Put a whole customer company on its own AI provider account, and keep its billing state in step with Dynamics 365 — so their AI runs on their bill, and yours invoices on real usage.
Who this is for: the CoverGuard team (Customer Success and platform admins). Where: Admin → Companies (/admin/companies) → click any company card. Time: ~5 min per company.
This is an internal admin guide. Customers never see these controls — they manage their own personal AI key at Sys Admin → Developer → AI & Models.
Why you'd do this
Three jobs, all handled from the same drawer:
| Job | What it gives you |
|---|---|
| See the whole company at a glance | Who owns it, how it was created, what funds it, how many seats and people it has, and how deep its org chart goes — without leaving the Companies tab. |
| Connect the company's AI key | Every person at that company runs on the customer's own AI account, on their bill, under one key you can rotate or revoke in one place. |
| Link their Dynamics account | Their contract, invoice status, balance, renewal date and account owner appear on the company row — and CoverGuard pushes their seat and usage counts back so Dynamics can invoice on what they actually used. |
Click anywhere on a company's card to open its drawer. (The AI key & billing link on the row opens the same drawer, if you prefer to aim at it.) Only the row's own Revoke control does something different — it keeps its own click.
Find the company
Every company is on this tab — the ones you provisioned by hand and the ones that signed up and paid through the product. Use the All / Self-serve / Concierge filter to narrow it down, and the search box for a name or owner email.
Each row tells you what you're looking at before you open it:
| On the row | What it's telling you |
|---|---|
| Comped | A concierge grant you provisioned. Only these can be revoked. |
| Professional / Team / Individual | A self-service customer, on that plan. |
| Professional (lapsed) | They had a plan and it's no longer active. |
| No plan | No subscription funds this company yet. |
| Exempt | The owner is billing-exempt, so a missing plan isn't a problem. |
Read the company's overview
Clicking a card opens the drawer on an Overview of that company. It's the fastest way to answer "who is this and what are they on?" before you change anything:
| Group | What's in it |
|---|---|
| Account | The owner's name, when the company was created, whether it was CS-provisioned or self-service, and the company id (handy for a support ticket). |
| Plan & seats | What funds it, the subscription's status, and how many seats it has. |
| People | Members, how many are active, how many invites are still pending — plus locations and teams if they've built an org chart. |
The overview comes straight from the row you clicked, so it appears immediately and always agrees with the card behind it.
It also calls out anything worth knowing before you act:
- Comped — a CoverGuard grant with no Stripe subscription behind it. Revoke it from the row, not from here.
- Not entitled — the subscription funding this company no longer grants access, so its people have dropped to the free tier.
- Billing-exempt owner — full access regardless of plan, so an empty plan isn't a problem.
- Demo — one of the seeded demo companies. Real, inspectable, but deliberately excluded from the platform metrics so a product demo never moves the numbers.
Turn on company AI keys (once per environment)
Before you can connect any company's key, the capability has to be on. The Platform setup panel at the top of the Companies tab has the switch:
- Find Company & personal AI keys (BYOK).
- Flip it On.
That's it — it takes effect within about a minute, with no redeploy.
Two things it will tell you honestly:
- "Set by deployment" — this environment pins the setting in its configuration, so you can't change it here. Ask engineering to unpin it if it needs to be managed from the app.
- A warning under the switch — the capability is on, but something it needs (the key-encryption secret) isn't configured, so it won't actually work yet. Ask engineering to set it.
While it's off, connecting a key wouldn't do anything: the setting is re-checked every time the AI runs, so a stored key would simply be ignored. That's why we refuse to store one rather than letting you believe it took.
Connect a company's AI key
- Open Admin → Companies and find the company.
- Click AI key & billing.
- Pick the provider (Claude, ChatGPT or Gemini) and the model you want them on.
- Paste the customer's API key and click Connect key.
The key is checked against the provider before it's saved, so you find out immediately if it's wrong. It's then encrypted, and it is never shown again — only a short redaction like sk-ant-…7f3a, enough to recognise which key is in place.
What it means
The company key wins. Once it's connected, every member of that company runs on it — including anyone who had already connected a personal key of their own. Their personal key stays stored but is not used. The drawer tells you how many people that affects, so the takeover is never a surprise.
If you remove the company key, nothing breaks: each member falls back to their own key if they have one, and otherwise to CoverGuard's own AI. The AI keeps working either way.
