# Tenant attach

> Source: Courseiva IT Certification Glossary — https://courseiva.com/glossary/tenant-attach

## Quick definition

Tenant attach allows IT administrators to manage both cloud-based and on-premises devices from a single console in the Microsoft Endpoint Manager admin center. It connects your existing Configuration Manager setup with Intune, so you can apply cloud policies, run scripts, and view device inventory without moving all devices to the cloud. This makes hybrid management simpler and more consistent.

## Simple meaning

Think of tenant attach as a bridge between your company’s on-premises server room and a cloud command center. Suppose your IT team has been managing hundreds of office computers using Configuration Manager, a tool that runs on local servers inside your building. That works well, but now the company also has many employees working remotely with laptops that connect through the internet. Managing those remote devices with the same on-premises tool is clunky and slow. Tenant attach connects your on-premises Configuration Manager to Microsoft Intune, a cloud-based management service. After you set up tenant attach, your IT administrators can open a single web portal-the Microsoft Endpoint Manager admin center-and see all devices, whether they are in the office or at home. They can push security updates, run scripts, check compliance, and even wipe a lost laptop, all from that one dashboard. The key is that the devices themselves still get their main policies from your local Configuration Manager servers; tenant attach just adds cloud capabilities on top. It does not require moving every device to be fully cloud-managed. Instead, it gives you the best of both worlds: the control of on-premises management and the flexibility of cloud tools. For a small business with ten computers, tenant attach might be overkill. But for an organization with thousands of devices spread across many locations, it saves time, reduces complexity, and keeps security policies consistent everywhere. In simple terms, tenant attach is like adding a remote control to your existing home security system-you can still use the keypad at the door, but now you can also arm the system from your phone.

## Technical definition

Tenant attach is a Microsoft Endpoint Manager feature that establishes a secure, authenticated connection between a Configuration Manager hierarchy and a Microsoft Entra ID (formerly Azure Active Directory) tenant, enabling cloud-powered device management. The connection uses a dedicated app registration in Entra ID, which authenticates via OAuth 2.0 client credentials grant flow. Once authorized, the Configuration Manager site server synchronizes device data (including hardware inventory, compliance status, and client details) to the Intune service using the Microsoft Graph API. This synchronization happens at a configurable interval, typically every 15–60 minutes. The tenant attach feature does not migrate devices to Intune or replace Configuration Manager policies; instead, it extends the management plane. Administrators can perform actions such as running CMPivot queries, deploying PowerShell scripts, and executing real-time device actions (e.g., restart, remote control) from the Microsoft Endpoint Manager admin center. These actions are relayed from the cloud back to the on-premises Configuration Manager site, which then communicates with the targeted clients via the existing client notification channel. The underlying protocols include HTTPS for all cloud communication, the Configuration Manager client notification channel (based on TCP and the site server’s messaging infrastructure), and Microsoft Graph for data exchange. Tenant attach requires Configuration Manager version 2006 or later, a supported SQL Server version, and an Entra ID tenant with appropriate administrative consent. The Configuration Manager site server must have internet access and the cloud management gateway (CMG) is recommended but not strictly required. For high availability, multiple site systems can be configured. Security considerations include rotating the client secret for the app registration, limiting delegated permissions to the minimum required (e.g., Device.Read.All, DeviceManagementManagedDevices.ReadWrite.All), and using role-based access control (RBAC) in both Configuration Manager and Intune. In the exam context, tenant attach is often contrasted with co-management, where both Configuration Manager and Intune actively manage policies. Tenant attach is a lighter integration that keeps Configuration Manager as the primary policy authority while adding cloud-based visibility and action capabilities. It is a prerequisite for several newer Microsoft endpoint analytics features and for deploying Windows Autopilot for existing devices.

## Real-life example

Imagine you run a chain of coffee shops with five locations. Each shop has an espresso machine that is programmed to pull shots at specific temperatures and pressures-a very precise, local setup. The espresso machines are like Configuration Manager devices, configured perfectly for each shop’s beans and water. Now you want to add a mobile app that lets you, the regional manager, check the machine’s daily shot count and send a cleanup alert from your phone. You do not want to replace the local programming because the baristas need those exact settings. Tenant attach is like installing a small internet-connected sensor on each espresso machine. The sensor sends shot counts, temperature logs, and error codes to your phone app. You can also send a “run cleaning cycle” command from the app, which the sensor forwards to the machine’s existing control board. The machine still follows its local program for pulling espresso, but you now have remote visibility and can trigger maintenance tasks. In IT terms, the sensor is the tenant attach connection, the phone app is the Endpoint Manager admin center, and the espresso machine’s control board is the Configuration Manager client. The key point is that the sensor does not take over the machine-it just adds a cloud channel for monitoring and occasional commands. This is exactly what tenant attach does for IT devices: it adds a cloud channel for visibility and actions without disrupting the on-premises management that already works well. If you tried to replace every espresso machine with a fully cloud-controlled model, you would lose the local precision that makes each shop’s coffee taste right. Similarly, if you forced all devices to be fully Intune-managed, you might lose specialized on-premises configurations. Tenant attach gives you the best of both worlds.

