Skip to main content

Microsoft 365 | Child tenants not being discovered

M365, Microsoft 365, 365, Child Tenants not being discovered, Discovery, Auto-discovery, Child Tenants

Overview 💥

When using the Microsoft 365 Inspector in a multi-tenant configuration, Liongard automatically discovers customer (child) tenants associated with your Microsoft Partner Center environment.

If one or more child tenants are missing from Discovered Systems, this typically indicates an issue related to:

  • GDAP (Granular Delegated Admin Privileges)

  • Microsoft Partner Center relationships

  • Microsoft Graph API permissions

  • Authentication or consent configuration

  • Cached discovery data

  • Parent Inspector failures

This guide walks through the most common causes and provides troubleshooting steps to help restore tenant discovery.

Why Does This Happen? 🤔

Child tenants may fail to appear for several reasons, including:

  • Missing or invalid GDAP relationships

  • The tenant not appearing in the Microsoft Graph Contracts resource

  • Authentication or admin consent issues

  • Parent Inspector permission failures

  • Microsoft Graph API throttling or outages

  • Stale cached discovery data

  • Recent customer onboarding delays

  • Payload processing or launchpoint creation failures

Steps to Resolve 👨‍💻

1️⃣ Verify the Tenant Is Not Already Discovered

Navigate to: Admin → Inspectors → Microsoft 365 → Discovered Systems

Search for the affected tenant.

  • If the tenant already exists:

    • Discovery has already completed successfully.

  • If the tenant is missing:

    • Continue with the next steps.

2️⃣ Check the “Discovered” Array in the Parent Dataprint

  • Open the Parent Microsoft 365 Launchpoint

  • On System Details page select Data Print Explorer

  • Search for:

    Discovered

  • If the client tenant appears in the array:

    • Check Parent inspector Payload Processing Logs for any errors during launchpoint creation.

  • If the tenant is not found in the Discovered array, proceed to the Contracts array.

3️⃣ Validate the ‘Contracts’ Array

The Contracts array is what Microsoft uses to list delegated admin customers.

  • In the parent inspector dataprint, search for:

    Contracts

  • If the tenant is missing from the Contracts array:
    ➜ Liongard cannot discover the tenant because Microsoft is not returning the delegated relationship through Graph API.
    ➜ This issue must be resolved within Microsoft Partner Center or the GDAP relationship configuration.

Reference: Microsoft Graph Contract Resource

4️⃣ Validate the GDAP Relationship

Sign in to: Microsoft Partner Center

Confirm the following:

  • The customer tenant appears under Customers

  • A valid GDAP/Admin Relationship exists

  • Required delegated roles are assigned

  • The relationship has not expired or been removed

  • The customer has not revoked delegated access

Without a valid GDAP relationship, Liongard cannot discover or inspect the tenant.

5️⃣ Validate Authentication and Consent

Ensure the Parent Microsoft 365 Inspector:

  • Has valid authentication

  • Has completed Microsoft admin consent

  • Uses an account with the required Entra ID roles

  • Uses Microsoft MFA enforcement

  • Is a member of the AdminAgents security group

If permissions or GDAP assignments were recently modified:

  1. Edit the Parent Inspector

  2. Select Open Microsoft Sign-In

  3. Complete authentication again

  4. Initiate an inspection by using the Clear Cache and Debug Mode

6️⃣ Verify the Parent Inspector Is Running Successfully

Discovery only occurs when the Parent Inspector completes successfully.

Common issues preventing discovery include:

  • Authentication failures

  • Expired refresh tokens

  • Conditional Access restrictions

  • API permission failures

  • Microsoft Graph throttling

  • Network or firewall restrictions

Resolve any Parent Inspector errors before troubleshooting discovery further.

7️⃣ Check Microsoft Service Health

Review Microsoft service health status for issues affecting:

  • Microsoft Graph API

  • Partner Center APIs

  • Entra ID authentication services

Useful resources:

Temporary Microsoft outages or throttling may prevent tenant discovery.

8️⃣ Recently Added Tenant? Allow Propagation Time

New GDAP relationships and delegated permissions may require time to propagate through Microsoft services.

Propagation can sometimes take between 2 and 24 hours.

Recommended actions:

  • Wait for propagation to complete

  • Re-run the Parent Inspector afterward

  • Use Clear Cache mode during the next inspection

9️⃣ Attempt Manual Discovery

If auto-discovery fails:

  • Add the client tenant manually as a new inspector.

  • Attempt authentication

    • If this fails → relationship or permissions are broken.

    • If this succeeds → auto-discovery is the only failing component.

Discovery Flowchart 🚀

START
 │
 ▼
Is the tenant listed in Discovered Systems?
 │       └── YES → Done
 ▼
Check Dataprint → Discovered array
 │
Is the tenant listed?
 │       └── YES → Check inspection logs
 ▼
Check Contracts array
 │
Is the client tenant listed?
 │       └── NO → Fix Partner Center relationship
 ▼
Validate permissions & consent
 │
Inspector running successfully?
 │       └── NO → Fix Inspector errors
 ▼
Check Microsoft service health
 │
Still not discovered?
 ▼
Contact Liongard Support

Important Notes 🚨

GDAP Relationships Are Required

Liongard relies on Microsoft GDAP relationships to enumerate and inspect delegated customer tenants. Without a valid delegated relationship, tenants cannot be discovered.

The Contracts Array Is Microsoft-Controlled

Liongard does not generate or manage the Contracts resource. If a tenant is missing from the array, Microsoft is not exposing the delegated relationship through Graph API.

AdminAgents Membership Is Still Required

Even if custom security groups are used for Admin Relationships, the account authenticating the Parent Inspector must still belong to the AdminAgents security group.

When to Contact Liongard Support 🦁

If the issue persists after completing all troubleshooting steps, contact Liongard Support and provide:

  • Parent Inspector name

  • Missing tenant name

  • Screenshot of the Discovered array

  • Screenshot of the Contracts array

  • Parent Inspector logs

  • Confirmation of GDAP relationship status

  • Any recent Partner Center or onboarding changes

  • Clear Cache + Debug Mode logs

Providing this information upfront significantly accelerates investigation and resolution.

External Resource Disclaimer ‼️

This article references external Microsoft resources and tools. Liongard does not control availability, functionality, or accuracy of third-party sites. Use them as optional reference resources.

Did this answer your question?