Only Claude runs the full experience today. ChatGPT and Gemini keys are accepted, validated and stored, but the conversational Advisor still runs on CoverGuard's Claude account until we ship execution for them. The drawer says so plainly — don't tell a customer their ChatGPT key is powering everything.
A key that stops working is handled for you. If the provider starts rejecting it, we mark it invalid and quietly fall back so the company's AI doesn't go down. The row shows AI key invalid and the drawer explains it — that's your cue to get a fresh key from the customer.
Link a company to Dynamics
- In the same drawer, find Dynamics 365 (billing).
- Paste the Dynamics account id — the GUID from the account record in Dynamics.
- Paste the connection id of the Dynamics connection (create one first under Sys Admin → Integrations). Without it the link is recorded but can't sync.
- Choose the direction and schedule, then click Link account.
We pull immediately so you see real figures rather than an empty shell.
| Direction | What runs |
|---|---|
| Both ways (default) | Pull their billing state in, push our usage counts out. |
| Pull billing from Dynamics | Read-only — we never write to their account. |
| Push usage to Dynamics | We only send seats and usage; we don't read their billing. |
Daily is the right schedule for almost everyone. Hourly is for an account you're actively working; Manual means it only moves when you click Sync now.
What it means
Dynamics is the source of truth for money. Everything under Account & ownership, Contract & invoice and Renewal & lifecycle is what Dynamics told us at the last sync. We never edit those figures, and we never invent one — a company that hasn't synced shows blanks and a "Not synced" note, not zeros. If a number looks wrong, fix it in Dynamics and sync again.
CoverGuard is the source of truth for usage. Usage this month is what we measured: seats on their plan, people actually using them, reports generated, and API calls — all for the current calendar month, so a pushed figure means the same thing every month. A Not yet pushed tag means our numbers have moved since Dynamics last heard from us; Sync now clears it.
A renewal or a past-due invoice surfaces on the row itself, so you spot it while scanning the list rather than by opening every company.
Tips
- Sync one direction when you're debugging. Pull billing only and Push usage only let you isolate which half is misbehaving.
- Re-linking to a different account clears the old snapshot. That's deliberate — showing one account's contract value under another account's id would be worse than showing nothing.
- Unlinking is safe. It removes the link and the cached figures; nothing in Dynamics changes, and the company keeps working normally.
Troubleshooting
| What you see | What it means | What to do |
|---|---|---|
| "Bring-your-own-key is disabled on this deployment" | The capability is off. | Turn on Company & personal AI keys in Platform setup at the top of the Companies tab. If it says Set by deployment, ask engineering to unpin it. |
| "Pinned by FEATUREAIBYOK on this deployment" | The environment fixes this setting in its configuration, so the in-app switch can't change it. | Ask engineering to clear that variable if the setting should be managed from the app. |
| "Platform settings aren't available on this deployment yet" | The settings table hasn't been created in this environment. | Each capability is running on its built-in default. Ask engineering to apply the pending migration. |
| "Key storage is unavailable" | The environment has no encryption secret configured, so no key can be stored safely. | Ask engineering to set it — we won't store a key unencrypted. |
| "The key was rejected by …" | The provider says that key is bad. | Get a fresh key from the customer. |
| "Could not reach … to validate the key" | We couldn't contact the provider just now — the key may well be fine. | Wait a moment and try again. Never a reason to ask for a new key. |
| AI key invalid on the row | The key worked before and has stopped. The company is on CoverGuard's AI in the meantime. | Ask the customer for a new key and connect it. |
| "Dynamics is not configured on this deployment" | This environment has no Dynamics settings. | Ask engineering to configure it; the rest of the Companies tab is unaffected. |
| "No Dynamics connection is attached" | The link was recorded without a connection, so it can't sync. | Connect Dynamics under Sys Admin → Integrations, then re-link with that connection. |
| "Dynamics rejected the connection" | The connection's authorisation has expired or been revoked. | Re-authorise Dynamics under Sys Admin → Integrations. |
| "Could not find a property named …" | Their Dynamics uses different column names than our defaults. | Ask engineering to set the field mapping for this environment. |
| Sync error on the row | The last scheduled sync failed. | Open the drawer — the exact reason is shown under the figures. |
Do this next
- Provisioning a brand-new customer? Start with Concierge company provisioning — you can enter the AI key and the Dynamics account id right in the provisioning form and finish the whole setup in one pass.
- Want to see AI keys and CRM health across every company at once? The Company governance section of the internal Observability dashboard tracks companies on their own key, invalid keys, sync errors, past-due accounts and upcoming renewals.