Docs / Get started

Get started

Partner Center Bridge ships as one signed Windows desktop app. Download it, double-click it, create a local account (or skip it on an already-secured machine), and add a Microsoft 365 tenant with its admin account. There is no server, database or identity provider to set up first. If your team wants one shared instance instead, see Run as a server.

Requirements

• 64-bit Windows (x64). The release is self-contained, so you do not need to install .NET. Only a win-x64 build is published. There is no macOS or Linux executable.
• Microsoft Edge WebView2 Runtime. The desktop window uses it to show the app. If missing, the app shows an installation hint. A current browser remains useful for Microsoft account sign-in and the optional browser/tray mode.
• To connect a tenant: its Microsoft 365 admin account, the roles needed for your operations, and permission to consent under that organization's policy. The Windows app includes its sign-in registration. CSP/GDAP is an optional alternative. See Connect Microsoft.
• For mailbox features only: PowerShell 7, the ExchangeOnlineManagement module and an app-only certificate. Everything else works without them. See Exchange Online.

1. Download and verify

From the latest release, download PartnerCenterBridge-v0.10.0-win-x64.zip and the .sha256 file published next to it. Before you unzip, check that the hash matches. In PowerShell, from the download folder:

$zip = "PartnerCenterBridge-v0.10.0-win-x64.zip"
$expected = (Get-Content "$zip.sha256" -Raw).Trim().Split()[0]
(Get-FileHash $zip -Algorithm SHA256).Hash -eq $expected   # True means the zip is intact

The executable is Authenticode-signed by Joseph Spillers. After unzipping you can confirm the signature in the file's Properties › Digital Signatures tab, or run:

Get-AuthenticodeSignature .\PartnerCenterBridge.exe | Format-List Status, SignerCertificate

If you would rather build it yourself, ./scripts/publish-local.ps1 produces the same single-file exe from source. See Local Workbench: building it.

2. Run it

Unzip to a folder of your choice and start the program:

.\PartnerCenterBridge.exe

On first launch it creates its data folder, sets up its SQLite database, and opens the workbench in its desktop window. Close the window to stop the local API. Launching the exe a second time brings the existing window forward. Use --browser for the classic browser/tray mode.

3. First launch: create the administrator

A new install has no accounts, so the first screen asks how you want to use it:

• Create an administrator account (recommended). The first account you register becomes the instance Administrator. After that you sign in with a passkey (once you register one under your account's Security settings) or your password, and you can add TOTP two-factor authentication. Anyone else who registers later starts with no access until you share tenants with them. See Authentication.
• Skip — use without an account on this computer. An explicit choice for a machine that is already secured: screen lock, disk encryption, and no shared Windows account. The desktop window receives a single-use setup link. After choosing this option, it uses a single-use sign-in link that expires after two minutes; run the exe again for a fresh one. Opening a bookmark later just tells you to start it from PartnerCenterBridge.exe again. Registering a password, a passkey, or TOTP is blocked until then; MCP access tokens still work. Add a password anytime from Settings > Account & security > Protect with an account.

You land on Home. Its Finish setting up card lists only what still needs attention, such as the Microsoft connection, a tenant without GDAP delegation or the Exchange module, and links each item to the screen that fixes it.

4. Connect Microsoft

Add a tenant with its admin account

The Windows desktop app can connect directly to one Microsoft 365 organization, or several. You do not need Partner Center, a CSP membership, a GDAP relationship, or your own app registration for this flow. The publisher's multitenant sign-in registration is included.

1. Open Tenants and choose Add tenant with Microsoft. The same button is in Settings > Microsoft connections.
2. Sign in through Microsoft's system-browser prompt with the organization's admin account, complete MFA if requested, and approve consent according to its policies.
3. Return to the desktop app. The connected tenant is now available to administer. Repeat Add tenant with Microsoft for another organization.

