> ## Documentation Index
> Fetch the complete documentation index at: https://docs.threataware.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Onboarding

> From provisioning to first connected integration — what to do in your first day of Protect

## Before you log in

ThreatAware Protect is provisioned by your ThreatAware account team. You'll receive:

* **Your Cloud ID** — the unique subdomain you'll use to access Protect (e.g. `https://acme.threataware.com`)
* **Initial credentials** — typically a Super Admin account for an internal IT contact
* **A welcome packet** outlining onboarding sessions

<Info>
  **No self-service signup.** Protect is enterprise-only. If you reached this page without an account, get in touch via the [website](https://threataware.com) or your security partner.
</Info>

## First login

<Steps>
  <Step title="Browse to your Cloud ID">
    `https://<your-cloud-id>.threataware.com`
  </Step>

  <Step title="Sign in">
    Either:

    * Username + password from your welcome email
    * Single Sign-On (SSO) via the **SSO** button on the login screen (only works if SSO has been pre-configured — usually not on day one)
  </Step>

  <Step title="Land on Device Explorer or Dashboard">
    Default landing page is configurable in [Settings → Misc](/settings/misc). New tenants typically land on the dashboard.
  </Step>

  <Step title="Run the dashboard tour">
    A 9-step in-product tour appears on first visit. Two minutes; introduces every Dashboard panel. See [Tour](/tour).
  </Step>
</Steps>

## What ThreatAware connects to

Protect's mission is to connect to **every platform that knows about devices** in your environment. On day one, focus on the foundational connections:

<CardGroup cols={2}>
  <Card title="Identity" icon="users">
    * Microsoft Entra ID (Azure AD)
    * Okta
    * On-prem Active Directory
    * Google Workspace
  </Card>

  <Card title="EDR (Endpoint Detection and Response)" icon="shield-virus">
    * CrowdStrike Falcon
    * Microsoft Defender ATP
    * SentinelOne
    * Cortex XDR (Extended Detection and Response)
  </Card>

  <Card title="MDM (Mobile Device Management)" icon="mobile-screen">
    * Microsoft Intune
    * JAMF Pro
    * Workspace ONE
  </Card>

  <Card title="Network scanning" icon="radar">
    * Lansweeper
    * PDQ Inventory
  </Card>
</CardGroup>

Each connection has its own setup. The [Connection Guides](/connection-guides) tab has step-by-step instructions for every supported integration.

## Day-one priorities

The recommended order:

<Steps>
  <Step title="1. Microsoft Entra ID (5 min)">
    OAuth-based. Provides cloud-device discovery, Multi-Factor Authentication (MFA) tracking, conditional access state.

    [Settings → Integrations](/settings/integrations) → search "Azure AD" → Connect → Global Admin consent.
  </Step>

  <Step title="2. Microsoft Intune (5 min)">
    Same OAuth flow as Entra ID, shares credentials. Provides MDM compliance, software inventory, encryption state.
  </Step>

  <Step title="3. Microsoft Defender ATP (5 min)">
    Same OAuth flow. Provides EDR Vitals + vulnerability data.
  </Step>

  <Step title="4. Your primary EDR (5-10 min)">
    If you use CrowdStrike, SentinelOne, or Cortex XDR rather than Defender, connect it now. Provides EDR coverage data — critical for Vitals.
  </Step>

  <Step title="5. On-prem Active Directory (15 min)">
    Requires the [PowerShell Relay](/powershell-relay). Provides on-prem device discovery and user information.
  </Step>

  <Step title="6. Wait for initial syncs">
    Each integration's first sync takes 15-60 minutes depending on estate size.
  </Step>

  <Step title="7. Validate via X-Ray">
    Open any known device → [X-Ray](/x-ray) → confirm the expected sources are reporting.
  </Step>
</Steps>

After these five integrations, you have \~80% of typical estate visibility. Add more in week 2.

## Microsoft integrations need Global Admin (once)

<Warning>
  Microsoft Entra ID, Intune, and Defender all require a Global Admin to authorise the initial application consent. After that, Protect only requests read-only permissions for ongoing operation.
</Warning>

The Microsoft integrations share OAuth — once you've authorised one, the others connect with one click.

## On-prem tools need the PowerShell Relay

For Active Directory, System Center Configuration Manager (SCCM), or any on-prem tool without a cloud API, you'll deploy the [PowerShell Relay](/powershell-relay) — a small PowerShell script that runs on a Windows server inside your network and relays queries to Protect over outbound HTTPS only.

