### Quick Details **Recommended Agent:** On-Demand
**Supported Agents:** On-Demand or Self-Managed
**Is Auto-Discovered By:** N/A
**Can Auto-Discover:** Microsoft 365 Education Child Inspectors (one per School)
**Parent/Child Type Inspector:** Yes
**Inspection via:** API
**Default Run Frequency:** Daily (maximum cadence every 8 hours)
**Data Summary:** [Microsoft 365 Education Summary](https://docs.liongard.com/docs/m365-education-inspector-summary) # Overview The Microsoft 365 Education Inspector reads the school roster of a [Microsoft 365 Education](https://learn.microsoft.com/en-us/graph/api/resources/education-overview) tenant — Schools, Classes, and Class members (students and teachers) — through the Microsoft Graph Education API, and segments it into one Liongard Environment per School. It is a separate Inspector from the main Microsoft 365 Inspector and makes no changes to it. Education tenants routinely hold many Schools inside a single tenant, and Partners managing school districts need per-School separation rather than one aggregated view. A parent launchpoint enumerates every School in the tenant and auto-discovers a child launchpoint for each one; each child reads the Classes in its School and the members (students and teachers) of each Class. Schools, Classes, and rosters are commonly populated by Microsoft School Data Sync (SDS) from a Student Information System, so the data this Inspector surfaces reflects the district's authoritative roster — giving Partners School-level documentation, change tracking, and reporting without logging into the tenant per School. # Inspector Setup Preparation ## Configure Authentication for the Microsoft 365 Education Inspector The **Microsoft 365 Education Inspector** authenticates using **Microsoft Graph**. Authentication is configured **once on the parent launchpoint**, and all discovered child launchpoints automatically inherit those credentials. Before creating the parent Inspector, choose one of the following authentication methods: - **Liongard Microsoft Sign-In (SSO)** _(Recommended)_ - **Azure App Registration (Client Credentials)** *** ## Prerequisites Before configuring the Inspector, ensure you have the following: - A **Microsoft 365 Education** tenant with **Schools, Classes, and Rosters** populated (typically through Microsoft School Data Sync). - A **Microsoft 365 tenant administrator** who can grant Microsoft Graph permissions. - Your **Microsoft Entra Directory (Tenant) ID**. - You can find this in the **Microsoft Entra admin center > Overview**. - If using **Client Credentials**, an Azure application registration configured with the required Microsoft Graph permissions. ### **Note:** The Client Credentials authentication method supports **single-tenant** environments only. If you manage customer tenants through **CSP** or **GDAP**, use the **Liongard Microsoft Sign-In (SSO)** method instead. *** ## Authentication Options ### Option 1: Liongard Microsoft Sign-In (Recommended) The **Liongard Microsoft Sign-In (SSO)** method provides the simplest setup and is recommended for most environments. > **No Azure application registration is required.** During launchpoint configuration, a Microsoft 365 tenant administrator grants consent to Liongard's multi-tenant application. After authentication is complete, Liongard securely stores and automatically refreshes the Microsoft authentication token after each successful inspection. **Requirements** - A Microsoft 365 tenant administrator is available to grant consent - A **Liongard-hosted** or **On-Demand Agent** *** ### Option 2: Azure App Registration (Client Credentials) Use this method if you prefer to authenticate with your own Azure application. ### **Important:** Client Credentials authentication supports **single-tenant** deployments only.
