> For the complete documentation index, see [llms.txt](https://docs.autopilotmonitor.com/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.autopilotmonitor.com/getting-started/portal-setup.md).

# Portal Setup

One-time tenant setup in the portal: the first sign-in that makes you Tenant Admin, enabling Autopilot Device Validation, and the recommended initial settings.

Before the agent can send any data to the portal, a few one-time steps are required in the portal itself.

## 1. Sign in — the first user becomes Tenant Admin

Open the portal and sign in with your Microsoft Entra ID account. The very first member of your organization to sign in is automatically granted **Tenant Admin** rights for your tenant; a guest account never is.

{% hint style="info" %}
The Tenant Admin can later promote other users via **Settings → Access Management**. Users without a role only see the **Progress Portal** — a simplified view for tracking a specific device by serial number — and have no access to session details, diagnostics, or configuration. See [Roles & Permissions](/concepts/roles-and-permissions.md) and, for colleagues who sign in later, [Signed in, but only the Progress Portal](/troubleshooting-and-support/progress-portal-only.md).
{% endhint %}

## 2. Enable Autopilot Device Validation

Navigate to **Settings → Configuration** and enable **Autopilot Device Validation**. This is required before the agent is permitted to send any session data — without it, all agent uploads are rejected.

{% hint style="warning" %}
**Why is this required?** The Autopilot device check ensures that only devices registered in your Intune tenant can register sessions, preventing unintended data from reaching your tenant. Enabling it requires admin consent for the Microsoft Graph permission `DeviceManagementServiceConfig.Read.All` (read-only), and it is your explicit confirmation that the agent may collect and transmit enrollment telemetry on behalf of your organization.

Granting this consent requires an Entra ID role that can consent tenant-wide to Microsoft Graph application permissions — **Global Administrator** or **Privileged Role Administrator**. If your account lacks these rights, ask someone who has them to run the consent, then use **Detect existing access** in the portal to activate the feature without repeating the consent redirect.
{% endhint %}

## 3. Ready

That's it — the portal can now receive data. [Deploy the agent](/getting-started/deploy-the-agent.md) via Intune, and sessions will start appearing on the dashboard as soon as devices begin enrolling.

## Recommended configuration

After the basic setup, consider enabling these features to get the most out of Autopilot Monitor:

1. **Tenant → Contact** — set an address we can reach you on if something about your tenant needs attention. A shared team mailbox works better than a personal one. It is used for service matters only, never for marketing.
2. **Agent Settings → Geo Location Detection + Set Timezone Automatically** — sets the device timezone correctly during enrollment. Without a location sensor, Windows defaults to Pacific Standard Time; this fixes the "every English device thinks it's in Redmond" effect and feeds the Geographic Performance view.
3. **Agent Analyzers** — enable the **Local Admin Analyzer** (configure your expected admin accounts to detect unauthorized local admins), **Software Inventory**, and the **Vulnerability Analyzer** for security insights during enrollment.
4. **Diagnostics Package** — automatically gathers log files from devices for troubleshooting. You choose the upload destination: your own Azure Blob Storage (Container SAS URL — data never leaves your tenant) or the built-in hosted storage (no storage account needed). Upload Mode *On Failure Only* keeps the IME and agent logs of every failed enrollment, the raw evidence an AI investigation needs when no rule explains a failure.

All settings are described in detail in the [Settings Reference](/reference/settings.md).


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation by asking a question.

Perform an HTTP GET request on the following URL with the `ask` and `goal` query parameters:

```
GET https://docs.autopilotmonitor.com/getting-started/portal-setup.md?ask=<question>&goal=<user_goal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is what the user is ultimately trying to achieve, the reason they need the answer. Sharing it helps GitBook give you a better, more relevant answer. A goal is most helpful when it describes the outcome the user wants rather than restating the question. For example, with `ask=how do I create an API token`, a goal like `automate deployments from our CI pipeline` lets GitBook tailor the answer to that use case.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.