Partner Center Bridge
v0.10.0 Signed Windows download →

Microsoft 365. On your desktop.

Many tenants.
One place to work.

Open the Windows app. Sign in with a tenant's Microsoft 365 admin account. Find a person, manage access, and work through everyday fixes with a clear record of what changed. Start with one tenant. Add more whenever you need them.

Download for Windows Run as a shared server (Docker)
  • v0.10.0 · Windows x64 · about 107 MB
  • Desktop app · no server setup
  • Signed by Joseph Spillers
  • SHA-256 checksum with every release
  • Free and open source (MIT)
Works with Microsoft Graph Partner Center (GDAP + SAM) Intune Exchange Online PowerShell Model Context Protocol

Your choice of connection

One tenant today. A whole customer list tomorrow.

Use each tenant's admin account, or connect your existing Microsoft partner organization.

Start here

Sign in to a Microsoft 365 tenant

Choose Add tenant with Microsoft. Microsoft opens sign-in in your browser; use that organization's admin account and approve the requested access. The tenant appears in your workbench.

Add another tenant the same way. Accounts are remembered with protected local token storage; tokens refresh silently when possible, with an account-specific reconnect when needed.

See the tenant sign-in flow → No partner membership, GDAP relationship, or customer app registration needed. Tenant consent and admin roles still apply.
Optional partner integration

Connect Partner Center

Already manage customers through CSP and GDAP? Connect your partner app and Secure Application Model credentials, then sync your customer list from Partner Center.

Keep delegated partner access alongside tenants connected with their own admin accounts.

See partner setup → Partner Center uses SAM/GDAP. Certificate-based Exchange workflows have their own setup.

Who it's for

Built for technicians who work across many Microsoft 365 tenants.

Most tickets are not hard. They are the same few problems, spread across dozens of customers and admin portals.

  • 01

    One portal at a time

    You know which tenant needs help, but finding a person or checking an app still means opening each tenant's admin portal separately.

  • 02

    Fixes repeated by hand

    The same MFA reset, access request or offboarding gets clicked through tenant by tenant, and each technician does it a little differently.

  • 03

    Little evidence afterwards

    When the ticket closes, the only record of what was checked and changed is whatever someone remembered to type into the notes.

Features

Organized around the job, not the admin portal.

Six areas (Home, People, Tenants, Operations, Activity and Settings) and a Ctrl+K palette that jumps to any person, tenant, fix or recent run.

People workspace

Everything about one person, in one place.

Search every active tenant at once, then open the person: summary, access, licensing, authentication, mailbox, devices and history, with every fix you can run for them.

  • Each section is read on its own, so one PCB can't read never blocks the rest.
  • Anything unavailable says so, with the reason and a link to what fixes it.
  • Disruptive actions are flagged, and preview-only without Operator on that tenant.
Read about Operations
Mirror access

Give someone the same access as a colleague. Additive only.

Pick the colleague and the person who needs their access. Access Parity shows every group it considered before anything changes, and it never removes a membership.

  • Eligible, already held, and not copied, each with the specific reason.
  • States plainly what it never compares: SharePoint direct permissions, direct app role assignments, mailbox and calendar permissions, Teams-only channels.
  • Re-plans on the server at apply time, then re-reads memberships to verify.
How Mirror access works
Offboarding

Offboard a leaver from a plan, not from memory.

Each contract carries an offboarding policy. Adjust it for one leaver if you need to, preview the ordered plan, and confirm the exact steps before anything runs.

  • Sign-in is blocked and sessions revoked first.
  • Licenses and groups wait for a verified shared-mailbox conversion, so a mailbox is never unlicensed before it is converted.
  • Steps it cannot perform yet are listed with the reason, not silently dropped.
How offboarding works
Evidence and ticket notes

Close the ticket with evidence, not a guess.

Every operation and known fix ends at the same evidence view, whether you just ran it or open it months later from Activity or the person's history.

  • The outcome follows what was verified: a write that does not read back shows as Verification failed, not Succeeded.
  • Failures and warnings first, then changes, verification, preflight and plan.
  • One button copies ticket notes; Markdown and JSON downloads keep the full record.
What evidence contains

Known fixes

MFA reset, password reset, compromised-account lockdown, license repair and mailbox archive repair. Each shows its diagnosis first, applies the fix step by step, then diagnoses again to confirm.

The workflow library

Intune app deployment

Upload an .intunewin template once and push it to the tenants you pick. Each tenant reports its own result. A redeploy updates the app in place and leaves its assignments alone.

