Overview

The Microsoft 365 Education Inspector reads the school roster of a Microsoft 365 Education tenant — Schools, Classes, and Class members (students and teachers) — through the Microsoft Graph Education API, and segments it into one Liongard Environment per School. It is a separate Inspector from the main Microsoft 365 Inspector and makes no changes to it.

Education tenants routinely hold many Schools inside a single tenant, and Partners managing school districts need per-School separation rather than one aggregated view. A parent launchpoint enumerates every School in the tenant and auto-discovers a child launchpoint for each one; each child reads the Classes in its School and the members (students and teachers) of each Class. Schools, Classes, and rosters are commonly populated by Microsoft School Data Sync (SDS) from a Student Information System, so the data this Inspector surfaces reflects the district's authoritative roster — giving Partners School-level documentation, change tracking, and reporting without logging into the tenant per School.

Inspector Setup Preparation

Configure Authentication for the Microsoft 365 Education Inspector

The Microsoft 365 Education Inspector authenticates using Microsoft Graph. Authentication is configured once on the parent launchpoint, and all discovered child launchpoints automatically inherit those credentials.

Before creating the parent Inspector, choose one of the following authentication methods:

• Liongard Microsoft Sign-In (SSO) (Recommended)
• Azure App Registration (Client Credentials)

---

Prerequisites

Before configuring the Inspector, ensure you have the following:

• A Microsoft 365 Education tenant with Schools, Classes, and Rosters populated (typically through Microsoft School Data Sync).

• A Microsoft 365 tenant administrator who can grant Microsoft Graph permissions.

• Your Microsoft Entra Directory (Tenant) ID.

  • You can find this in the Microsoft Entra admin center > Overview.

• If using Client Credentials, an Azure application registration configured with the required Microsoft Graph permissions.

  📘

  Note:

  The Client Credentials authentication method supports single-tenant environments only. If you manage customer tenants through CSP or GDAP, use the Liongard Microsoft Sign-In (SSO) method instead.

---

Authentication Options

Option 1: Liongard Microsoft Sign-In (Recommended)

The Liongard Microsoft Sign-In (SSO) method provides the simplest setup and is recommended for most environments.

No Azure application registration is required.

During launchpoint configuration, a Microsoft 365 tenant administrator grants consent to Liongard's multi-tenant application. After authentication is complete, Liongard securely stores and automatically refreshes the Microsoft authentication token after each successful inspection.

Requirements

• A Microsoft 365 tenant administrator is available to grant consent
• A Liongard-hosted or On-Demand Agent

---

Option 2: Azure App Registration (Client Credentials)

Use this method if you prefer to authenticate with your own Azure application.

Step 1: Register an Application

1. Sign in to the Microsoft Entra admin center.
2. Navigate to Applications > App registrations.
3. Select New registration.
4. Create a new application.

---

Step 2: Assign Microsoft Graph Permissions

Under API permissions, add the following Application permissions:

After adding the permissions:

1. Click Grant admin consent.
2. Confirm the consent request.

---

Step 3: Create a Client Secret

1. Navigate to Certificates & secrets.
2. Select New client secret.
3. Copy the Value of the client secret immediately.

   ‼️

   Important:

   Microsoft only displays the client secret value once. Store it securely before leaving the page.

---

Step 4: Record the Application Information

From the application's Overview page, record the following values:

• Application (Client) ID
• Directory (Tenant) ID

You'll use these values when configuring the Microsoft 365 Education Inspector in Liongard.

Inspector Setup

Step 1. Parent Inspector Setup

Since a single Microsoft 365 Education tenant holds many Schools, you set up a single "Parent" Inspector with the tenant credentials. The Parent then auto-discovers a "Child" Inspector for each School.

In Liongard, navigate to Admin → Inspectors → Inspector Types, select the Microsoft 365 Education Inspector, and click Add System. Fill in the following:

• Type of Inspector: Parent
• Environment: Select the Environment for this tenant
• Friendly Name: Suggested naming: [Customer Name] Microsoft 365 Education Parent
• Agent: Select an On-Demand Agent (required for SSO)
• Inspector Version: Latest
• Authentication: For SSO (recommended), leave Authentication on, click Open Microsoft Sign-In, and complete the Microsoft consent prompt as a tenant administrator. For CSP/GDAP partners, also enable Tenant Settings (multi-tenant). To use Client Credentials instead, turn Authentication off and enter the Azure Application (client) ID, Azure Application (client) Secret Value, and Azure Directory (tenant) ID from Option 2 above.
• Azure Directory (tenant) ID: The tenant's Directory (tenant) ID.
• Scheduling: The Inspector defaults to running once a day at the time it is set up. Adjust the schedule here if needed.

Step 2: Child Inspector Setup

After the first run of the Parent Inspector, your Schools will be Auto-Discovered in the Discovered Systems tab on the Inspectors → Microsoft 365 Education page. Each discovered School maps one-to-one to a Liongard Environment by School name; child launchpoints are named Microsoft 365 Education - (School name).

Activate or Archive your Discovered Systems by ensuring they are mapped to the correct Environment → check the checkbox to the left of the Inspector(s) → select the Actions drop-down menu → Activate Launchpoints.

Manage a Customer's Microsoft 365 Education Tenant (GDAP/CSP)

If you're managing a customer's Microsoft 365 Education tenant through GDAP or CSP, configure the child launchpoint using your existing multi-tenant parent launchpoint.

---

Step 1: Verify Your Parent Launchpoint

Confirm that your parent Microsoft 365 Education launchpoint is configured for multi-tenant management.

Verify that:

• Tenant Settings (Multi-Tenant) is enabled.
• SSO consent has been completed.

This configures the parent launchpoint to use Liongard's multi-tenant Microsoft application rather than authenticate to a single Microsoft Entra tenant.

---

Step 2: Create a Child Launchpoint

1. Create a new Microsoft 365 Education launchpoint.
2. Assign it as a child of your existing multi-tenant parent launchpoint.
3. Enter the Azure Directory (Tenant) ID of the customer's tenant, not your partner tenant.

---

Step 3: Allow the Initial Inspection

During the first inspection, Liongard uses the authorization from your parent launchpoint and Microsoft Partner Center to obtain an access token scoped specifically to the customer's tenant.

No additional consent is required within the customer's Microsoft 365 tenant.

---

Step 4: (Optional) Enable Application-Based Permissions

If delegated permissions do not provide access to all education data (such as class rosters), enable Application-Based Permissions on the child launchpoint.

When enabled, Liongard uses application-level Microsoft Graph permissions for that specific customer tenant, allowing access to additional education resources.

Note: After enabling this option, Microsoft may take several minutes before the new permissions become fully available.