Draft saved automatically — you can close and resume anytime
Draft
Create Customer Tenant
Enter the basic details for this customer. The tenant will be provisioned instantly upon completion.
Ops note: Use the customer's legal entity name — this appears on compliance reports and cannot be changed without contacting Hoxhunt support. The display name can be changed anytime.
Legal entity name. Used in reports and audit logs.
Shown in your portfolio dashboard. Optional.
Used to validate synced users. We check this domain is not registered to another organization.
This domain is already associated with an existing Hoxhunt tenant. Contact support if this is unexpected.
✓ Domain available
Optional. Add if the customer uses multiple email domains.
Determines data residency region (EU or US) and default language.
Simulations deliver during 8 AM–6 PM in this timezone. Critical: setting wrong timezone is a common setup mistake.
Default language for simulations and training. Per-user override available via IdP attribute.
For your own billing/project tracking. Not visible to end users.
Assign Product & Licenses
Select the product tier and allocate licenses from your pool for this customer.
Your License Pool
NordTech Solutions — Master Agreement NT-2024-001
Total Pool
5,000
Allocated
4,230
Available
770
770 licenses remaining. 2 other setups in progress may claim ~200 additional seats.
150 of 770 available licenses.
Exceeds available licenses. Reduce count or request additional licenses from Hoxhunt.
Hoxhunt Premium — Features Included
✓ Automated phishing simulations
✓ Adaptive difficulty per user
✓ Training course library
✓ Report button (Outlook + Gmail)
✓ Custom simulation templates
✓ Department-level analytics
✗ API access (Enterprise only)
✗ Advanced reporting (Enterprise only)
Configure User Provisioning
Choose how users will be synced into this customer's Hoxhunt tenant.
Common mistake: Make sure you connect your customer's directory, not your own MSP directory.
We'll validate synced emails against the configured domain meridianhealth.com and flag mismatches.
Azure AD
SCIM / Entra ID
Okta
SCIM provisioning
Google Workspace
Directory sync
CSV Upload
Manual import
Azure AD SCIM Setup
Complete these steps in your customer's Azure portal. Check each when done.
1. Copy the SCIM Tenant URL
Paste into Azure AD → Enterprise Applications → Hoxhunt → Provisioning → Tenant URL
https://scim.hoxhunt.com/v2/orgs/mhg-9f3a2
📋 Copy
2. Copy the Secret Token
Paste as the Secret Token. Expires in 180 days — you'll be notified 14 days before expiry.
hxt_scim_9f3a2_Kj82mNpQ••••••••
👁 Reveal
3. Configure attribute mapping
Map:
userPrincipalName → email, displayName → name, department → department, preferredLanguage → language4. Assign the correct user group
In Azure AD, assign users/groups to the Enterprise Application. Only assigned users will sync.
5. Start provisioning in Azure
Click "Start provisioning" in Azure AD. Initial sync takes 20–40 min for large directories.
Sync Status
Waiting for initial sync from Azure AD...
Click "Test Connection" to verify your SCIM endpoint is reachable.
Click "Test Connection" to verify your SCIM endpoint is reachable.
Testing SCIM connection...
Connected
Last sync: 2 seconds ago
143 users synced
141 domain matched
2 domain mismatch
2 users have email domains that don't match meridianhealth.com:
These appear to be MSP staff accounts synced by mistake. They will be excluded from simulations automatically.
admin@nordtech.fi, j.virtanen@nordtech.fiThese appear to be MSP staff accounts synced by mistake. They will be excluded from simulations automatically.
Configure Email Environment
Allowlist Hoxhunt so simulation emails reach user inboxes. This is the #1 cause of failed first campaigns.
40% of first-time setups fail at this step. The most common cause is configuring only one email filtering layer when the customer has multiple (e.g., M365 + Mimecast).
Complete every checklist item and run the delivery test before proceeding.
If the customer uses a third-party gateway, you must configure allowlisting there too.
Allowlisting Checklist — Microsoft 365
1. Add Hoxhunt sending IPs to Connection Filter
Exchange Admin → Mail Flow → Connection Filtering → IP Allow List
185.26.97.0/24, 185.26.98.0/24, 52.178.167.0/24
📋 Copy
2. Create Transport Rule to bypass spam filtering
Condition: sender IP in above ranges AND header
X-Hoxhunt-Sim: true → Action: Set SCL to -1.3. Add Hoxhunt domains to Safe Senders
Allow:
*.sim.hoxhunt.com and *.training.hoxhunt.com4. Disable Safe Links URL rewriting for Hoxhunt
Defender Safe Links rewrites URLs and can break click-tracking. Create an exception for Hoxhunt domains.
5. Deploy the Hoxhunt Report Button
Deploy via M365 Centralized Deployment or Intune. Verify it appears in users' Outlook ribbon.