## Why it matters

In practical IT, most organizations have a mix of on-premises and cloud infrastructure. Moving everything to the cloud is a multi-year project, and some devices (like those in air-gapped environments or with legacy software) may never be fully cloud-managed. Tenant attach matters because it enables unified management without forcing a migration. IT teams can keep their existing Configuration Manager investment while gradually adopting cloud capabilities. This reduces operational friction-administrators do not need to switch between two consoles to manage different device groups. From a security perspective, tenant attach improves the visibility of on-premises devices. If a device falls out of compliance, the cloud console can trigger a remediation script immediately. Without tenant attach, that same action might require someone to physically access the device or rely on a slower on-premises reporting cycle. Tenant attach also unlocks modern features like endpoint analytics, which uses data from the cloud to measure boot times, app crashes, and user experience. These analytics help IT proactively fix performance issues before users complain. For businesses that need to support remote work, tenant attach is especially valuable because it gives administrators a cloud-based method to troubleshoot devices that are not on the corporate network. Finally, tenant attach is a stepping stone toward co-management. Once IT teams become comfortable with cloud actions, they can gradually shift policy workloads to Intune-a process that Microsoft calls “slider” management. Understanding tenant attach is essential for any IT professional working with Microsoft endpoint management, especially those preparing for exams like MD-102 (Microsoft 365 Endpoint Administrator) or the legacy MS-101, where hybrid scenarios are heavily tested.

## Why it matters in exams

Tenant attach is a tested topic in several Microsoft certification exams, particularly the MD-102 (Microsoft 365 Endpoint Administrator) and the legacy MS-101 (Microsoft 365 Mobility and Security). In the MD-102 exam, the objectives include “Manage endpoints with Microsoft Endpoint Manager,” which covers hybrid scenarios, co-management, and tenant attach. Questions often ask candidates to differentiate between tenant attach and co-management, or to identify the prerequisites for implementing tenant attach. For example, a question might list four scenarios and ask which one requires tenant attach versus full Intune enrollment. Another common question pattern presents a failure to see devices in the cloud console and asks for the likely cause-such as an expired client secret, missing Microsoft Graph permissions, or an outdated Configuration Manager version. In the MS-101 exam, tenant attach appears under “Plan and implement a Microsoft 365 endpoint management strategy.” Questions may require ordering the steps to configure tenant attach: first create the app registration in Entra ID, then configure the connection in Configuration Manager, then synchronize devices. Candidates must also know that tenant attach does not replace on-premises policies but provides cloud actions and visibility. The exam might include a scenario where an organization has multiple Configuration Manager hierarchies and must choose which one to connect. The correct answer is that each hierarchy connects to one tenant, but a tenant can be connected to multiple hierarchies. Trap questions often confuse tenant attach with co-management, so knowing the difference is critical. Co-management requires both Configuration Manager and Intune to have policy authority split via workloads, whereas tenant attach keeps all policy authority with Configuration Manager. There may also be questions about licensing-tenant attach requires Intune licenses for all managed users, even if devices remain primarily managed by Configuration Manager. Expect straightforward multiple-choice questions and case-study-style drag-and-drop ordering. The best preparation is to have hands-on experience setting up tenant attach in a lab, as familiarity with the configuration steps and troubleshooting console errors directly maps to exam scenarios.

