Features

Every mailbox, on-prem accountable

Tenvero manages hybrid AD and Exchange Online mailboxes so on-prem security groups stay the administrator-facing source of truth — grouped into four capability areas.

Delegation & AutoMapping

AD-group-driven access
Full Access, Send As and Send on Behalf each mapped to an on-prem AD security group, reused or separate per right.
Automation-owned state
Reconciliation grants and revokes only Tenvero-owned permissions — unrelated manual Exchange access is never touched.
Safe existing-access takeover
Import current direct delegates, resolve them to AD, and adopt matching permissions into Tenvero without revoking anything.
Fail-closed by design
A complete cloud snapshot must be read before any AD group membership changes during takeover.
Direct Full Access for AutoMapping
Reconciliation writes direct Exchange Full Access so Outlook AutoMapping keeps working while AD groups stay authoritative.
Access activity log
Every Grant, Revoke, Takeover and AutoMapping event recorded with expected Outlook desktop/mobile propagation behavior.

Audit & compliance

Delegation Audit scan
Read-only health scan across every configured mailbox mapping — never changes Exchange permissions or AD membership.
Disabled & orphaned detection
Flags disabled AD users retaining access and Exchange trustees that no longer resolve to a recipient or an AD account.
Missing mapping detection
Flags missing mapped mailboxes and groups that are missing or no longer security-enabled.
Unmanaged access detection
Surfaces direct Exchange delegations that exist outside the AD group mapped as source of truth.
Critical / Warning / Info triage
Findings are filterable by severity with remediation guidance and a direct shortcut back into Delegation.
CSV export
Every audit run exports to DelegationHealthAudit.csv for review or ticketing outside Tenvero.

Identity & mailbox data

Multi-domain SMTP & aliases
Primary and secondary addresses across every accepted domain in the tenant, with a searchable mailbox picker.
Hybrid source of authority
Handles proxyAddresses, AD mail, hidden-from-address-lists and Entra Connect delta sync consistently.
Cloud-only support
Mailboxes without an on-prem AD object are managed directly in Exchange Online.
Mailbox settings
Mailbox type, forwarding, address-list visibility and directory-sync metadata in one view.
Entra Connect delta sync
Trigger a delta cycle locally or on a remote Connect server immediately after a change, or leave sync disabled.
AD-first writes
Directory-synchronized recipients are always written on-prem first so sync state never drifts.

Setup, automation & licensing

Scheduled reconciliation
The Tenvero Mailbox Sync task runs on interval under a dedicated service account with certificate-based auth.
Guided Setup assistant
One-time configuration walks through Exchange, AD, Entra app and certificate steps separately from daily admin.
Optional ADUC integration
A single Tenvero property tab and right-click action inside Active Directory Users and Computers.
Responsive operation progress
A dedicated progress process keeps step text, elapsed time and theming live even while the Manager runspace is busy.
Signed offline licensing
MASTER, OFFLINE, ONLINE-ready and TRIAL license types enforced independently in both the UI and the background engine.
Diagnostics & logs
TLS, connectivity and dependency-version checks alongside rotating logs for every reconciliation run.