📧 Email Delivery Test
Sends a test simulation and verifies delivery across all filtering layers.
No test sent yet. Configure the checklist above, then run this test.
Sending test simulations... typically 30–60 seconds.
test.user@meridianhealth.com | Delivered to inbox | 1.2s |
sarah.johnson@meridianhealth.com | Caught by spam filter | 1.4s |
1 of 2 emails was spam-filtered. This usually means the M365 transport rule (step 2) wasn't applied correctly.
Check that the SCL override rule is active and re-test. Campaigns will be blocked until delivery rate reaches 80%+.
Apply Branding
Customize how Hoxhunt looks to this customer's employees in training and simulation emails.
📤
Drop PNG or SVG here, or click to browse
Recommended: 200×60px, transparent background, under 500KB
Buttons and accents
We'll check contrast ratio. Minimum 4.5:1 against white text for accessibility.
Appears as the "From" name on simulation emails. Use something the customer's users will recognise.
Meridian Healthcare Group
Security Awareness Training
Welcome to your training portal. Complete the assigned modules to build stronger phishing awareness.
Start TrainingApproximate preview of the end-user training interface with your branding.
Want to co-brand with your MSP logo? Configure your MSP-level branding in Settings → MSP Branding — it will appear alongside each customer's logo.
Review & Create Tenant
Review everything below. You can modify any setting from the customer's detail page after creation.
Setup Readiness
4 of 5 ready
Ready Tenant information
Ready Product & licenses (150 Premium)
Ready User provisioning (143 users synced)
Partial Email delivery (1/2 tests passed)
Ready Branding configured
Email delivery is partially configured. You can create the tenant now, but campaign launches will be blocked until email delivery passes verification (80%+ delivery rate). This is a safety gate to prevent wasted campaigns.
Configuration Summary
Organization NameMeridian Healthcare Group
Primary Domainmeridianhealth.com
Country / RegionUnited States (US data residency)
TimezoneAmerica/New_York (UTC-5)
LanguageEnglish
Product TierHoxhunt Premium
Licenses Allocated150 seats (from pool of 770 available)
User ProvisioningAzure AD SCIM — 143 users synced, 2 domain mismatches excluded
Email PlatformMicrosoft 365 (no third-party gateway)
Delivery TestPartial — 1/2 delivered (campaign launch blocked)
BrandingCustom — Meridian Healthcare logo + #0066CC
ReferenceNT-2026-0347
✅
Tenant Created Successfully
Meridian Healthcare Group is now live in your portfolio.
Recommended Next Steps
Fix
Resolve email delivery — re-check M365 transport rule and re-test
Next
Configure first phishing simulation campaign (available once email passes)
Next
Assign an onboarding training course to all 143 users
Later
Set up recurring campaign schedule
Setup time: ~8 minutes (previous average without portal: 10–14 business days).
This setup is logged in your audit trail.
Tenant Health & Diagnostics
Proactive monitoring across your portfolio. This view replaces ~35 support tickets/month by surfacing issues before MSPs have to report them.
Total Customers
47
+3 this month
Healthy
38
All checks passing
Needs Attention
6
Config or delivery warnings
Critical
3
Simulations blocked or sync broken
Active Issues
9 issues across 9 customers — sorted by severity
| Customer | Issue | Severity | Detected | Impact | |
|---|---|---|---|---|---|
| Greenfield Logistics | Email delivery rate dropped to 31% | Critical | 2h ago | 69% of users not receiving simulations | |
| Apex Financial Services | SCIM sync failing — bearer token expired | Critical | 1d ago | New hires not being provisioned | |
| Meridian Healthcare Group | Email delivery partially configured | Critical | Just now | Campaign launches blocked | |
| Summit Education Group | License utilization at 112% (12 over) | Warning | 3d ago | Billing overage accruing | |
| Coastal Engineering Ltd | No campaign activity in 45 days | Warning | Ongoing | Users losing training momentum | |
| Brightstar Retail | 2 unexpected domain mismatches in sync | Warning | 5d ago | Possible wrong-directory sync | |
| Nordic Manufacturing Co | Report button missing for 18 users | Warning | 2w ago | 18 users can't report phishing | |
| Alpine Security Group | SCIM token expires in 12 days | Warning | Today | Sync will break if not renewed | |
| Lakeside Partners | Training completion stalled at 34% | Warning | 1w ago | Due in 8 days, 66% incomplete |
Automated Health Checks
Runs every 6 hours · Last run: 14 min ago
Email Delivery Rate47/47 checked
User Sync Status42/42 IdP tenants
License Utilization47/47 checked
Campaign Activity47/47 checked
SCIM Token Expiry42/42 SCIM tenants
Report Button Deployed47/47 checked