Hybrid Admin Panel / Setup & Use

Start with the runtime home, then define the environment.

HAP begins at the runtime home. From there, the operator selects or creates a profile, validates the configured providers, launches the runtime, and opens only the workflows supported by that environment.

Step 1 / Runtime home

See the active profile and launch readiness before entering a workflow.

The startup dashboard is the control point for the current session. It displays the selected runtime profile, operating mode, provider state, launch requirements, diagnostics, and the available operational workflows.

  • Select an existing profile or open the profile manager.
  • Review environment and provider readiness before launch.
  • Enter User Lookup, New User Wizard, or Device Manager from one starting point.
Hybrid Admin Panel startup dashboard showing runtime profiles, environment, provider status, launch requirements, diagnostics, and workflow buttons.
HAP runtime home

Step 2 / Runtime profile

Describe the organization and providers HAP will use.

The profile wizard keeps all environment-specific settings together. Use the steps below to review the current configuration flow without scrolling through six full-size screenshots.

01

Profile details

Name the profile and provide the organization, tenant, app registration, and certificate information used by cloud providers.

Runtime Profile Wizard profile step showing profile name, organization, tenant ID, application registration, and certificate fields.
Profile details

Step 3 / Launch

Initialize the providers, then choose the workflow.

Launching the runtime validates and initializes the configured providers. After that process completes, HAP presents the workflows available for the active profile.

Launching Runtime screen showing provider initialization and validation progress.
Provider initialization and validation
Choose Workflow screen showing User Lookup, New User Wizard, and Device Manager.
Workflow selection

Workstation requirements

Current PowerShell/WPF baseline

Windows

A Windows desktop environment with Windows PowerShell and WPF support.

Active Directory

RSAT Active Directory module for live domain operations.

Exchange Online

ExchangeOnlineManagement module for live Exchange Online operations.

App registration requirements

Permissions required for the full current cloud feature set.

HAP uses the tenant ID, application client ID, and a certificate-backed credential from the runtime profile. For app-only Graph authentication, HAP requests the tenant's .default scope, so the app registration must already contain the application permissions below and tenant-wide administrator consent must be granted.

Microsoft Graph Application permissions
User.Read.All

Search users and read full user profiles.

Directory.Read.All

Read directory data used for memberships, licensing context, and directory-role fallback queries.

AuditLog.Read.All

Read sign-in activity and the audit-log-backed authentication context displayed by HAP.

UserAuthenticationMethod.Read.All

Read registered authentication methods and MFA-related details.

RoleManagement.Read.Directory

Read role definitions, assignments, and PIM-related role information.

DeviceManagementManagedDevices.Read.All

Read Intune managed-device records for Device Manager. The tenant must have the applicable Intune service available.

IdentityRiskyUser.Read.All

Read the user's Identity Protection risk state. Microsoft documents the riskyUsers API as requiring Microsoft Entra ID P2.

Administrator consent: Required for all seven permissions.

Delegated-mode note: The current runtime requests the first six permissions as delegated scopes. IdentityRiskyUser.Read.All is additionally required by the risky-user endpoint but is not yet included in the current delegated scope request.

Office 365 Exchange Online Application permission + RBAC
Exchange.ManageAsApp

Required application permission for certificate-based Exchange Online PowerShell authentication.

Exchange RBAC assignment

The service principal must also receive Exchange roles that authorize the mailbox, mailbox-statistics, delegation, recipient-permission, distribution-group, and membership operations enabled for the deployment.

Least privilege: Exchange.ManageAsApp enables app-only connection but does not by itself authorize every cmdlet. Use a purpose-built Exchange role group where possible rather than a broad administrative role.

Certificate and registration checklist

  • Register the application in the customer tenant and record its Application (client) ID and Directory (tenant) ID.
  • Upload the public portion of the authentication certificate to the app registration.
  • Make the matching private-key certificate available to the HAP workstation by thumbprint or configured certificate path.
  • Grant administrator consent after the required Microsoft Graph and Exchange Online application permissions are added.
  • For delegated Graph operation, configure the six delegated scopes requested by the current runtime and use a registration that supports the localhost browser callback used by HAP. Risky-user enrichment additionally requires IdentityRiskyUser.Read.All; the current delegated scope request does not yet include it.
Microsoft references Microsoft Graph permissions reference ↗ Exchange Online app-only authentication ↗

Current feature availability

Availability follows provider capability and permission.

The matrix below describes the current PowerShell/WPF baseline. A configured provider may still return less information when a tenant, role, license, target object, or permission does not expose the requested data.

AreaPrimary sourcesCurrent roleImportant dependency
User LookupAD, Graph, Exchange Online, Exchange On-PremisesRead and selected administrationLoaded providers and operator permissions
New User WizardActive Directory, optional Exchange On-PremisesPlan, preview, create, assign groups, enable remote mailboxProfile mappings and execution rights
Device ManagerActive Directory, Microsoft GraphRead-oriented search and normalizationAvailable directory or managed-device data
Authentication contextMicrosoft GraphMethods, MFA posture, sign-in and related fieldsTenant permission and feature availability
Mailbox administrationExchange Online, Exchange On-PremisesForwarding, address-list, delegation, and distribution operationsRecipient type, provider capability, and rights

Authentication

Use the method appropriate to the provider and environment.

Active Directory

Integrated Windows authentication through the operator's current Windows context.

Exchange On-Premises

Kerberos or explicitly configured remoting authentication.

Microsoft Graph

Interactive delegated browser authentication or certificate-based app-only authentication.

Exchange Online

Certificate-based application authentication with Exchange Online application permission and RBAC.

Operational boundaries

What an evaluator should know before deployment.

  • The current product is pre-release and remains under active stabilization.
  • The PowerShell/WPF implementation is the current functional baseline.
  • Device Manager is presently read-oriented.
  • Some Graph identity, licensing, risk, role, and authentication fields depend on tenant permissions and licensed service availability.
  • HAP stores customer-controlled profiles, configuration, caches, logs, and diagnostics locally; these artifacts must be handled according to the customer's own data-protection requirements.