## How it appears in exam questions

Exam questions about tenant attach typically fall into three categories: definitional, scenario-based, and troubleshooting. Definitional questions ask “What is the primary benefit of tenant attach?” or “Which of the following is a prerequisite?” The answer choices often include “Co-management slider,” “Full Intune enrollment,” “Configuration Manager version 2006 or later,” and “Cloud management gateway (required).” The correct answers are usually the ones that emphasize enhanced cloud visibility and actions without full migration. Scenario-based questions present a company with 500 on-premises devices managed by Configuration Manager and 200 remote devices managed by Intune. The IT director wants a single pane of glass to see compliance status for all devices. The question asks which feature should be implemented. The answer is tenant attach, because it connects the two management systems without requiring devices to change their primary management mode. Another scenario might describe a company that already uses co-management but now wants to run CMPivot queries from the cloud console. The question asks whether tenant attach is needed or if co-management already supports this. The answer is that tenant attach is required because CMPivot queries from the cloud console depend on the tenant attach connection. Troubleshooting questions present a symptom-for example, “Devices are not appearing in the Endpoint Manager admin center after configuring tenant attach.” The candidate must identify the root cause from options like an incorrect app registration, missing API permissions, a firewall blocking the site server’s outbound traffic, or the synchronization interval not yet elapsed. Some questions combine tenant attach with endpoint analytics: “Which component must be configured to enable endpoint analytics for on-premises devices?” The answer is tenant attach. Finally, expect a few drag-and-drop questions that ask you to put the setup steps in order: 1. Create an app registration in Microsoft Entra ID. 2. Grant admin consent for API permissions. 3. In Configuration Manager console, go to Administration > Cloud Services > Azure Services and add the tenant. 4. Configure the synchronization settings. 5. Verify devices appear in the cloud console. Being able to recall this sequence from memory is a strong advantage.

## Example scenario

Contoso Ltd. is a medium-sized company with 1,200 desktop computers in their main office and 300 laptops used by sales representatives who travel frequently. Their IT team has used Configuration Manager for ten years and is comfortable with its on-premises tools. However, the sales reps’ laptops are difficult to manage when they are on the road-the IT team cannot easily check if a laptop has the latest antivirus definitions or remotely restart a frozen device. The IT director decides to implement tenant attach. First, the team creates a new app registration in Microsoft Entra ID called “Contoso Tenant Attach” and gives it the Device.Read.All and DeviceManagementManagedDevices.ReadWrite.All API permissions. They note the client secret and store it securely. Next, in the Configuration Manager console, they navigate to Administration > Cloud Services > Azure Services and select “Add Azure Service.” They choose the “Cloud Management” connector type, enter the tenant ID and client ID from the app registration, and paste the client secret. They configure the synchronization to occur every 30 minutes. After a few minutes, the team opens the Microsoft Endpoint Manager admin center and sees all 1,500 devices listed. They can now view hardware inventory, run a CMPivot query to find which laptops have a specific outdated driver, and even restart a remote laptop that a sales rep reports as frozen-all from the cloud console. The on-premises desktops continue to receive their software updates and security policies from Configuration Manager as before. The sales reps’ laptops also remain fully managed by Configuration Manager when they are on the corporate network, but the IT team now has cloud-based visibility and action capabilities for those devices when they are offsite. This scenario is a common exam question template: identify the feature that provides cloud visibility for on-premises devices without changing the primary management tool. The correct answer is tenant attach.

## Common mistakes

- **Mistake:** Thinking tenant attach requires all devices to be enrolled in Intune.
  - Why it is wrong: Tenant attach does not change the device’s management mode; Configuration Manager remains the primary policy authority. Devices are not enrolled in Intune individually.
  - Fix: Understand that tenant attach is a connection between the Configuration Manager site and the Intune service, not between each device and Intune.
- **Mistake:** Believing tenant attach and co-management are the same thing.
  - Why it is wrong: Co-management splits policy authority between Configuration Manager and Intune via workload sliders. Tenant attach keeps all policy authority with Configuration Manager and only adds cloud actions and visibility.
  - Fix: Memorize the distinction: tenant attach = visibility/actions from cloud, co-management = shared management between cloud and on-premises.
- **Mistake:** Assuming the Cloud Management Gateway (CMG) is mandatory for tenant attach.
  - Why it is wrong: CMG is recommended for internet-based client management, but tenant attach connections are between the site server and Intune, not directly between clients and the cloud. CMG is not strictly required.
  - Fix: Learn the prerequisites: Configuration Manager 2006+, Entra ID tenant, app registration, and internet access for the site server. CMG is optional.
- **Mistake:** Forgetting to grant admin consent for API permissions in Entra ID.
  - Why it is wrong: Without admin consent, the app registration cannot access Microsoft Graph to read device data or trigger actions. The connection will fail silently or show errors.
  - Fix: Always verify that admin consent has been granted for the required permissions after creating the app registration.
- **Mistake:** Thinking tenant attach provides full Intune policy management for on-premises devices.
  - Why it is wrong: Tenant attach does not allow Intune policies (like compliance policies or configuration profiles) to be applied to on-premises Configuration Manager clients. Those devices still receive policies from Configuration Manager.
  - Fix: Remember that tenant attach is for visibility and cloud actions only-not for policy delegation.

