Getting started with Praefic
Connecting a tenant takes a few minutes and four steps. You need:
- A Microsoft work account to sign in to Praefic.
- A Global Administrator (or another role allowed to grant tenant-wide admin consent) for step 2.
- Permission to assign roles on the management group or subscriptions you want scanned — Owner or User Access Administrator — for step 3.
The person who assigns the Reader role in step 3 must be a member of your Praefic organization, signed in to Praefic with the same Microsoft account they use in Azure. That is how Praefic confirms the tenant is yours to read — see How Praefic confirms the tenant is yours.
Sign in
Open Praefic and choose Sign in with Microsoft. The first time anyone from your Entra tenant signs in, Praefic creates an organization for it and makes that person its owner.
Sample data
A new organization starts empty: your pages fill in as soon as your first scan completes.
Some organizations — demo and evaluation setups — also hold a fictional estate, Contoso (sample data), so every page has something to show before a real scan: findings across most areas, initiatives, exceptions, solutions, cost and activity history, privileged-access elevations and Secure Score history. It is never scanned and is clearly labelled.
If your organization has it, remove it under Settings → Connections → Remove sample data. This deletes the sample connection and everything that came with it, including the sample solutions and IP inventory entries; your own connections are not affected. A sample solution you have since pointed a mapping rule at is kept.
There is no need to hurry: your own scan history is kept. Days your scans recorded stay in the health-score trend and the maturity-level charts, with the sample taken out of them, and only the days that held nothing but sample data are removed.
Connect a tenant
Go to Settings → Connections and choose Connect a tenant. The wizard walks you through four steps.
Step 1 — Tenant
Enter your Azure tenant ID (or click Use my tenant to fill in the tenant you signed in with) and, optionally, a friendly name.
Step 2 — Admin consent
Click Open admin consent. Microsoft's consent screen opens in a new tab, asking a tenant administrator to grant the Praefic Scanner app access to your directory. After consenting you are returned to Praefic; if you consented in another tab, just continue.
Note: Consent creates the Praefic Scanner service principal in your tenant. It does not by itself grant access to any subscription — that is step 3.
Step 3 — Assign Reader
Give the Praefic Scanner app the built-in Reader role. The wizard shows the exact command, with your tenant's values filled in. Assigning it at the tenant root management group is recommended — it covers every current and future subscription:
az role assignment create \
--assignee <praefic-scanner-app-id> \
--role Reader \
--scope /providers/Microsoft.Management/managementGroups/<tenant-id>
To scope Praefic to a single subscription instead, use --scope /subscriptions/<subscription-id>. You can also assign the role in the Azure portal: Subscription → Access control (IAM) → Add role assignment → Reader, and select Praefic Scanner.
Tip: Assign the role with the same Microsoft account you use in Praefic. If someone else does it, invite them to your Praefic organization first (see below).
Step 4 — Verify
Click Verify access. Praefic confirms the tenant is yours, lists the subscriptions it can see, and scanning starts automatically.
A new role assignment can take a few minutes to reach Azure. If verification does not find it straight away, wait a moment and click Verify again.
How Praefic confirms the tenant is yours
A tenant ID is not a secret, and the Praefic Scanner app is shared by every customer. So before Praefic reads anything, it checks that the Reader role was granted by someone in your Praefic organization: Azure records who created each role assignment, and Praefic compares that with the Microsoft accounts of your organization's members. Granting a role takes Owner or User Access Administrator, so this shows that someone with authority over the subscriptions chose to let your organization in. Being a user in the same Entra tenant is not enough.
If verification says Praefic could not confirm who granted access, pick the case that fits:
| Who assigned Reader | What to do |
|---|---|
| You | Make sure you are signed in to Praefic with the same account you used in Azure. If you used a different account, treat it as the next row. |
A colleague, or a separate admin account (for example a dedicated adm- account, or an account in a customer's tenant you manage) |
Invite that account under Settings → Users → Invite user. By email works for an account in any Entra tenant; by sign-in name only within your organization's own tenant. Have it sign in to Praefic once to accept, then click Verify again. Anyone in your organization can verify once that account is a member. |
| A pipeline, script or infrastructure-as-code | A service principal cannot be a member. Have a person assign Reader once more — on a single subscription is enough — then click Verify again. Praefic still reads everything the Praefic Scanner app has access to. |
| None of these fit | Contact Just Software support with your tenant ID. We confirm the tenant is yours and verify it for you. |
Praefic never tells you who did assign the role — to someone who is not entitled to the tenant, that would be another organization's administrator.
Managing customer tenants (MSP)? The same rule applies: invite an account from the customer's tenant that assigned Reader there (or have it assign Reader), and the connection verifies itself. One Praefic organization can hold several tenants.
Choose what is scanned
Each discovered subscription appears under its connection and can be switched off and on individually. Praefic only scans enabled subscriptions.
Scans
- The first scan starts as soon as access is verified; most areas finish within minutes. Cost history is back-filled over the following scans.
- After that, every area is scanned on a schedule (daily by default) — each area keeps its own schedule, so scanning one area by hand never delays the others.
- Scan now on the dashboard starts a scan immediately.
- Settings → Scan history shows every scan, what it examined, and any subscription Azure refused to answer for.
If a scan can only partly read your tenant — for example because Reader was removed from one subscription — Praefic says so on the affected pages and keeps showing the last good data for that subscription, labelled with its age, rather than silently dropping it.
Invite your team
Invite colleagues under Settings → Users → Invite user, by email or by their Microsoft sign-in name, with the role they should have. A colleague from your Entra tenant who signs in without an invitation is turned away and asked to request one, unless an administrator allows that under Settings → Organization → Colleagues without an invitation. Organize people into Groups, which you can assign findings to. See Settings for what each role can do.