Hoxhunt MSP Portal — Engineer Wireframe

Active Customers

45

+3 this month

Total Licensed Seats

8,420

of 10,000 pool

Avg. Simulation Pass Rate

78%

+2.1% vs last month

Customers Needing Attention

4

sync failures, low engagement

All Customers

Sorted by health status — issues first

Customer	Status	Seats	Tier	Pass Rate	Last Campaign
Eklund Bygg AB eklundbygg.se	Sync Failed	85 / 100	Pro	—	Never
Finnmark Shipping Oy finnmarkshipping.fi	Email Unverified	210 / 250	Enterprise	61%	12 days ago
Helsingborg Medical Group hbgmedical.se	Low Engagement	340 / 400	Enterprise	52%	28 days ago
Polar Energi AS polarenergi.no	Setup Incomplete	0 / 150	Pro	—	Never
Vestland Accounting vestlandaccounting.no	Active	42 / 50	Starter	88%	3 days ago
KopparTech Solutions koppartech.se	Active	120 / 150	Pro	81%	5 days ago
Luleå Transport AB ltransport.se	Active	75 / 80	Pro	79%	7 days ago
Nordhavn Consulting nordhavn.dk	Active	58 / 60	Starter	84%	2 days ago

Showing 8 of 45 customers

Dashboard data served by the cross-tenant analytics aggregation API. Health statuses derived from: sync status (provisioning API), email verification status, campaign recency, and simulation pass rate thresholds. All queries are MSP-scoped via the identity layer — no cross-MSP data leakage possible by design.

1 Create Tenant

2 Licenses

3 User Provisioning

4 Email Config

5 Branding

6 Review & Launch

Customer Details

Basic information to provision the tenant. The organization will be created immediately.

Organization Name

Primary Domain

Must match the domain in the customer's email environment.

Country

Timezone

Data Residency Region

Cannot be changed after creation. Data will be stored in this region per GDPR requirements.

Internal Reference / PO Number

Tenant creation is an async operation. The API accepts the request, returns a tenant ID and provisioning job ID immediately. Actual provisioning (DB schema, storage bucket, config seeding) happens server-side in ~10-30 seconds. The wizard shows a progress indicator, then auto-advances once the status endpoint returns "ready". If provisioning fails, the user sees a clear error and can retry. Data residency selection determines which regional cluster the tenant is provisioned in — this is irreversible by design.

Provisioning Tenant...

Creating Saimaa Digital Oy in the EU (Frankfurt) region.

✓

Request accepted

Tenant ID: tnt_7f3a2b1c · Job ID: job_9e4d5f8a

Creating database schema and storage...

In progress

Seeding default configuration

Waiting

Tenant ready

Waiting

The wizard polls GET /v1/provisioning/jobs/{job_id} every 2 seconds. Each step transition triggers a UI update. If polling returns an error state, a retry button appears. Timeout at 60 seconds shows a "taking longer than expected" message with a link to continue setup later — the tenant will appear in the dashboard with a "Provisioning" badge.

Product Tier & Licenses

Assign a product tier and allocate seats from your license pool.

ℹ Your license pool: 1,580 seats available of 10,000 total (8,420 allocated across 45 customers).

Product Tier

Tier determines which features are available to this customer. Can be changed later.

License Seats

Number of employee accounts. After allocation: 1,460 seats remaining in pool.

License allocation calls POST /v1/licenses/allocate which atomically decrements the pool and sets the tenant limit. The API rejects if requested seats exceed available pool (no over-provisioning). Seat count is a soft cap — if user sync imports more users than licensed, excess users are marked "unlicensed" and excluded from campaigns rather than blocking the sync. This avoids a hard failure during IdP provisioning.

User Provisioning

Connect the customer's identity provider to sync employee accounts automatically.

◎

Azure AD / Entra ID

SCIM 2.0 provisioning

◉

Okta

SCIM 2.0 provisioning

●

Google Workspace

Directory sync via API

Azure AD Setup Instructions

✓

1. Copy SCIM endpoint URL


                        https://scim.hoxhunt.com/v2/tnt_7f3a2b1c

✓

2. Copy Bearer Token


                        ••••••••••••••••••••f8a2b1

3

3. In Azure Portal, create Enterprise Application for SCIM

Navigate to Azure AD > Enterprise Applications > New > Non-gallery. Paste the SCIM URL and token above into the Provisioning settings.

4

4. Configure group filter (recommended)

Assign the Azure AD group containing the customer's employees. Do not sync "All users" — this may include your MSP's own staff.

⚠ Common mistake: Syncing users from your own MSP directory instead of the customer's. The portal will flag this if synced user emails don't match the tenant domain (saimaadigital.fi).

"Test Connection" calls POST /v1/tenants/{id}/provisioning/test which attempts a SCIM ListUsers with count=0 to verify credentials. On success, it returns user count and a domain distribution. The domain mismatch check compares synced user email domains against the tenant's configured domain — this catches the #1 MSP provisioning mistake. Full sync only runs after the MSP clicks "Continue" and is processed async with status polling.