## Exam trap

{"trap":"A question states that an organization wants to manage all devices from a single cloud console and asks whether to use tenant attach or co-management. Many learners choose co-management because it offers a more complete cloud management experience.","why_learners_choose_it":"Learners associate co-management with the phrase ‘single pane of glass’ and assume that the more feature-rich option must be the answer. They overlook the detail that the organization does not want to change its current management structure.","how_to_avoid_it":"Read the scenario carefully. If it says ‘keep using Configuration Manager but add cloud visibility and actions,’ the answer is tenant attach. If it says ‘split management workloads between Configuration Manager and Intune,’ the answer is co-management. Watch for keywords like ‘without changing primary management’ or ‘keep on-premises policies.’"}

## Commonly confused with

- **Tenant attach vs Co-management:** Co-management divides management authority between Configuration Manager and Intune using workload sliders. Tenant attach keeps all authority with Configuration Manager while adding cloud connectivity for visibility and actions. Co-management requires devices to be enrolled in both systems; tenant attach does not enroll devices in Intune. (Example: Co-management is like sharing driving duties on a road trip-you take turns steering. Tenant attach is like adding a GPS tracker to the car-you can see where it is and send a ‘turn off headlights’ command, but you are not taking over the wheel.)
- **Tenant attach vs Cloud Management Gateway (CMG):** CMG is an Azure service that allows internet-based clients to communicate with Configuration Manager site systems. Tenant attach is a separate feature that connects the site server to Intune for cloud management actions. CMG handles client-to-site traffic; tenant attach handles site-to-cloud traffic. (Example: CMG is like a secure tunnel from a remote campsite to your home base. Tenant attach is like a radio that lets your home base talk to a satellite command center.)
- **Tenant attach vs Intune standalone:** Intune standalone is a cloud-only device management service with no on-premises dependency. Tenant attach requires an on-premises Configuration Manager hierarchy and does not replace Intune standalone. Devices managed by Intune standalone are enrolled directly in the cloud; tenant attach devices remain under Configuration Manager. (Example: Intune standalone is like renting a fully furnished apartment-everything is in the cloud. Tenant attach is like adding a smart home hub to your existing house-you still have your own furniture, but now you can control lights from your phone.)

## Step-by-step breakdown

1. **Create an App Registration in Microsoft Entra ID** — This step registers a service principal that Configuration Manager will use to authenticate with Microsoft Graph. You must assign API permissions (Device.Read.All, DeviceManagementManagedDevices.ReadWrite.All) and generate a client secret. This app is the secure identity for the connection.
2. **Grant Admin Consent for API Permissions** — After creating the app registration, a Global Administrator must grant tenant-wide admin consent. Without this, the app cannot access your organization’s device data. This step is easy to forget and is a common exam trap.
3. **Configure the Azure Service in Configuration Manager** — In the Configuration Manager console, go to Administration > Cloud Services > Azure Services and select ‘Add Azure Service.’ Choose the ‘Cloud Management’ type and provide the tenant ID, client ID, and client secret from the app registration. This establishes the trust relationship.
4. **Configure Synchronization Settings** — After the Azure service is added, you can set the sync interval (default 60 minutes, minimum 15 minutes). This controls how often device data is uploaded from Configuration Manager to Intune via Microsoft Graph. Shorter intervals provide more current data but increase network load.
5. **Verify Devices in Microsoft Endpoint Manager** — Once synchronization completes, open the Microsoft Endpoint Manager admin center and navigate to Devices > All devices. You should see devices from your Configuration Manager hierarchy listed, often with a ‘CMG’ or ‘ConfigMgr’ source indicator. This confirms the tenant attach connection is working.
6. **Test Cloud Actions** — Select a device from the cloud console and try a remote action like ‘Restart’ or ‘Run script.’ The action is sent via Microsoft Graph to the Configuration Manager site, which forwards it to the client. Successful execution proves the bidirectional communication is functional.

