One-click fix
By default Rollout only reads. With "one-click fix" Rollout may do a few fixed things in a client tenant: assign a license, add someone to a group or link a laptop to an employee. Only with consent, four eyes and a plan that can't change any more.
Professional Plus, Enterprise and trial licenses. It's off by default; an administrator switches it on per organization.
What it does, and what it never does
| Change | Rollback | Permission of the write app |
|---|---|---|
| Assign a license from the role profile | Remove the license | LicenseAssignment.ReadWrite.All |
| Add to a group from the profile, or to the assignment group of a required app | Remove from that group | GroupMember.ReadWrite.All |
| Link the Autopilot laptop to the employee | Unlink | DeviceManagementServiceConfig.ReadWrite.All |
Never: creating or deleting accounts, roles, passwords, MFA methods, Conditional Access, policies, mailboxes or apps. The database and the server both refuse anything not on this list.
From plan to execution
Scroll here or press play.
Thirteen layers
Each layer stands on its own; if one fails, nothing happens.
- Separate write app, only for tenants in both allowlists, never with a client secret.
- Exactly three permissions: if the write app has one more, Rollout executes nothing.
- Only what belongs to the project: licenses and groups from the role profiles. Role-assignable groups, dynamic groups and groups from on-premises AD are always refused.
- Read first, then write.
- Four eyes, checked in the database.
- Step-up when approving and when switching it on.
- Sealed plan with a fingerprint.
- Short-lived and single-use: two hours, once.
- Limits: max 200 changes per plan, 50 plans per day, 10 executions per hour, stop after 5 failures in a row.
- Kill switches: per organization (a button) and per installation (
EXECUTION_DISABLED=1). - License is checked on the server.
- Everything recorded in the audit log, with an alert to Teams.
- Rollback only of what Rollout actually changed.
Setting it up (once per MSP)
Only do this for clients who agreed to it in writing, for example in the data processing agreement.
- App registration Rollout – Write
In your own tenant, multi-tenant, without a redirect URI. Give it a federated credential for your Vercel project (as in step 3), never a client secret.
- Exactly three permissions
Application permissions:
LicenseAssignment.ReadWrite.All,GroupMember.ReadWrite.AllandDeviceManagementServiceConfig.ReadWrite.All. Nothing more. - Environment variables
GRAPH_WRITE_CLIENT_ID(must be a different app from the read app),GRAPH_WRITE_FEDERATION=vercelandGRAPH_WRITE_ALLOWED_TENANTSwith only the tenants where this is allowed. - Client consent and switching it on
The client grants consent to the write app (same flow as for reading). Then an administrator switches One-click fix on in Rollout; that requires signing in again.