---
title: Connecting Tenants
description: Connect additional Microsoft 365 tenants and troubleshoot connection issues.
icon: Link
---

You can connect multiple Microsoft 365 tenants to a single 1Security account - useful for MSPs, holding companies, and organisations with several tenants.

## Adding a tenant

<Steps>
  <Step>
    ### Open the tenant menu

    Click the tenant switcher in the top-left of the dashboard, then **Add tenant**.

  </Step>
  <Step>
    ### Authenticate

    A new tab opens to Microsoft's OAuth consent flow. Sign in with a global admin of the tenant you want to add.

  </Step>
  <Step>
    ### Grant permissions

    Approve the same permissions you granted during the initial install.

  </Step>
  <Step>
    ### Wait for the initial scan

    The new tenant appears in your switcher immediately, but full data takes the duration of the [initial scan](/en/docs/scans) to populate.

  </Step>
</Steps>

## Troubleshooting

<Accordions>
  <Accordion title="Consent failed with 'AADSTS50020'">
    This error means the account you tried to sign in with isn't a member of the
    target tenant. Make sure you're using a global admin account **from the
    tenant you're adding**, not from your main 1Security account.
  </Accordion>
  <Accordion title="Scan stuck on 'Discovery' for over an hour">
    Microsoft Graph rate limits sometimes throttle initial discovery. Check
    **Settings → Scan status** for error messages. If you see `TooManyRequests`,
    the scan will retry automatically - no action needed.
  </Accordion>
  <Accordion title="Some users are missing from the dashboard">
    Newly created users in Microsoft 365 take up to 24 hours to appear in
    1Security. Manually trigger a delta scan from **Settings → Scan status → Run
    delta** to pull them in immediately.
  </Accordion>
  <Accordion title="I want to disconnect a tenant">
    Go to **Settings → Tenants**, click the three-dot menu next to the tenant,
    then **Disconnect**. This removes all data associated with the tenant from
    1Security within 7 days.
  </Accordion>
</Accordions>

## Tenant permissions

<Callout type="info">
  1Security requests **read-only** permissions by default. Write permissions
  (used by automations) are opt-in per module.
</Callout>

Each tenant you add grants the same permissions as the first one, and each is
consented separately - connecting a second tenant never extends the first
tenant's grant.

The full list of permissions per module, the licenses each tenant needs, and the
admin roles involved are in [Requirements](/en/docs/requirements).