blackpoint-multi-tenant-operations

# Blackpoint Multi-Tenant Operations The CompassOne partner account sees every customer tenant. This skill covers the partner-level operating loop: enumerate tenants, sweep across them, and roll up into a portfolio view. ## Anti-triggers - **`blackpoint_partners_*`** — the partners domain is a stub. Partner scope comes from the token itself; `blackpoint_tenants_list` is the only enumeration that works. - **Investigating one detection** — the drill-down flow is `blackpoint-incident-response`; this skill is the sweep across tenants, not the deep dive within one. - **A tenant portfolio in another product** — M365 tenants are `cipp-tenants` or `inforcer-tenant-management`; Blumira client accounts are `blumira-msp`. A CompassOne tenant maps to none of them automatically. ## The Partner-Tenant Model ``` Partner (the MSP) └── Tenant (customer) ← blackpoint_tenants_list / _get └── Asset └── Detections / Vulnerabilities ``` Every partner-level operation starts the same way: enumerate tenants, then iterate. Never present partner output without tenant attribution on every row. ## API Tools | Tool | Purpose | |------|---------| | `blackpoint_tenants_list` | Enumerate customer tenants (filter by account, status, name search) | | `blackpoint_tenants_get` | Detail for one tenant | | `blackpoint_detections_list` | Detections — call once per tenant with `tenant_id` | | `blackpoint_vulnerabilities_list` | Vulnerabilities — call once per tena...