Set up your tenant

Work through these steps in order. Most tenants have useful, estate-wide data within a day. Your ThreatAware onboarding team will usually guide you through this on two to four calls in the first two weeks.

​

Before you start

You’ll receive these from your ThreatAware account team:

• Your Cloud ID: the subdomain you sign in at, for example https://acme.threataware.com
• Initial credentials: usually a Super Admin account for an internal IT contact
• A welcome pack with your onboarding session dates

You’ll also need a Microsoft Global Admin available for a few minutes (step 2), and, if you use on-prem tools such as Active Directory or SCCM, a Windows server inside your network for the PowerShell Relay (step 4).

​

1. Sign in

​

2. Connect Microsoft

Connect these three first. They share one OAuth consent, need no firewall changes, and together give you cloud-device discovery, identity, MDM compliance and EDR data.

​

3. Connect your EDR

If your primary EDR isn’t Defender, connect it now: CrowdStrike, SentinelOne, Cortex XDR or another from the catalogue. EDR coverage drives most of what you’ll do in Vitals. Each tool has a step-by-step connection guide.

​

4. Reach on-prem tools (if you have them)

On-prem Active Directory, SCCM and other tools without a cloud API connect through the PowerShell Relay: a small script on a Windows server in your network that talks to ThreatAware over outbound HTTPS only. There are no inbound firewall rules, DMZ or port forwarding. Allow about 15 minutes for the first relay.

​

5. Check your data

Each integration’s first sync takes 15 to 60 minutes, depending on estate size. While you wait, other teams can connect further tools; with the four or five above you’ll typically see around 80% of your estate. Once syncs complete:

• Device Explorer shows devices in the regions you expect, and each tool’s last sync time across the top.
• Devices shows one row per physical device, however many tools report it.
• X-Ray: open a device you know, click a tool’s card in its Vitals and choose View in X-Ray to see exactly what that tool reported.

​

6. Set up single sign-on (optional)

Set up SSO yourself for Azure AD, Okta or CyberArk:

1. Go to Settings → User Management → SSO and choose your identity provider.
2. Pick a setup mode. Azure AD offers Automatic (needs a Global Admin) or Manual SAML.
3. Choose provisioning: None (you add users yourself), JIT (created on first sign-in) or SCIM (your identity provider manages them; Azure AD and Okta). None is only offered with Azure AD automatic setup.
4. Set the Default user role, and turn on Enforce SSO if everyone should sign in through your identity provider.

See Access Control → SSO for the full walkthrough and the SCIM setup.

Still on ThreatAware 3.2?

On 3.2 only Entra ID is self-service: go to Settings → Single Sign-On, click Enable Single Sign-On, authorise as a Global Admin, wait 30 seconds, then click Enable in stage 2. Okta and other SAML / OIDC providers are set up by ThreatAware, so contact your account team.

​

7. Define your tags

Tags decide which controls apply to which devices, what Actions target and who can see what, so set them up early.

1. Review the defaults in Settings → Tags.
2. Build a small taxonomy of four to six tags, for example End-User, Server, VM, Mac, plus regions or business units.
3. Write a Logic Engine rule for each.
4. Check Coverage Explorer to make sure no device falls into zero tags.

If you have several instances of the same tool, such as two Entra ID directories, turn on Multi-Tenancy for that integration.

​

You’re set up when

• At least four integrations show Connected with recent syncs
• The Dashboard device count is within about 10% of what you expect
• Tag rules apply correctly in Coverage Explorer
• At least one Vital shows a healthy/unhealthy split you’d expect
• A few known devices show data from several tools in X-Ray

If something looks wrong, see Troubleshooting.

​

Next steps

​

Common questions