Registered Tenants
Manage which customer organisations can access InnerCircle Workplace Suite.
➕ Add Tenant
| Organisation | Tenant ID | Expiry | Status | Consent | Actions |
|---|---|---|---|---|---|
| Loading… | |||||
Setup & Administration Guide
Internal reference for AVI-SPL staff managing the InnerCircle Workplace Suite deployment.
📋 Contents
🔑 App Registrations (Entra ID)
InnerCircle requires two separate Entra ID app registrations in the AVI-SPL tenant.
1. InnerCircle (Multi-tenant)
Used by end users across all customer tenants.
Supported account types: Accounts in any organisational directory
Redirect URI (SPA):
API permissions (Delegated):
• User.Read
• Presence.Read.All
• People.Read
• Calendars.Read
• Place.Read.All
• MailboxSettings.Read
Admin consent required — all permissions above need admin consent in the customer tenant.
Supported account types: Accounts in any organisational directory
Redirect URI (SPA):
https://innercircle.tandilab.com/innercircle/API permissions (Delegated):
• User.Read
• Presence.Read.All
• People.Read
• Calendars.Read
• Place.Read.All
• MailboxSettings.Read
Admin consent required — all permissions above need admin consent in the customer tenant.
2. InnerCircle Admin (Single-tenant)
Used only by AVI-SPL staff in the admin portal.
Supported account types: AVI-SPL tenant only
Redirect URI (SPA):
API permissions (Delegated):
• User.Read
• Organization.Read.All
• Mail.Send
Mail.Send is used by the Send Email button in the Tenants tab to email consent links to customer admins. No customer-side consent needed — stays entirely within the AVI-SPL tenant.
Supported account types: AVI-SPL tenant only
Redirect URI (SPA):
https://innercircle.tandilab.com/admin/API permissions (Delegated):
• User.Read
• Organization.Read.All
• Mail.Send
Mail.Send is used by the Send Email button in the Tenants tab to email consent links to customer admins. No customer-side consent needed — stays entirely within the AVI-SPL tenant.
After creating the registrations: Add both client IDs as Azure Static Web App application settings (see Config & Environment Setup below). Do not commit real client IDs into
config.json — that file is blocked from public access and kept as a local reference only.
⚙️ Environment Setup (Azure SWA Application Settings)
Config is served via /api/clientconfig and never stored in publicly accessible files. All values are set as Azure Static Web App application settings (Azure Portal → Static Web App → Configuration).
| Setting Name | Value | Notes |
|---|---|---|
SPOTTER_CLIENT_ID | Client ID of the multi-tenant app reg | Used by end users to sign in |
ADMIN_CLIENT_ID | Client ID of the single-tenant admin app reg | Used by AVI-SPL admin portal only |
AVISPL_TENANT_ID | 6736da89-25a5-4c99-a404-4ce9ddfb6b3e | AVI-SPL tenant GUID — already known |
AZURE_STORAGE_CONNECTION_STRING | Storage account connection string | For tenant + app config blob storage |
APP_NAME | InnerCircle Workplace Suite | Optional — defaults to this value |
SUPPORT_EMAIL | innercircle@avi-spl.com | Optional — defaults to this value |
SHARED_MAILBOX | e.g. innercircle@avi-spl.com | Optional — adds a shared mailbox "From" option when sending consent emails (requires Mail.Send permission on that mailbox) |
🗄️ Blob Storage Configuration
The Azure Functions backend reads and writes tenant config from Azure Blob Storage.
1. Create a storage account in the same Azure subscription as the Static Web App.
2. Create a container named
3. Copy the connection string from Azure Portal → Storage Account → Access keys.
4. Add to Static Web App: In Azure Portal → Static Web App → Configuration → Application settings:
Name:
Value: [the connection string]
2. Create a container named
innercircle-config (private access).3. Copy the connection string from Azure Portal → Storage Account → Access keys.
4. Add to Static Web App: In Azure Portal → Static Web App → Configuration → Application settings:
Name:
AZURE_STORAGE_CONNECTION_STRINGValue: [the connection string]
The API functions will automatically create
tenants.json and appconfig.json blobs on first write. No manual blob creation needed.
🏢 Onboarding a New Customer Tenant
- Ask the customer for their tenant domain (e.g.
contoso.com) or tenant ID. - Go to the Tenants tab and use Add Tenant to look up and register them.
- Use the row's Send Email button to email the consent link directly to their Global Administrator (or use Copy URL / Settings → Admin Consent URL Generator to share it another way).
- The Global Administrator must open the consent link and click Accept.
- Set an expiry date if this is a trial or fixed-term engagement.
- The customer's users can now sign in at
/innercircle/with their Microsoft 365 accounts.
🔐 Admin Consent Process (Detail)
Because InnerCircle is a multi-tenant app, each customer's Global Admin must grant permission once before their users can sign in.
What the consent URL does: It takes the customer's Global Admin to a Microsoft page that lists the permissions InnerCircle is requesting. When they click Accept, those permissions are granted for their entire organisation and a service principal is created in their tenant.
The consent URL format is:
Sending it: The recommended way is the Send Email button on a tenant's row in the Tenants tab — it emails the Global Admin a branded message containing this link and a breakdown of the permissions being requested. Copy URL or the Settings → Admin Consent URL Generator are available if you'd rather share it manually.
After consent: The admin is redirected back to InnerCircle and a service principal is created in their tenant.
The consent URL format is:
https://login.microsoftonline.com/{customer-tenant-id}/adminconsent?client_id={innercircle-client-id}Sending it: The recommended way is the Send Email button on a tenant's row in the Tenants tab — it emails the Global Admin a branded message containing this link and a breakdown of the permissions being requested. Copy URL or the Settings → Admin Consent URL Generator are available if you'd rather share it manually.
After consent: The admin is redirected back to InnerCircle and a service principal is created in their tenant.
Important: Consent must be completed before a customer's users can sign in. If a user from an unconsented tenant tries to sign in, they will see a Microsoft error about admin approval being required.
🔧 Troubleshooting
Users see "Your organisation is not registered"
Their tenant ID is not in the allowlist. Add them via the Tenants tab. Also check their expiry date hasn't passed.
Users can't sign in — Microsoft error about admin approval
Admin consent has not been completed for that tenant. Generate the consent URL from Settings and ask their Global Admin to visit it.
Admin portal shows "Access Denied"
Only users in the AVI-SPL tenant (
6736da89…) can access this portal. Ensure you're signed in with an AVI-SPL account, not a personal or customer account.API calls returning 500 errors
Check that
AZURE_STORAGE_CONNECTION_STRING is set correctly in the Static Web App application settings and that the innercircle-config container exists.Tenant lookup returns "not found"
The Graph API
findTenantInformationByDomainName can only look up tenants that have federated their domain with Microsoft. Try entering the tenant ID (GUID) directly instead of the domain.No desks/workspaces appearing for customers
Microsoft Places must be configured in the customer's tenant. This is an IT admin task for the customer — InnerCircle cannot configure Places on their behalf.
App Settings
Runtime configuration for InnerCircle Workplace Suite.
App Name
Displayed in the app header and sign-in screen.
Support Email
Shown to users who need help.
Environment
Shows a "Dev"/"Staging" badge in the InnerCircle app header. Hidden in Production.
Maintenance Mode
Blocks all users from signing in.
Maintenance Banner
Shows a yellow banner to all signed-in users. Set message below.
🔐 Admin Consent URL Generator
Generate the admin consent URL to send to a new customer's IT admin. They must visit this link and click Accept to grant the app permissions in their tenant.