## Practical mini-lesson

Tenant attach is a feature that many IT professionals implement to bridge two management worlds: on-premises Configuration Manager and cloud Intune. In practice, the setup is straightforward but requires careful permission management. First, you need a dedicated app registration in Microsoft Entra ID. This app should have a descriptive name like ‘Contoso CM Tenant Attach’ to make it easy to identify in audit logs. The API permissions granted to this app should be the minimum required-Device.Read.All and DeviceManagementManagedDevices.ReadWrite.All are usually sufficient. Do not grant Directory.Read.All because tenant attach does not need to read user objects. The client secret you generate should have a long expiration (like 24 months) and be stored in a secure vault, because you will need it if you ever have to reconfigure the connection. In the Configuration Manager console, the ‘Add Azure Service’ wizard handles most of the configuration. You must use the Cloud Management type-do not confuse it with the ‘Azure Active Directory’ type which is used for user authentication. Once the service is added, devices will start syncing. A common practical issue is that the sync does not happen immediately; the first sync can take up to two hours depending on the number of devices and the network speed. During this time, administrators may worry that the setup failed. Patience is key. Another practical issue is expired client secrets. The app registration client secret has a set lifespan, and when it expires, the connection breaks silently. Set up a monitoring alert or calendar reminder to rotate the secret before it expires. When troubleshooting, always check the CloudAttach.log file on the site server, which logs synchronization details and error messages. If devices appear in the cloud console but remote actions fail, verify that the Configuration Manager client notification channel is healthy and that clients are online. Tenant attach is not a set-and-forget feature; it requires periodic checkups on permissions, secret rotation, and sync health. For professionals preparing for exams, the most important practical lesson is that tenant attach is a one-way street for policies-policies flow from Configuration Manager to clients, not from Intune to clients. Only cloud actions and visibility flow in the opposite direction. Misunderstanding this leads to configuration errors and exam mistakes. Spend time in a lab testing remote actions like CMPivot and script execution, as these are the most valued capabilities of tenant attach in real-world troubleshooting.

## Memory tip

Think ‘Attach for Vision and Action’-tenant attach gives you cloud vision (visibility) and cloud action, but policies stay put.

## FAQ

**Do I need Intune licenses for tenant attach?**

Yes, each user who is managed with tenant attach requires an Intune license. The license is needed because tenant attach uses Intune’s cloud services, even though devices remain primarily managed by Configuration Manager.

**Can I use tenant attach with multiple Configuration Manager hierarchies?**

Yes, one Microsoft Entra ID tenant can be connected to multiple Configuration Manager hierarchies. However, each Configuration Manager hierarchy can only connect to one tenant. This is a common exam point.

**Does tenant attach work without a Cloud Management Gateway?**

Yes, CMG is not required for tenant attach. The connection is between the site server and the cloud, not directly between clients and the cloud. However, if you also want to manage internet-based clients, CMG is recommended.

**What Configuration Manager version is required for tenant attach?**

Configuration Manager version 2006 or later is required. Earlier versions do not support the tenant attach feature. Always check the current Microsoft documentation for the minimum version as it may change.

**Can I apply Intune compliance policies to devices through tenant attach?**

No, tenant attach does not allow Intune compliance policies to be applied to on-premises Configuration Manager clients. Those clients still use Configuration Manager compliance settings. To apply Intune policies, you need co-management or full Intune enrollment.

**What should I do if devices do not appear in the cloud console after setting up tenant attach?**

First, verify that the app registration has admin consent granted. Then check the CloudAttach.log on the site server for errors. Ensure the site server can reach https://graph.microsoft.com and that the client secret has not expired. Also, wait at least one sync cycle (default 60 minutes) before assuming failure.

**Is tenant attach the same as hybrid Azure AD join?**

No, they are different. Hybrid Azure AD join registers on-premises devices in Entra ID. Tenant attach connects Configuration Manager to Intune. They can coexist but serve different purposes. Hybrid Azure AD join is about identity; tenant attach is about management.

## Summary

Tenant attach is a Microsoft Endpoint Manager feature that creates a secure bridge between an on-premises Configuration Manager hierarchy and the Microsoft Intune cloud service. It enables IT administrators to view device inventory, run CMPivot queries, execute PowerShell scripts, and perform remote device actions from the Microsoft Endpoint Manager admin center, all without changing the primary management authority of Configuration Manager. This feature is particularly valuable for organizations that have a large investment in on-premises management but need cloud-based flexibility for remote device support, modern analytics, and a unified console experience. Tenant attach is not the same as co-management-co-management splits policy authority, while tenant attach keeps policies on-premises and adds cloud actions and visibility. In certification exams like MD-102 and MS-101, tenant attach appears in questions that test the candidate’s ability to distinguish between hybrid management scenarios, identify prerequisites (Entra ID app registration, Configuration Manager 2006+, admin consent), and troubleshoot common issues like expired secrets or missing permissions. The key exam takeaway is that tenant attach is about extending, not replacing, existing management. A solid understanding of this distinction will help learners correctly answer scenario-based questions and avoid traps that confuse tenant attach with co-management or full Intune enrollment. In practice, tenant attach is a stepping stone toward modern management and a critical tool for IT professionals managing hybrid environments.

---

Practice questions and the full interactive page: https://courseiva.com/glossary/tenant-attach