Getting started

Coming soon. TenRise is in testing and not publicly available yet. This guide is for testers who received an install link.

TenRise is a Firefox extension that activates your Microsoft Entra PIM roles across customer tenants. This page takes you from installing it to your first activation.

Before you start

Firefox 140 or later.
An account at the customer with at least one eligible PIM assignment: a PIM-enabled group, a Microsoft Entra role or an Azure resource role. TenRise activates what you're already eligible for; it never grants anything new.
Admin consent in the customer's tenant. The first time someone at a customer uses TenRise, an administrator there approves it once. See Permissions & consent — you can send that page to the customer's admin.
For CSP access (Partner plan): active GDAP relationships and/or Azure Lighthouse delegations, and admin consent in your own partner tenant.

There is nothing to register or configure in Entra yourself. TenRise uses one app published by Cloudtrees; each tenant only grants consent to it.

1. Install

Install TenRise in Firefox using the link you received with your access.
The TenRise button appears in the Firefox toolbar. If it's hidden behind the puzzle-piece icon, open that menu, click the gear next to TenRise and choose Pin to Toolbar.
Click the button to open TenRise in its own tab.

2. Add your first customer

Click + Add customers.
Enter your own account at that customer, for example you@customer.com, and click Add and sign in.
TenRise looks up the customer's tenant and opens the Microsoft sign-in window with your account filled in. Sign in as usual, MFA included.
The customer appears in the list on the left, with its own colour. That colour is also its Firefox container: every tab TenRise opens for this customer is kept separate from your other customers.

If TenRise shows Admin consent needed, the customer's tenant hasn't approved TenRise yet. Use the link it shows, or send it to an administrator at the customer — see how to grant consent.

3. Activate a role

Pick the customer on the left.
Pick the role in the middle. Roles are grouped by how you reach them (your own account, GDAP or Lighthouse) and labelled by type.
On the right, TenRise shows what the customer's PIM policy requires. The duration starts at the maximum the policy allows. Fill in a reason (the chips give you a quick start) and, if the policy asks for it, a ticket number — tickets you used recently for this customer appear as chips too.
Click Activate role. Entra usually needs 1 to 5 minutes before the role is active; TenRise shows a countdown as soon as it is.

If a role needs approval, TenRise submits the request and an approver at the customer decides, exactly as in the Azure portal.

4. Open the right portal

Each group of roles has an Open Azure Portal ↗ button. The arrow next to it lists the other admin portals: Entra, Microsoft 365, Exchange, Teams, Intune, Defender, SharePoint, Power Platform and more. They open already switched to that customer, inside the customer's own container.

5. When you're done

Deactivate ends the activation right away. Microsoft only allows this once a role has been active for at least 5 minutes.
Reactivate deactivates and activates again with the same reason, duration and ticket, for when you need more time.
Activations also simply expire at the end of their duration.

CSP partners: GDAP and Lighthouse

On the Partner plan you sign in once with your partner account instead of per customer.

Click Connect CSP account on the left and sign in with your account in your partner tenant.
Choose whether to check for GDAP customers, Lighthouse customers or both.
TenRise lists the customers it finds. Tick the ones you want and click Create containers.

Lighthouse details can only be read while you have an Azure role with at least Reader-level access active on the customer's subscription. If none is active, the check comes back empty — activate one first, then check again.

Microsoft limits how long a browser app like TenRise stays signed in, so expect to sign in again about once a day. When that happens TenRise shows Reconnect accounts; one click per account is enough. Your tokens are kept only inside the extension in your browser.

Sign in with a passkey

TenRise already fills in your account name. With a passkey there's no password either: you confirm with your face, fingerprint or PIN, and you're in. A passkey is also phishing-resistant: it only works on Microsoft's real sign-in page, so it can't be phished the way a password, code or push approval can.

Go to mysignins.microsoft.com/security-info, signed in with the account you use in TenRise.
Choose Add sign-in method → Passkey and follow the steps. Keep it in Microsoft Authenticator on your phone, in Windows Hello, or on a security key.
Next time TenRise opens the Microsoft sign-in, choose the passkey option:
- Windows Hello or a security key: enter your PIN, look at the camera or touch the key.
- Passkey on your phone: the first time, scan the QR code with your phone. After that, your phone usually gets a notification to confirm.

Passkeys must be allowed in the tenant you sign in to: an administrator enables them under Microsoft Entra ID → Authentication methods → Policies → Passkey (FIDO2). For GDAP and Lighthouse only your own partner tenant matters; for your own account at a customer, it's that customer's setting.

Some customers require phishing-resistant sign-in before you can activate certain roles. A passkey meets that requirement.

Plans and licenses

TenRise runs on the Free plan without a license. To use Pro or Partner, open About → License, paste the license string you received and click Save.

A license belongs to your organisation's own Microsoft Entra tenant. It takes effect once TenRise has an account from that tenant that has signed in: for Partner usually your CSP account, for Pro your own work account (add it like any other customer). Your own tenant doesn't count toward the Pro customer limit. Until then, TenRise keeps running on Free and the License screen tells you which tenant it's waiting for.

Pro is per named user: the license lists the accounts (UPNs) that may use it. Adding a colleague means a new license with their account added.
Partner is per organisation and comes in three sizes by number of customer tenants: 25, 100 or unlimited. When a GDAP or Lighthouse import would go past your size, TenRise adds what fits and tells you about the rest.

The License screen shows your plan, which tenant the license belongs to, how many customers you're using and until when the license is valid. If a license expires, TenRise keeps working on Free; customers you already added stay available. Want to try Partner first? Ask for a 30-day trial at hello@gettenrise.com and tell us your own tenant. Plans and prices follow at launch.

Need help?

Email support@gettenrise.com. For access, plans or licenses: hello@gettenrise.com.