Contracts and templates

Tenant audits read-only

Run a health check on a tenant: dormant licensed users, stale and inactive admin accounts, MFA gaps, guests, mailbox forwarding, Intune hygiene and sign-in protection. Each finding shows its evidence, and checks PCB can't run here say why. Export to CSV, JSON or Markdown.

Tenant audits

Config snapshots

Capture Conditional Access, Named Locations and Device Compliance policies, diff any two captures, export them, and optionally mirror them to a git repository. Read-only by design.

Config snapshots

MCP for AI agents human approval

An AI client can use the same operations a technician does over the Model Context Protocol. By default, anything it asks to change waits for a person to approve it.

MCP server

How it works

One loop for every change.

Whether it is a known fix or a planned operation, PCB never reports success on the strength of a write call alone.

  1. 1

    Diagnose

    Read the real state from Graph or Exchange Online and show every finding as-is. Nothing changes yet.

  2. 2

    Plan

    List every item considered, including what will not be touched and why, so you choose what to apply.

  3. 3

    Apply

    Re-plan on the server, then apply step by step in a safe order. Steps are idempotent, so re-running is safe.

  4. 4

    Verify

    Read every change back from Microsoft. Anything that does not read back is reported as not verified.

  5. 5

    Record

    Save who ran what, against which tenant, with the findings and results, ready to paste into the ticket.

Two shapes, one record. Known fixes run Diagnose → Fix → Verify. Planned operations such as Mirror access and offboarding run Plan → Apply → Verify. Both end in the same recorded run and evidence view.

Trust and safety

Careful by default, and honest about its limits.

PCB works with delegated admin access to your customers' tenants, so it is built to do exactly what it shows you, and to say when it cannot.

Additive-only access mirroring

Access Parity can only add the target to groups. It never removes a membership, and never copies dynamic, synced, role-assignable or mail-enabled groups.

Verified before it says success

Every change is re-read from Graph or Exchange Online. A change that does not read back is reported as Verification failed.

Loopback-only on your PC

The Windows program listens on this machine only, with pinned allowed hosts and a DPAPI-protected key ring. Being on localhost is never treated as a credential.

Per-tenant roles

Viewer, Operator and Owner are granted per tenant. Viewers plan, Operators apply, and even an instance Administrator cannot bypass a tenant's grants.

An audit trail for everything

Sign-ins and every change to users, tenants, contracts, templates, deployments and grants are recorded, alongside the full history of every run.

Open source, MIT licensed

Read every line on GitHub. Nothing is installed in customer tenants, and data stays where you run it, apart from calls to Microsoft and any webhook or git sync you configure.

What it does not do (yet)

  • Mirror access compares direct group memberships and directory roles only. SharePoint direct permissions, direct app role assignments, mailbox and calendar permissions and Teams-only channels are not compared.
  • Win32 in-place updates are tested against mocked Graph and have not yet been run against a live tenant.
  • Two-way LDAP sync is planned and not implemented.
  • The MCP server has no OAuth discovery yet; you mint a personal access token.

What it needs from you

  • A Microsoft 365 tenant admin account and consent for the operations you use. Add each organization through Microsoft sign-in.
  • For optional partner access: your CSP partner app, customer GDAP relationships, and a one-time SAM bootstrap.
  • For mailbox features: PowerShell 7, the ExchangeOnlineManagement module and an app-only certificate.
  • 64-bit Windows and Microsoft Edge WebView2 Runtime for the desktop app. Only win-x64 is published; other platforms can run it as a server.

Maturity

Where each feature stands.

Status as the project tracks it. Planned means no code exists yet, and this page will say so until it ships.

CapabilityStatus
Win32 .intunewin deploy across tenants, with in-place updatesStable
Contract-driven new-hire provisioning and offboardingStable
Cross-tenant person search with per-person fix shortcutsStable
Person workspace (profile, licenses, groups, auth, mailbox, devices, history)Beta
Mirror access (Access Parity), additive onlyBeta
Offboarding policy per contract, with ordered plan, apply and verifyBeta
Evidence on every planned operation (JSON, Markdown, ticket notes)Beta
Known fixes: MFA reset, password reset, compromised lockdown, license repairBeta
Mailbox archive repair via Exchange Online PowerShellBeta
Config snapshots, diff, export and optional git syncBeta
Local Workbench: the single Windows program with SQLite and local accountsBeta
MCP server with a per-tenant human approval queueBeta
Two-way LDAP syncPlanned

Tests run against mocked Microsoft APIs, so no tenant is needed to run them. Win32 in-place updates have not yet been exercised against a live tenant.

