Overview 💥
When using a Microsoft 365 Inspector (Multi-Tenant Configuration), Liongard should automatically discover all delegated child tenants associated with your Partner Center account.
If one or more client tenants are not appearing under Discovered Systems, this indicates a configuration, permission, or API issue preventing Liongard from retrieving the tenant list.
This guide provides a complete troubleshooting workflow to identify root causes and resolve discovery problems efficiently.
Why Does This Happen? 🤔
Tenants may not be auto-discovered due to:
Missing or broken Partner Center Delegated Admin relationship
Missing entries in the Contracts array from Microsoft Graph
Cached/stale discovery data
Permission/consent issues with the parent launchpoint
Microsoft Graph API errors, throttling, or outages
Inspector failing before discovery is attempted
Recent tenant onboarding requiring propagation time
Payload processing errors when generating launchpoints
Steps to Resolve 👨💻
1️⃣ — Verify the Tenant Isn’t Already Discovered
Go to Admin → Inspectors → Microsoft 365 → Discovered Systems
Search for the client tenant
If already present → the issue is not discovery; review Active System instead
If not present → continue troubleshooting
2️⃣ — Check the “Discovered” Array in the Parent Dataprint
Open the Parent Microsoft 365 Launchpoint
On System Details page select Data Print Explorer
Search for:
Discovered
If the client tenant appears in the array:
Check Parent inspector Payload Processing Logs for any errors during launchpoint creation.
If the tenant does not appear, move on to Contract checks
3️⃣ — Validate the ‘Contracts’ Array (Microsoft Graph)
The Contracts array is what Microsoft uses to list delegated admin customers.
In the parent dataprint, search for:
Contracts
If the client tenant is missing from the Contracts array:
➜ Liongard cannot discover the tenant.
➜ This must be fixed in Partner Center, not Liongard.
Reference: Microsoft Graph Contract Resource
4️⃣ — Confirm Partner Relationship in Partner Center
Have the partner sign in to ➡ Partner Centre
Check:
Is the client tenant listed under Customers?
Does the relationship show Delegated Admin permissions?
Has the customer recently removed any permissions?
Without a valid delegated admin relationship, Liongard cannot discover the tenant.
5️⃣ — Validate Permissions & Admin Consent
Ensure the Parent Launchpoint has:
Proper API permissions.
Valid admin consent.
No expired or revoked OAuth tokens.
If permissions were updated in Microsoft 365:
Edit the parent inspector
Complete the re-authentication process by selecting "Open Microsoft Sign-In"
Trigger a run in Clear Cache + Debug Mode
6️⃣ — Check Inspector Run Status
If the parent Inspector is failing due to:
Authentication issues.
API rate limits.
Network restrictions.
Expired refresh tokens.
Or any other issues.
Discovery may not execute. Resolve any Inspector errors and re-run inspector and check discovery.
7️⃣ — Check Microsoft Graph API Status
Visit:
Look for:
Graph API throttling.
Tenant retrieval failures.
Partner Center API issues.
If Microsoft is impacted → discovery will fail until Microsoft resolves the service.
8️⃣ — Recently Added Tenant? Allow Time
Microsoft sometimes takes up to 2–24 hours to propagate new:
Delegated admin assignments.
Customer tenant visibility.
Contracts resource updates.
Our Advise is:
Wait for propagation.
Re-run the parent launchpoint.
9️⃣ — Attempt Manual Discovery
If auto-discovery fails:
Add the client tenant manually as a new inspector.
Attempt authentication
If this fails → relationship or permissions are broken.
If this succeeds → auto-discovery is the only failing component.
Troubleshooting Summary 🤩
Step | What to Check | Expected Result | What It Means if It Fails |
1️⃣ Discovered Systems | Tenant appears | Already discovered | No discovery issue |
2️⃣ Discovered Array | Tenant listed | Payload logs should show success | Launchpoint creation error |
3️⃣ Contracts Array | Tenant listed | Valid delegated admin | Missing → Not discoverable |
4️⃣ Partner Center | Customer visible | Relationship exists | No relationship → no discovery |
5️⃣ Permissions | Admin consent valid | Inspector can access Graph API | Reauth required |
6️⃣ Inspector Runs | Successful | Discovery functions normally | Fix Inspector failure |
7️⃣ Service Health | No advisories | Graph API healthy | Microsoft outage/throttling |
8️⃣ Propagation | 0–24 hrs | Tenant eventually appears | Still missing → permissions issue |
9️⃣ Manual Discovery | Manual launchpoint succeeds | Auto-discovery issue | Manual fails → relationship broken |
Discovery Flowchart 🚀
START
│
▼
Is the tenant listed in Discovered Systems?
│ └── YES → Done
▼
Check Dataprint → Discovered array
│
Is the tenant listed?
│ └── YES → Check payload processing logs
▼
Check Contracts array
│
Is the client tenant listed?
│ └── NO → Fix Partner Center relationship
▼
Validate permissions & consent
│
Inspector running successfully?
│ └── NO → Fix Inspector errors
▼
Check Microsoft service health
│
Still not discovered?
▼
Try manual discovery
│
Manual discovery fails?
│ └── YES → Partner Center relationship broken
▼
Contact Liongard Support
External Resource Disclaimer ‼️
This article references external Microsoft resources and tools. Liongard does not control availability, functionality, or accuracy of third-party sites. Use them as optional reference resources.
When to Contact Liongard Support 🦁
Contact Support after completing all troubleshooting steps.
Provide the following details for fastest resolution:
Parent Microsoft 365 Launchpoint name.
Tenant ID(s) not being discovered.
Screenshot of the Discovered array and Contracts array.
Latest Inspector run logs.
Confirmation of partner relationship from Partner Center(Screenshots).
Any recent changes to tenant onboarding or delegated access.
Whether manual discovery succeeds or fails.
Logs from a Clear Cache + Debug Mode run.
Providing these upfront significantly accelerates investigation.