# Customer Consent Instructions (template)

Use this when handing the single consent link to a customer's Global Administrator.
Fill in `{{CUSTOMER}}`, `{{CONSENT_URL}}` (from `onboard365.sh link <domain>`), and your name.

---

**Subject:** Action needed: one-click approval to connect Arizona Computer Guru to your Microsoft 365

Hi {{ADMIN_NAME}},

To manage and protect your Microsoft 365 environment, we need a one-time approval from a
Microsoft 365 **Global Administrator** at {{CUSTOMER}}. This is a single click — you won't need
to approve anything else after this.

1. Open this link while signed in as a Global Administrator:

   {{CONSENT_URL}}

2. Review the screen (it will show **"ComputerGuru Tenant Admin"**) and click **Accept**.

That's it. Once you've accepted, reply to let us know and we'll finish the setup on our end.

Thanks,
{{TECH_NAME}}
Arizona Computer Guru · 520.304.8300

---

## Notes for the tech (not for the customer)

- The approver MUST be a **Global Administrator**. A User Admin / other role cannot grant
  application admin consent — the Accept will fail or be greyed out.
- The single grant is for **ComputerGuru Tenant Admin** only. After they accept, run
  `onboard365.sh provision <domain>` — that creates the other app SPs and assigns roles with no
  further customer interaction.
- If they report an error like "Need admin approval" / "AADSTS650056" / "AADSTS7000229" on the
  link, they almost always signed in with a non-GA account. Have them retry as a GA.
- Don't send the per-app links. One link is the whole point. Per-app fallback URLs only come into
  play if `onboard-tenant.sh` reports a specific app failed programmatic consent.