Get started

Up and running in minutes.

A Windows desktop app and a Microsoft 365 tenant admin account. Add partner integration whenever you need it.

  1. Step 1

    Download and verify

    Get PartnerCenterBridge-v0.10.0-win-x64.zip from GitHub Releases and check it against the published .sha256.

    Get-FileHash .\PartnerCenterBridge-*.zip
  2. Step 2

    Open the desktop app

    Unzip and double-click PartnerCenterBridge.exe. The workbench opens in its own window. Create a local account, or choose to use it without an account on your secured computer.

    Microsoft Edge WebView2 Runtime is required; the app guides you if it is missing.

  3. Step 3

    Add your first tenant

    Open Tenants, choose Add tenant with Microsoft, and sign in with that tenant's admin account. Repeat for each organization you administer.

    Using Partner Center? Connect it as an optional integration.

More screens

A closer look.

Captured from the real web app with mocked data, so they track the current UI. Select one to enlarge it.

  • Person-first searchEvery active tenant at once. Unreachable tenants are listed, not hidden.
  • Tenants and contractsAdd tenants through Microsoft sign-in, or sync your partner customer list.
  • Ctrl+K paletteJump to any page, person, tenant, fix or recent run.
  • Your tenants, their admin accountsConnect each Microsoft 365 organization through Microsoft sign-in. Partner integration is optional.

FAQ

Common questions.

Something missing? Open an issue on GitHub.

What do I need to run it?

64-bit Windows with Microsoft Edge WebView2 Runtime. The download is self-contained, so there is no .NET, database or web server to install. Only a win-x64 build is published; on other platforms, run it as a server with Docker.

Connect Microsoft 365 tenants with their own admin accounts using Add tenant with Microsoft. Microsoft handles sign-in, MFA and tenant consent. For MSPs, Partner Center/GDAP is a separate optional connection.

Where does my data live?

On your machine, under %LOCALAPPDATA%\PartnerCenterBridge: a SQLite database, the encryption key ring, logs and uploaded app packages. The key ring is protected with Windows DPAPI for your user and encrypts the SAM refresh token. A folder the program creates is restricted to your Windows user where Windows allows it.

On a server, data lives in your PostgreSQL database and the volumes you provide. If you turn on git sync, config snapshots are also pushed to the repository you configure.

Is it safe to point at customer tenants?

It can only do what your signed-in admin role or GDAP delegation and the app's consented permissions allow, and it installs nothing in customer tenants. Changes are planned and shown first, applied in a safe order, and verified by reading them back. Mirror access is additive only. Every run is recorded with who ran it.

Treat the SAM refresh token like a domain-admin credential for every customer: it is stored encrypted, but keep the machine or server that holds it secured. See SECURITY.md.

Do I have to create an account on my own PC?

No. Creating an administrator account is recommended, but on first launch the Windows program also offers Skip — use without an account on this computer, for a machine that is already secured (screen lock, disk encryption, no shared Windows account). It then opens with a single-use launch link from the running exe. The link expires after two minutes; run the exe again for a fresh one. You can add a password later from Settings > Account & security > Protect with an account.

This option grants instance Administrator and no tenant access until it adds one. It is not available in server or Docker mode, and first run refuses to offer it when the program is exposed to the network with --listen. More detail.

What about Exchange Online?

Mailbox features (mailbox archive repair, and converting or forwarding a leaver's mailbox) need PowerShell 7, the ExchangeOnlineManagement module and an app-only certificate. Everything else works without them. When a piece is missing, the affected section says Unavailable with the reason, and PartnerCenterBridge.exe doctor prints the exact fix.

Should I use the Windows program or Docker?

Use the Windows program if you are one technician working from your own PC. It needs no server and stays on the loopback address.

Use Docker or Kubernetes if your team wants one shared instance with one audit trail, sign-in through your own OIDC provider, and PostgreSQL. Both run the same code and features. See Run as a server.

What does it cost?

Nothing. Partner Center Bridge is free and open source under the MIT license. If you want it built out or connected to the rest of your tools, Spillers Technology can help.

Is this a Microsoft product?

No. Partner Center Bridge is an independent open-source project from Spillers Technology. It is not affiliated with, sponsored by, or endorsed by Microsoft.

Try it on your next ticket.

Open the signed Windows desktop app, add your first Microsoft 365 tenant, and see the plan before anything changes.

Download for Windows View on GitHub