> ## Documentation Index > Fetch the complete documentation index at: https://docs.threataware.com/llms.txt > Use this file to discover all available pages before exploring further. # Set up your tenant > From first sign-in to data you can trust: the setup checklist for new ThreatAware tenants Work through these steps in order. Most tenants have useful, estate-wide data within a day. Your ThreatAware onboarding team will usually guide you through this on two to four calls in the first two weeks. > [!NOTE] > > **No self-service sign-up**, with authority provisioned by the ThreatAware team. If you don't have a tenant yet, get in touch through the [ThreatAware website](https://threataware.com) or your security partner. ## Before you start You'll receive these from your ThreatAware account team: * **Your Cloud ID**: the subdomain you sign in at, for example `https://acme.threataware.com` * **Initial credentials**: usually a Super Admin account for an internal IT contact * **A welcome pack** with your onboarding session dates You'll also need a **Microsoft Global Admin** available for a few minutes (step 2), and, if you use on-prem tools such as Active Directory or SCCM, a **Windows server** inside your network for the PowerShell Relay (step 4). ## 1. Sign in **1. Browse to your Cloud ID** `https://.threataware.com` **2. Sign in** Use the credentials from your welcome email. The **SSO** button only works once single sign-on is set up (step 6). **3. Look around** New tenants land on Device Explorer. A short in-product tour runs on your first visit; on pages that have one, such as Devices, restart it any time from your user menu → **Help for this page**. ## 2. Connect Microsoft Connect these three first. They share one OAuth consent, need no firewall changes, and together give you cloud-device discovery, identity, MDM compliance and EDR data. **1. Microsoft Entra ID (about 5 minutes)** [Settings → Integrations](https://docs.threataware.com/settings/integrations.md) → search **Azure AD** → **Connect** → approve consent as a Global Admin. **2. Microsoft Intune (about 5 minutes)** Same flow, and it reuses the consent you just gave. **3. Microsoft Defender ATP (about 5 minutes)** Same flow. Adds EDR Vitals and vulnerability data. > [!WARNING] > > A Global Admin is only needed to grant the initial consent. After that, ThreatAware uses read-only permissions. ## 3. Connect your EDR If your primary EDR isn't Defender, connect it now: CrowdStrike, SentinelOne, Cortex XDR or another from the [catalogue](https://docs.threataware.com/connection-guides/index.md). EDR coverage drives most of what you'll do in [Vitals](https://docs.threataware.com/security-monitoring.md). Each tool has a step-by-step [connection guide](https://docs.threataware.com/connection-guides/index.md). ## 4. Reach on-prem tools (if you have them) On-prem Active Directory, SCCM and other tools without a cloud API connect through the [PowerShell Relay](https://docs.threataware.com/powershell-relay.md): a small script on a Windows server in your network that talks to ThreatAware over **outbound HTTPS only**. There are no inbound firewall rules, DMZ or port forwarding. Allow about 15 minutes for the first relay. ## 5. Check your data Each integration's first sync takes 15 to 60 minutes, depending on estate size. While you wait, other teams can connect further tools; with the four or five above you'll typically see around 80% of your estate. Once syncs complete: * **[Device Explorer](https://docs.threataware.com/device-explorer.md)** shows devices in the regions you expect, and each tool's last sync time across the top. * **[Devices](https://docs.threataware.com/device-management.md)** shows one row per physical device, however many tools report it. * **[X-Ray](https://docs.threataware.com/x-ray.md)**: open a device you know, click a tool's card in its Vitals and choose **View in X-Ray** to see exactly what that tool reported. ## 6. Set up single sign-on (optional) Set up SSO yourself for **Azure AD**, **Okta** or **CyberArk**: 1. Go to **Settings → User Management → SSO** and choose your identity provider. 2. Pick a setup mode. Azure AD offers **Automatic** (needs a Global Admin) or **Manual** SAML. 3. Choose provisioning: **None** (you add users yourself), **JIT** (created on first sign-in) or **SCIM** (your identity provider manages them; Azure AD and Okta). None is only offered with Azure AD automatic setup. 4. Set the **Default user role**, and turn on **Enforce SSO** if everyone should sign in through your identity provider. See [Access Control → SSO](https://docs.threataware.com/sso.md) for the full walkthrough and the SCIM setup. > **Still on ThreatAware 3.2?** > > On 3.2 only Entra ID is self-service: go to **Settings → Single Sign-On**, click **Enable Single Sign-On**, authorise as a Global Admin, wait 30 seconds, then click **Enable** in stage 2. Okta and other SAML / OIDC providers are set up by ThreatAware, so contact your account team. > [!NOTE] > > **SSO matches users on the `mail` attribute, not UPN.** Make sure `mail` is populated for your users first, or sign-ins fail with "user not found". ## 7. Define your tags Tags decide which controls apply to which devices, what Actions target and who can see what, so set them up early. 1. Review the defaults in [Settings → Tags](https://docs.threataware.com/settings/tags.md). 2. Build a small taxonomy of four to six tags, for example `End-User`, `Server`, `VM`, `Mac`, plus regions or business units. 3. Write a [Logic Engine](https://docs.threataware.com/logic-engine.md) rule for each. 4. Check [Coverage Explorer](https://docs.threataware.com/coverage-explorer.md) to make sure no device falls into zero tags. If you have several instances of the same tool, such as two Entra ID directories, turn on [Multi-Tenancy](https://docs.threataware.com/multi-tenancy.md) for that integration. ## You're set up when * [ ] At least four integrations show **Connected** with recent syncs * [ ] The Dashboard device count is within about 10% of what you expect * [ ] Tag rules apply correctly in Coverage Explorer * [ ] At least one Vital shows a healthy/unhealthy split you'd expect * [ ] A few known devices show data from several tools in X-Ray If something looks wrong, see [Troubleshooting](https://docs.threataware.com/reference/troubleshooting.md). ## Next steps > **[Configure Vitals](https://docs.threataware.com/vitals-configuration.md)** > > Decide which controls each tag of device must have. > **[Build your first Action](https://docs.threataware.com/automation.md)** > > Start with an email Action, then add tickets or webhooks. > **[Save a view and schedule a report](https://docs.threataware.com/scheduled-reports.md)** > > Send the right list to the right people automatically. > **[Your first month](https://docs.threataware.com/your-first-month.md)** > > A week-by-week plan for your first month. ## Common questions > **How long until I see useful data?** > > One integration's data appears within the first hour. An estate-wide view usually takes 24 to 48 hours, once three to five integrations are connected and matching has run a cycle or two. > **Do I need to install anything?** > > No endpoint agents. The only optional install is the [PowerShell Relay](https://docs.threataware.com/powershell-relay.md), for on-prem tools. > **What if my tool isn't in the catalogue?** > > Check the [connection guides](https://docs.threataware.com/connection-guides/index.md) for the current list, then send your account team the vendor name and its API documentation. > **Is ThreatAware read-only?** > > ThreatAware reads from your tools. Actions can write to other systems, such as opening a ServiceNow ticket or posting to Teams, but only through automations you set up. See [Trust & Security](https://docs.threataware.com/trust/security.md). > **Who do I contact for help?** > > Your account manager for escalations, **[support@threataware.com](mailto:support@threataware.com)** for technical questions, and your scheduled onboarding sessions for live help. This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.