Each account's token cache is protected locally and survives restarts. Tokens renew silently when possible. If Microsoft requires interaction again, use that connection's reconnect action to sign back in with the remembered account. Access still depends on consent, tenant policy, and the signed-in admin's roles. Some organizations restrict unverified publishers.

Direct sign-in covers Microsoft Graph operations. Exchange Online certificate authentication remains separate; see Exchange Online setup below.

Optional: connect your partner organization

If you use CSP, the bridge also supports your existing partner setup. It reaches each tenant through your GDAP relationship and a multi-tenant app under the Secure Application Model. Nothing is installed in the customer tenant.

{
  "Partner": {
    "ClientId": "<application (client) id of the multi-tenant app>",
    "ClientSecret": "<client secret>",
    "PartnerTenantId": "<your partner tenant id>"
  }
}

.\PartnerCenterBridge.exe bootstrap-sam

5. Add your customer tenants

Open Tenants and choose Add tenant with Microsoft to connect an organization through its admin account. If you configured the optional partner integration, choose Sync from Partner Center to pull in your customer list. Adding tenants is an Administrator task, and the Administrator who adds a tenant becomes its Owner. Each tenant shows its connection status. GDAP delegation applies to partner-connected tenants; directly connected tenants use the signed-in admin's consent and roles.

To give colleagues access on the same instance, share a tenant with them as Viewer, Operator or Owner. Even an instance Administrator cannot bypass these per-tenant grants.

Optional: Exchange Online

Mailbox operations (mailbox archive repair, and converting or forwarding a leaver's mailbox during offboarding) run through Exchange Online PowerShell, out of process. They need three things, and the app says which one is missing instead of failing silently. In the Windows Local Workbench, an instance Administrator can install the first two from the Home setup checklist or Settings after confirming; the commands below remain available for manual setup:

1. PowerShell 7 (pwsh) on PATH, or its path in Exchange:PwshPath.
2. The ExchangeOnlineManagement module installed for it:

   pwsh -c "Install-Module ExchangeOnlineManagement -Scope CurrentUser"

3. An app-only certificate: set Exchange:AppId in pcb.local.json, then either import the certificate into Cert:\CurrentUser\My and set Exchange:CertificateThumbprint (preferred on Windows -- no certificate secret is handled by the app), or place the PFX at certs\exo.pfx in the data folder and set Exchange:CertificatePath (plus Exchange:CertificatePassword if it's protected; that password reaches pwsh only over standard input, never a temporary file). The app needs Exchange.ManageAsApp and the Exchange Administrator role.

Run .\PartnerCenterBridge.exe doctor afterwards. The pwsh, exchange-module and exchange-app checks should all pass. Full detail: Exchange Online as an optional dependency.

The Exchange organization is read from Microsoft Graph for that tenant (its verified initial *.onmicrosoft.com domain, checked against the tenant's own Entra id) the first time an Exchange operation runs, so the Graph connection has to work for that tenant too. If the connection ever answers for a different organization, the operation is refused and nothing is changed.

Your first session

1. Find a person. Search from Home or People across every active tenant and open their workspace: summary, access, licensing, authentication, mailbox, devices and history.
2. Run a known fix. MFA reset, password reset, compromised-account lockdown, license repair or mailbox archive repair. Each one shows its diagnosis before anything changes. See Workflows.
3. Mirror access or offboard someone. Review the plan, apply what you choose, and copy the ticket notes from the evidence view. See Operations.
4. Set up a contract. Group tenants into a contract, add an app template (an .intunewin from the Microsoft Win32 Content Prep Tool) or provisioning defaults (licenses, groups, UPN domain), and deploy.
5. Take a config snapshot (optional). Back up Conditional Access, Named Locations and Device Compliance policies for a tenant and diff any two captures. See Config snapshots.

Prefer Docker or a shared server?

The same app also runs as containers (Postgres, the API and the web app) for teams that want one shared instance, with sign-in through your own OIDC provider or local accounts. Docker Compose with the published ghcr.io images is the quickest way to evaluate it, and the repository includes a Kustomize template for Kubernetes. See Run as a server.