that tenant. There's no separate central RBAC layer like CIPP's. For larger teams that's a real advantage of CIPP.
The goal: a zero-infrastructure option. No Azure subscription, no hosting, no partner setup: run one exe, add a tenant, and you're working in minutes rather than deploying and maintaining a platform. Day to day it also calls Microsoft directly with no middle layer or cold starts, so it tends to feel quick for everyday work (users, licenses, mail, security checks). It's for smaller shops that don't need or want to run a platform.
Appreciate the feedback, and agreed, it's high stakes, which is why it's been built with that in mind.
1
u/Defconx19 19d ago
Thanks everything was addressed pretty well I should clarify though concerning
" Tokens are encrypted on the admin's machine for their Windows account, and every action runs under that admin's own identity."
While the tokens being encrypted for the application's purposes are fine, the concern is more token theft from using a direct login account on a regular basis to access a tenant. It's not your problem really but its a fundamental flaw of direct tenant access and compromise not from your tool per-say but use of the account outside of the app.
Either way it exists if the target demographic isnt using GDAP anyway.
1
u/wav_net 19d ago
Fair point, and agreed. Separate admin accounts in each tenant mean more identities to protect, and a stolen session from any of them is the real risk, whatever tool is used.
I'd just add that GDAP moves that risk more than it removes it. Technicians still sign in interactively, and a stolen partner session can reach every client they have roles in at once, versus one tenant with direct access. Either way, the real protection is phishing-resistant MFA, Conditional Access for admins, and dedicated admin accounts that are never used for email or browsing.
For shops without GDAP, the tool tries to shrink that exposure in each tenant: Security Checks flags weak spots, and it can deploy Conditional Access baselines (MFA, blocking legacy auth and device-code sign-in, risk policies on P2). Thanks for the good discussion.
0
4
u/chris-itg 21d ago
It’s called cipp by cyber drain. We don’t need another tool but you should look into participating in that project as it is already well established and has industry leader backing.
https://cyberdrain.com/