Connect client tenants

Rollout reads at your clients whether everything is ready for the switch: account, license, groups, MFA and laptop. For this you create one app registration with read-only permissions, without a password or secret, and each client grants consent once.

App registration "Rollout – Readiness"

Faster with the setup assistant

In Rollout, under Setup, there's an assistant that generates a PowerShell script creating both app registrations (Login and Readiness) correctly in one go. Below is what that script does, so you can review it or do it by hand.

New registration, multi-tenant
Entra → App registrations → New registration
- Name: Rollout – Readiness
- Supported account types: Accounts in any organizational directory (multi-tenant: clients grant consent to this app)
- Redirect URI (Web): https://<your-domain>/toestemming

Read permissions only

API permissions → Add a permission → Microsoft Graph → Application permissions:

Permission	Used for
`User.Read.All`	Does the account exist, is it enabled, which licenses
`GroupMember.Read.All`	Is the employee in the right groups
`LicenseAssignment.Read.All`	License assignment and free licenses
`AuditLog.Read.All`	Last sign-in, MFA registration, hypercare
`DeviceManagementServiceConfig.Read.All`	Autopilot registration of the laptop
`DeviceManagementManagedDevices.Read.All`	Laptop in Intune, compliant, last sync
`DeviceManagementApps.Read.All`	Required apps assigned
`Organization.Read.All`	Tenant name and domains (to detect a wrong tenant ID)

Optional for migration checks: MailboxSettings.Read and BitlockerKey.ReadBasic.All.

Don't click "Grant admin consent" for your own tenant unless you use it as a test client yourself.

No secret: federation with Vercel

Instead of a password, the app registration only trusts your Vercel project. So there's nothing that can leak.

First in Vercel: project → Settings → Security → Secure backend access with OIDC federation: on, mode Team.

Then in Entra: Certificates & secrets → Federated credentials → Add credential → Other issuer:

Field	Value
Issuer	`https://oidc.vercel.com/<team-slug>`
Subject identifier	`owner:<team-slug>:project:<project-name>:environment:production`
Audience	`https://vercel.com/<team-slug>` (change the default!)
Name	`vercel-<project-name>-production`

Case-sensitive: copy it exactly. Do not create a client secret or certificate.

Note the application ID
It becomes GRAPH_CLIENT_ID in step 4. It isn't a secret.

Why this is secure

With federation there's no key to your clients' tenants: on every request Vercel proves "I am this project", and Microsoft only trusts that one project. Even someone with access to the code or the database can't reach your clients. Self-hosting without Vercel? Then use a certificate or a managed identity, see Self-hosting.

Connecting a client

You do this per client, in the app itself (Project → Connection → Connect client). Only an administrator can link a tenant to a client.

Client consent

Step 0 / 8

You (admin)in Rollout

Rolloutyour domain

Client adminGlobal Administrator

Microsoftclient's tenant

Domain: contoso.com

Consent link + email

Sends the email

Opens link, signs in, Accept

Back to /toestemming

Test connection

Which rights do I really have?read-only

Connected

Scroll here or press play.

Two locks on every tenant

Rollout only reads from a tenant if it passes both locks:

Lock 1: allowlist
Tenant ID is in GRAPH_ALLOWED_TENANTS, outside the app and the database
Lock 2: own client
The tenant belongs to a client of your organization (Row Level Security)
Only then read
Only the read permissions the client approved

Adding a new client is therefore deliberately a manual step: add the tenant ID to GRAPH_ALLOWED_TENANTS and redeploy. Even if someone managed to create a client with a foreign tenant ID in the database, Rollout won't read there.

Check

Test connection on a test tenant shows green for the permissions
The app registration has no client secret and no certificate, only a federated credential
An engineer (not an administrator) can't enter a tenant ID for a client