No inbound firewall changes. No DMZ. No port forwarding.

## Single Sign-On setup

For organisations that prefer SSO over passwords:

<Tabs>
  <Tab title="Entra ID (self-service)">
    1. **\[Settings] → Single Sign-On** in Protect
    2. Click **Enable Single Sign-On**
    3. Authorize the setup application as Global Admin
    4. Wait 30 seconds (critical — for the setup app to propagate)
    5. Click **Enable** in stage 2 — Protect auto-creates the Enterprise Application
    6. Existing users with matching Entra ID `mail` attributes get SSO automatically

    See [Access Control → SSO](/access-control#sso) for the full walk-through.
  </Tab>

  <Tab title="Okta">
    Okta SSO requires manual setup by Protect engineering. Contact your account team with:

    * Your Okta tenant URL
    * Your preferred app name
    * The user-matching attribute

    Lead time: 1-2 business days.
  </Tab>

  <Tab title="Other SAML / OIDC">
    Generic Security Assertion Markup Language (SAML) 2.0 / OpenID Connect (OIDC) providers (OneLogin, Google Workspace, Ping, custom) are supported via manual configuration. Contact your account team.
  </Tab>
</Tabs>

<Info>
  **SSO matches on the `mail` attribute, not User Principal Name (UPN).** Confirm your users have `mail` populated before enabling SSO — otherwise sign-ins will fail with "user not found".
</Info>

## Multi-tenancy

If you have multiple instances of the same tool (multiple Entra ID directories, separate CrowdStrike instances, etc.), enable [Multi-Tenancy](/multi-tenancy) on the integration once the first tenant is connected.

For MSPs / MSSPs with truly separate customer environments, strict tenant isolation is available (contact support).

## Configuring tags

After your first integrations are syncing, decide on a [tag strategy](/tags-and-logic-engine):

* Walk through [Settings → Tags](/settings/tags) — review the defaults
* Build a 4-6 tag taxonomy that captures your estate (`End-User`, `Server`, `VM`, `Mac`, plus regional or business-unit tags)
* Define Logic Engine rules for each
* Check the Coverage Explorer to confirm no devices fall into zero tags

Tags drive Vitals scope, Action targeting, and access control — get them right early.

## Validating onboarding is complete

You're ready to move to the [Getting Started](/getting-started) phase when:

* ✓ At least 4 integrations show CONNECTED with recent syncs
* ✓ Device Explorer globe shows devices in expected regions
* ✓ Device count on the Dashboard looks plausible (within 10% of your IT estate)
* ✓ Tag rules apply correctly (verify via Coverage Explorer)
* ✓ At least one Vital column shows healthy/unhealthy split as expected
* ✓ Sample devices in [X-Ray](/x-ray) show data from multiple sources

If any of these look wrong, the [Troubleshooting](/reference/troubleshooting) page covers common causes.

## What happens next

After onboarding:

1. **[Getting Started](/getting-started)** — your first 24 hours of operation
2. Configure [Vitals](/security-monitoring) for each connected control
3. Build your first [saved view](/query-language#saved-views) and [Scheduled Report](/scheduled-reports)
4. Wire your first [Action](/automation)
5. Explore [Reporting](/reporting) for custom dashboards

## Support during onboarding

| Channel                                                 | Use for                                |
| ------------------------------------------------------- | -------------------------------------- |
| Your **account manager**                                | High-level questions, escalations      |
| **[help@threataware.com](mailto:help@threataware.com)** | Technical questions, troubleshooting   |
| **Onboarding sessions**                                 | Live calls scheduled during onboarding |
| **In-product chat** (where available)                   | Quick questions while clicking around  |
| **[Status page](https://status.threataware.com)**       | Platform health                        |

The ThreatAware team will be in close contact during initial onboarding — typically 2-4 calls in the first two weeks.

## See also

<CardGroup cols={3}>
  <Card title="Getting Started" icon="play" href="/getting-started">
    Your first 24 hours of operation
  </Card>

  <Card title="Platform Overview" icon="compass" href="/platform-overview">
    Architecture and concepts
  </Card>

  <Card title="Connection Guides" icon="plug" href="/connection-guides">
    Step-by-step per integration
  </Card>
</CardGroup>