> ## Documentation Index
> Fetch the complete documentation index at: https://docs.tenantcore.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Agency Client Onboarding

> How to structure and provision Microsoft 365 infrastructure for agency clients, from tenant creation to live mailboxes.

## The agency model

There are two ways to structure infrastructure for agency clients in TenantCore: one tenant per client, or multiple clients on a shared tenant with enforcement.

**One tenant per client** is the recommended approach. Each client gets their own Microsoft 365 tenant, their own domains, and their own mailboxes. A suspension or deliverability problem for one client is fully isolated and cannot affect another.

**Multiple clients on a shared tenant** is a viable alternative if you are managing strict send limits through TenantCore's enforcement. The risk of a shared tenant is that all clients share the same TERRL and the same Microsoft abuse detection surface. With enforcement active on every domain, that risk is manageable, but the responsibility for keeping the tenant healthy sits entirely with you.

See [Tenant Architecture](/concepts/tenant-architecture) and [Understanding TERRL](/concepts/terrl) for a full breakdown of how shared tenants work and what enforcement covers.

***

## Who owns the tenant

There are two ways to structure tenant ownership for agency clients:

### Client-owned (recommended)

The client creates and owns the Microsoft 365 tenant. You connect it to TenantCore using their Global Administrator credentials or a dedicated admin account they provision for you.

**Pros:**

* Client retains full ownership of infrastructure
* No billing relationship between you and Microsoft for client licenses
* Clean offboarding — you disconnect the tenant, they keep everything

**Cons:**

* Requires client to set up a Microsoft account
* More coordination overhead during onboarding

### Agency-owned

You create and own the Microsoft 365 tenant on behalf of the client. You manage billing, licensing, and access.

**Pros:**

* Faster onboarding — no client involvement required
* Full infrastructure control

**Cons:**

* You absorb license costs (or pass them through with markup)
* Offboarding requires transferring ownership or migrating infrastructure

***

## Onboarding workflow

Regardless of ownership structure, the provisioning sequence is the same:

### 1. Create the tenant

Follow the [Microsoft Tenant Setup](/guides/microsoft-tenant-setup) guide. If the client is creating their own tenant, share that guide with them and have them send you Global Administrator credentials or create a dedicated admin account for your access.

### 2. Register sending domains

For each client, register dedicated sending domains. Use brand-adjacent variations — not the client's primary domain.

**Examples for a client at `acme.com`:**

* `tryacme.com`
* `getacme.com`
* `acmehq.com`

Register these at your preferred registrar. The client does not need to be involved in domain registration unless they prefer to own the domains themselves.

### 3. Connect the tenant to TenantCore

1. Go to **Tenants** in the TenantCore app
2. Click **Connect Tenant**
3. Enter the Global Administrator credentials for the client's tenant
4. TenantCore connects and configures Exchange Online

Label the tenant clearly in TenantCore, use the client's name or a consistent naming convention so tenants are easy to identify across your account.

### 4. Add domains and configure DNS

Add each sending domain to the tenant through TenantCore. For each domain:

1. TenantCore generates DNS records (MX, SPF, DKIM, DMARC and Microsoft 365 service records)
2. Add those records to the domain's registrar
3. Wait for propagation and verification

If the client owns the domains, share the DNS records with them and have them add the records themselves, or request registrar access.

### 5. Provision mailboxes

Once domains are verified, provision mailboxes. New infrastructure should start conservatively, begin at 4 to 7 emails per mailbox per day and ramp up toward the 25 per day ceiling as your domains age and build reputation.

### 6. Set enforcement

After mailboxes are provisioned, set send limit enforcement through the **Set Global Limit** button on your dashboard. Select the tenant, select the domains, and apply the limit. This provisions transport rules in Exchange Online per domain.

<Warning>
  Enforcement is not applied automatically. Until it is set, there is no Exchange-level ceiling on outbound volume. For agency clients especially, set enforcement before handing off to your sending tool.
</Warning>

### 7. Hand off credentials

Retrieve Mailbox credentials from TenantCore and enter them into your sending tool. Tag mailboxes by client so campaign attribution stays clean.

***

## Managing multiple clients

**Consistent naming** — Use a standard format for mailbox display names and email addresses across clients. Makes debugging easier when something goes wrong.

**Stagger ramp schedules** — Do not bring multiple new clients to full volume simultaneously. Staggering ramp-ups makes it easier to attribute deliverability issues if they arise.

**Separate sending tools per client** — If your sequencer supports workspaces or accounts, keep clients isolated there too. Shared campaign pools make it harder to attribute performance and harder to offboard cleanly.

**Document tenant credentials securely** — Store Microsoft admin credentials in a password manager with client-specific entries. You will need them if you ever need to access the admin center directly.