Email Environment Configuration

Ensure phishing simulations reach employee inboxes. This requires changes in the customer's email environment.

ℹ This step requires configuration in the customer's mail environment (Microsoft 365 or Google Workspace). The checklist below guides you through each layer. Use "Send Test" to verify.

✓

Mail Flow Transport Rule

Bypass spam filtering for Hoxhunt sender IPs in Exchange Online mail flow rules.

✓

Connection Filter (IP Allow List)

Add Hoxhunt IPs to the connection filter allow list in Exchange Online Protection.

!

Third-Party Spam Filter (Mimecast detected)

Customer uses Mimecast as an additional spam filter. You must also allowlist Hoxhunt IPs in Mimecast.

Incomplete — this layer will block simulations if not configured

4

Report Button Deployment

Deploy the Hoxhunt report button add-in to the customer's Outlook environment.

Delivery Verification

"Send Test Simulation" calls POST /v1/tenants/{id}/email/verify which sends a tagged test email through the full delivery chain. The backend tracks delivery via mail flow logs and return-path analysis. Each filter layer is tested independently. Results typically arrive in 5-30 seconds (async polling). The "Mimecast detected" label comes from MX record analysis during tenant creation — we auto-detect the customer's mail stack. Campaign launch is gated on this verification: tenant.email_verified = true is a precondition for POST /v1/campaigns.

Branding & Customization

Customize the training experience for the customer's employees.

Company Logo

Drop logo here or click to upload
PNG or SVG, max 2MB. Recommended: 200x60px

Primary Brand Color

Used in training emails, landing pages, and the report button.

Training Language

Primary language for training content. Employees can override in their profile.

Branding is a simple CRUD operation on the tenant config. Logo is uploaded to the tenant's storage bucket. These are purely cosmetic settings with no complex dependencies — safe to include in the wizard but also fully editable later from the customer settings page.

Review & Launch

Confirm the setup for Saimaa Digital Oy before going live.

Tenant

OrganizationSaimaa Digital Oy

Domainsaimaadigital.fi

Country / TimezoneFinland / Europe/Helsinki

Data ResidencyEU (Frankfurt)

Tenant IDtnt_7f3a2b1c

Product & Licenses

TierPro

Licensed Seats120

User Provisioning

Identity Provider Azure AD (SCIM 2.0) Connected

Users Synced108 of 120 seats

Domain Match100%

Email Environment

Delivery Verification Partial — Mimecast not configured

Report ButtonNot deployed

Branding

LogoNot uploaded

Brand Color#2563eb

LanguageFinnish

⚠

Email delivery is not fully verified. The tenant can be activated, but campaigns will be blocked until the Mimecast layer is configured and a delivery test passes.
You can complete this from the customer's settings page at any time.

ℹ

What happens next: The tenant will appear in your dashboard as "Active — Setup Incomplete" with a checklist showing remaining items (Mimecast config, report button, logo). Campaigns are unlocked once email verification passes.

"Activate Tenant" calls POST /v1/tenants/{id}/activate which flips the tenant state from "provisioning" to "active". This is idempotent. The incomplete setup items are tracked as a checklist in the tenant config (tenant.setup_checklist) and surface in the dashboard. The campaign launch gate is a separate enforcement: tenant.email_verified must be true. This decouples "tenant is usable" from "campaigns can send" — the MSP can continue configuring without being fully blocked.

Total Pool

10,000

Allocated

8,420

84.2%

Active Users

7,834

93% of allocated

Available

1,580

Over-allocated

0

No overages

Pool Utilization

84.2% allocated

7,834 active / 8,420 allocated

License Allocation by Customer

Customer	Tier	Allocated	Active Users	Utilization	Status
Helsingborg Medical Group	Enterprise	400	340	85%	OK
Finnmark Shipping Oy	Enterprise	250	210	84%	OK
Polar Energi AS	Pro	150	0	0%	No users
KopparTech Solutions	Pro	150	120	80%	OK
Eklund Bygg AB	Pro	100	85	85%	Sync failed
Luleå Transport AB	Pro	80	75	94%	Near limit
Nordhavn Consulting	Starter	60	58	97%	At limit
Vestland Accounting	Starter	50	42	84%	OK

License pool data from GET /v1/msp/{id}/licenses/summary and GET /v1/msp/{id}/licenses/by-tenant. The "active users" count comes from the provisioning system (users with status=active). Over-allocation prevention is enforced server-side: POST /v1/licenses/allocate returns 409 if requested seats exceed available pool. "Near limit" threshold is configurable (default: 90%). "At limit" means active users >= 95% of allocated — triggers a proactive alert suggesting the MSP increase allocation before user sync imports more.

See the Portfolio Dashboard for the customer list view.

Portfolio Dashboard

New Customer Setup

Tenant

Product & Licenses

User Provisioning

Email Environment

Branding

License Pool

Customers