Dockli is provisioned per organization — against a purchase order placed directly with the Dockli team — and then activated by a single, tenant-wide approval from one of your administrators. After that, access is controlled entirely by a Microsoft Entra security group you own, and the app installs per-user with no admin rights.
This page is the map. Each step links to a dedicated article with the exact clicks.
The rollout at a glance
| # | Step | Who does it | Result |
|---|---|---|---|
| 1 | Approve tenant-wide admin consent | Your Global Administrator | Tenant bound, licence goes Active |
| 2 | Create the access group and add people | Your admin | Group membership = who holds a seat |
| 3 | Distribute the per-user installer | Your admin (or each user) | Dockli appears in File Explorer |
| 4 | Users sign in | Each user | Seat claimed, Dockli ready — no consent prompt |
Prerequisites
| Requirement | Detail |
|---|---|
| An order | A Dockli order placed directly with the Dockli team on a purchase order. This sets your seat count and plan tier (Essential or Spark). |
| A Global Administrator | Only a Global Administrator can grant the one-time tenant-wide consent that activates Dockli. |
| Permission to manage a group | Whoever manages access needs rights to add and remove members on a Microsoft Entra security group. |
| Client machines | Windows 10 or Windows 11, 64-bit, with the Edge WebView2 runtime (ships with current Windows). No local admin rights and no .NET install needed — the installer is self-contained. |
| Network | Outbound HTTPS to Microsoft 365 and Dockli services. See Endpoints to allowlist. |
Step 1 — Approve tenant-wide admin consent
The Dockli team emails your Global Administrator a consent link. Opening it, reviewing the requested Microsoft Graph permissions, and approving binds your tenant and flips your licence to Active. This is the activation trigger — nothing works until it’s done, and once it’s done your users never see a consent prompt of their own.
Full walkthrough, including the user-facing “needs admin approval” experience if someone signs in before consent lands: Tenant-wide admin consent.
Step 2 — Create the access group and add people
Right after consent, the approval success page offers a one-click Create access group button (you can rename the group first). This creates — or reuses — a Microsoft Entra security group and points your licence at it.
From then on, group membership is the seat list: add a user to the group and they can claim a seat; remove them and their seat is released. Add exactly as many people as you have purchased seats.
Details on sticky seat assignment, the 4-hourly reconciliation, and what happens if the group grows past your seat count: Access groups and seats.
Step 3 — Distribute the per-user installer
Dockli installs per-user under the user’s own profile (HKCU) with no administrator rights, no reboot, and no MSI. You have two options:
- Self-service. Point users at the download link (the file is named
Dockli-win-Setup.exe) and have them run it. See Installing Dockli. - Managed deployment. Package the same installer for delivery through Microsoft Intune or Microsoft Configuration Manager. Because it’s a per-user install, deploy it in the user context, not the system/device context.
The installer bundles everything Dockli needs (including .NET 8), registers the File Explorer shell extension, and restarts Explorer so the Dockli entry appears in the navigation pane immediately.
No update rings to manage
You don’t build patch rings or push updates. Dockli updates itself silently in the background about every four hours. See Updates and maintenance.
Step 4 — Users sign in
A user opens File Explorer, clicks Dockli in the navigation pane below This PC, and signs in with their Microsoft 365 work or school account. Because your tenant already consented, there is no approval prompt. At first sign-in the app calls the licensing service, the user claims a seat, and Dockli is ready.
Walkthrough for users: Signing in.
What happens under the hood
At sign-in and on a periodic heartbeat, the app asks the Dockli licensing service whether the user holds a seat. The service returns a short-lived signed entitlement token that carries the tenant, user, plan tier, and features, and that token is what gates the AI features at the secure gateway. If the licensing service is briefly unreachable, a grace window keeps working users working. For the admin-level mechanics, see Licensing and entitlement.
Where to go next
- Tenant-wide admin consent — the one approval that activates Dockli
- Access groups and seats — how membership grants seats
- Licensing and entitlement — tokens, statuses, grace window
- Updates and maintenance — silent auto-updates
- Uninstalling and offboarding — removing users and winding down
- Endpoints to allowlist — network requirements