Docs

Admin guide

Every control in Redtrail answers one of four questions. This page walks through them in the order an administrator meets them.

1. Who can use it

• Entra app registration. Consent once, tenant-wide, to the Redtrail application. Delegated scopes: openid profile email. Files.ReadWrite is requested only when you enable history replay from SharePoint versions.
• Seats by group. Assign one or more Entra ID groups in the admin console. A person in a seat group can connect agents; a sign-in from an MCP client counts as a seat for billing.
• Agent and client allowlist. Choose which client types may obtain a grant: for example Claude Code and Copilot Studio yes, unknown clients no. Each grant is a named device shown to the user and in audit.
• Tenant on/off. The whole integration can be disabled with one switch; live sessions are terminated and new ones refused.

2. What it can touch

• Site and library allowlist. The add-in knows the document's SharePoint location; the relay refuses to open a session for a document outside the allowlist, with a clear message in the task pane and to the agent.
• Tracked changes rule. Automatic application of agent writes is only possible while change tracking is on in the document. This is enforced in the add-in and cannot be turned off by a user or by policy.
• Read auto-approval. By default, read tools (outline, read, search, list changes, history queries) are answered without a prompt and write tools queue for approval unless auto-apply is on. Tenant policy can require approval for reads as well.
• Fork policy. When a document copy is detected in an unattended session, the tenant default decides whether the copy forks the history or starts clean. The default is fork. Merging is never an option.

3. What it did

• Audit rows without content. Every operation produces a row: user, agent device, document id and location, operation type, anchor structure, timestamp, outcome, and its place in the per-document hash chain. No document text is in the audit stream on any tier.
• Export and push. CSV export from the console; webhook, Azure Event Hub and Log Analytics push; OpenTelemetry traces and logs that appear in Microsoft Agent 365 observability when the relay is registered there.
• Live session list. Every open add-in connection: who, which document, which agents are attached, since when.
• Change history (opt-in). The full per-change ledger with encrypted content fields, queryable by document, user, agent and time; log, blame, revert and replay from the task pane or the CLI. Region choice US or EU; retention as a tenant setting; export as JSONL; hard delete with a signed receipt.

4. How to turn it off

• Kill switches, one click each: tenant, user, session, agent grant. They act on live sessions immediately; pending writes in the affected sessions are marked refused rather than applied.
• Revoke a grant from the console or by removing the user from the seat group.
• Off-boarding: export all history, then delete all, and receive a receipt for each stream. On the Enterprise tier, revoking the customer-held key makes stored history unreadable immediately, including to us.

Deployment checklist

1. Consent to the Entra application; confirm the scopes match this page.
2. Create the tenant in the admin console; choose region and retention.
3. Assign seat groups and the agent allowlist.
4. Add the site or library allowlist for the pilot.
5. Deploy the add-in through Centralized Deployment to the pilot group.
6. Connect the audit stream to your SIEM.
7. Optionally register the relay with Agent 365 (see the quickstart) and approve it in the Microsoft 365 admin center.
8. Run the demo: an agent edits a document while two people are in it; changes appear as tracked revisions; review log, blame and revert in the task pane.

Not in the first release

SCIM provisioning, custom roles, per-document policy, an agent approval workflow, and a SOC 2 report are on the roadmap and are built on the first customer request. Ask us at [email protected].