### Step 1: Register an Application 1. Sign in to the **Microsoft Entra admin center**. 2. Navigate to **Applications > App registrations**. 3. Select **New registration**. 4. Create a new application. *** ### Step 2: Assign Microsoft Graph Permissions Under **API permissions**, add the following **Application** permissions: | Permission | Required | | ------------------------------------------------------- | --------------------------------------------------------------------------- | | **EduRoster.ReadBasic.All** _or_ **EduRoster.Read.All** | Required | | **User.Read.All** | Required | | **Group.Read.All** | Required | | **Member.Read.Hidden** | Optional (required only if your organization uses hidden class memberships) | After adding the permissions: 1. Click **Grant admin consent**. 2. Confirm the consent request. *** ### Step 3: Create a Client Secret 1. Navigate to **Certificates & secrets**. 2. Select **New client secret**. 3. Copy the **Value** of the client secret immediately. ### **Important:** Microsoft only displays the client secret value once. Store it securely before leaving the page. *** ### Step 4: Record the Application Information From the application's **Overview** page, record the following values: - **Application (Client) ID** - **Directory (Tenant) ID** You'll use these values when configuring the Microsoft 365 Education Inspector in Liongard. # Inspector Setup ### Step 1. Parent Inspector Setup Since a single Microsoft 365 Education tenant holds many Schools, you set up a single "**Parent**" Inspector with the tenant credentials. The Parent then auto-discovers a "**Child**" Inspector for each School. In Liongard, navigate to **Admin → Inspectors → Inspector Types**, select the **Microsoft 365 Education** Inspector, and click **Add System.** Fill in the following: - **Type of Inspector:** Parent - **Environment:** Select the Environment for this tenant - **Friendly Name:** Suggested naming: \[Customer Name] Microsoft 365 Education Parent - **Agent:** Select an On-Demand Agent (required for SSO) - **Inspector Version:** Latest - **Authentication:** For SSO (recommended), leave Authentication on, click Open Microsoft Sign-In, and complete the Microsoft consent prompt as a tenant administrator. For CSP/GDAP partners, also enable Tenant Settings (multi-tenant). To use Client Credentials instead, turn Authentication off and enter the Azure Application (client) ID, Azure Application (client) Secret Value, and Azure Directory (tenant) ID from Option 2 above. - **Azure Directory (tenant) ID:** The tenant's Directory (tenant) ID. - **Scheduling:** The Inspector defaults to running once a day at the time it is set up. Adjust the schedule here if needed. ### Step 2: Child Inspector Setup After the first run of the Parent Inspector, your Schools will be Auto-Discovered in the **Discovered Systems** tab on the **Inspectors → Microsoft 365 Education** page. Each discovered School maps one-to-one to a Liongard Environment by School name; child launchpoints are named **Microsoft 365 Education - (School name).** Activate or Archive your Discovered Systems by ensuring they are **mapped to the correct Environment → check the checkbox to the left of the Inspector(s) → select the Actions drop-down menu → Activate Launchpoints.** ## Manage a Customer's Microsoft 365 Education Tenant (GDAP/CSP) If you're managing a customer's Microsoft 365 Education tenant through **GDAP** or **CSP**, configure the child launchpoint using your existing multi-tenant parent launchpoint. ### **Prerequisite:** A **GDAP relationship** must already exist between your Microsoft Partner Center account and the customer's Microsoft 365 tenant. This relationship is configured in Microsoft and is required before Liongard can access the customer's tenant. *** ### Step 1: Verify Your Parent Launchpoint Confirm that your parent **Microsoft 365 Education** launchpoint is configured for multi-tenant management. Verify that: - **Tenant Settings (Multi-Tenant)** is enabled. - **SSO consent** has been completed. This configures the parent launchpoint to use Liongard's multi-tenant Microsoft application rather than authenticate to a single Microsoft Entra tenant. *** ### Step 2: Create a Child Launchpoint 1. Create a new **Microsoft 365 Education** launchpoint. 2. Assign it as a **child** of your existing multi-tenant parent launchpoint. 3. Enter the **Azure Directory (Tenant) ID** of the **customer's tenant**, **not** your partner tenant. *** ### Step 3: Allow the Initial Inspection During the first inspection, Liongard uses the authorization from your parent launchpoint and Microsoft Partner Center to obtain an access token scoped specifically to the customer's tenant. No additional consent is required within the customer's Microsoft 365 tenant. *** ### Step 4: (Optional) Enable Application-Based Permissions If delegated permissions do not provide access to all education data (such as class rosters), enable **Application-Based Permissions** on the child launchpoint. When enabled, Liongard uses **application-level Microsoft Graph permissions** for that specific customer tenant, allowing access to additional education resources. > **Note:** After enabling this option, Microsoft may take several minutes before the new permissions become fully available. #