MSP: see what reaches each tenant before you send it
Per row and per tenant: what will arrive, and what is withheld with the reason - computed by the same plan a managed tenant runs.
Purpose
"I gave them the role in the customer tenant and nothing happened" is the most common multi-tenant support question.
Design
The provider's Manager shows per row how many managed tenants it reaches and which ones, and per role which tenants it is withheld from - the wave, the target, the relationship policy, a capability the customer switched off, or something unresolved. The preview builds the set and runs the same plan the managed tenants run, using the managing tenant's copy of each tenant's wave; when that copy differs from the tenant's own wave, the tenant's own wave decides. A pull's explanation - what was sent, what was excluded and why - is kept with the run.
Business opportunities
Fewer surprises and support calls: the provider knows what each customer receives before it happens.
Related features
Access map: your delegation model on one board
Pick a person or a permission and see every path in your delegation model - people, their groups, what those groups include and the roles and scopes they grant.
Who can do what - and who can activate this role
Pick a person to see the targets they can reach, or pick a role to see who can activate it - each with the exact path that grants it.
Look up a role: find the least-privileged role for the job
See what an Entra ID role can do in plain words, find the roles that grant an action ranked least-privileged first, see who can activate a role, or compare two roles.
An engine that keeps your tenant matching your model
You describe the access you want; the engine creates the groups, owners, policies, assignments and access passes your data defines, and keeps them that way.