Description
Set up and maintain a dedicated Microsoft 365 account to sign in to the Exclaimer Managed Service Provider (MSP) Connect Portal and manage billing and operational communication.
Before you begin, make sure you have the following in place. Both items are mandatory and neither can be substituted:
• A dedicated account in the format exclaimer@msp-domain.com
• Your Microsoft Entra Tenant ID (GUID format)
IMPORTANT! The exclaimer@msp-domain.com account must be a user account. It cannot be an alias, a shared mailbox, or a distribution group.
Account options
There are two ways to set up the exclaimer@msp-domain.com account, depending on whether you want to assign it a full Microsoft 365 license. Select the option that suits you:
To set up a standard Microsoft 365 account:
The account comes with a mailbox and can receive emails immediately, so no further configuration is required. This is the simplest and quickest option.
- Create a standard Microsoft 365 user account with the address exclaimer@msp-domain.com.
- Assign an M365 license to the account.
To set up a non-licensed Microsoft 365 account:
This option avoids the cost of an extra Microsoft 365 license, but the account has no mailbox of its own, so you must configure an alias before setup.
- Create a user account in your Entra ID tenant with the address exclaimer@msp-domain.com, without assigning an M365 license.
This works because Microsoft Entra ID Free is included at the tenant level with every Microsoft 365 subscription, so an unlicensed account carries no additional per-user cost.
- Configure an email alias for exclaimer@msp-domain.com that points to an active, monitored mailbox within your organization.
Information required at onboarding
Provide the following to Exclaimer before you can complete onboarding:
| Field | Format | Notes |
|---|---|---|
| Portal account email address | exclaimer@msp-domain.com | This must be a user account, not an alias or group |
| Microsoft Entra Tenant ID | GUID (aaaaaaaa-aaaa-aaaa-aaaa-aaaaaaaaaaaa) | This is from the Entra Admin Center or the Partner Center |
| Entra Security Group Object ID (optional) | GUID | This is only needed if you register a Security Group for team sign-in |
How to find your Entra Tenant ID
You can retrieve your Tenant ID from either the Microsoft Entra Admin Center or the Microsoft Partner Center. Select the option you have access to:
To find your Entra Tenant ID in the Microsoft Entra Admin Center:
- Sign in to the Microsoft Entra Admin Center.
- Select Microsoft Entra ID from the menu.
- Select Overview. Find the Tenant ID in the Basic information section.
To find your Entra Tenant ID in the Microsoft Partner Center:
- Sign in to the Partner Center dashboard.
- Select the Settings icon, then select Account settings.
- From the menu sidebar, select Tenants.
- Locate the Tenant ID in the Tenant Profile section.
Why is a dedicated account required
A dedicated account helps you access the portal, manage billing and operations, and complete Exclaimer’s identity verification requirements.
The Exclaimer MSP Connect Portal does not use a standalone username and password. Microsoft handles authentication entirely. When you sign in at msp.exclaimer.net, Microsoft verifies your identity and returns your organization's Entra Tenant ID.
At contract stage, you provide Exclaimer with your Entra Tenant ID, and Exclaimer stores it securely in its backend. On every subsequent login, Exclaimer checks the Tenant ID that Microsoft returns against the value on record. A match grants access to the Your Subscriptions page.
The exclaimer@msp-domain.com account acts as the authoritative account for your entire relationship with Exclaimer.
Use it for:
- Signing in to the MSP Connect Portal to create and manage subscriptions
- Receiving your API key upon account creation
- All billing communications, including your monthly consolidated invoice
- All back-office and operational correspondence from Exclaimer
As a single account covers all of these functions, it must be able to receive email.
A verified Microsoft identity tied to your organization's domain satisfies Exclaimer's KYC requirements. This also means that when you provision a new subscription for a customer, Exclaimer requires only minimal information at that point, since Exclaimer completed identity verification at the contract stage.
Security and permissions details
A standard member account with no admin roles assigned is sufficient. Exclaimer does not require elevated permissions.
When you sign in, the portal requests the following OAuth 2.0 / OpenID Connect scopes:
| Scope | Type | What it does |
|---|---|---|
| openid | Delegated | Confirms identity and issues an ID token |
| profile | Delegated | Reads display name and username |
| Delegated | Reads the account's email address | |
| User.Read | Delegated | Reads the signed-in user's own profile via Microsoft Graph |
| GroupMember.Read.All | Delegated | Checks whether the account is a member of the one registered Entra Security Group |
Using the User.Read delegated permission, the portal makes a single call to the Microsoft Graph organization endpoint:
With User.Read, this endpoint returns only three properties: id (the Entra Tenant ID, checked against Exclaimer's backend record), displayName, and verifiedDomains. All other properties on the organization object return null, so no tenant configuration, policies, users, groups, or directory data of any kind is accessible.
Microsoft's Graph API documentation for this endpoint explicitly lists User as a supported role, alongside every named admin role in the system. It is the lowest privilege level listed and the default for any member account with no roles assigned. This holds whether or not you register a Security Group for team sign-in: registering a group changes what the account consents to, not what role it holds.
You do not need to assign a named Entra ID role. Organizations commonly assume the following roles are necessary, but they are not required:
- Global Administrator
- Application Administrator
- Cloud Application Administrator
- Directory Readers
- Global Reader
The portal has no access to:
- Any other user's profile or directory data
- Mailboxes, calendars, files, or Teams data
- Tenant configuration, policies, or conditional access rules
- Any write operations of any kind