Application Access
Choose tenant roles for broad responsibilities and resource permissions for access to specific tasks or certificate templates. This guide explains how those permissions work together and how groups let you maintain access for a team.
Group ownership and application ownership
Any user can select My groups → Create group and become its owner. Only owners can manage the group and its members. Adding or removing applications also requires ownership of those applications.
Give a group access to specific automation tasks or certificate templates when its members need those capabilities while keeping their normal User role. For example, User access on an approved ACME template allows certificate ordering without broad Operator or TenantAdmin access.
Group management roles and resource access levels are separate. Owning a group does not automatically grant application ownership, resource management, or provider permissions. See Groups for user access, application integrations, and machine pools.
Role Assignment and Access Control
By default, users can sign in unless access is restricted by your tenant's Enterprise Application settings or Conditional Access policies. AZExecute uses Microsoft Authentication Library (MSAL), so sign-in follows your organization's Entra ID controls such as Conditional Access and MFA.
When a tenant has no users yet, the first user is assigned TenantAdmin by default. An explicit Microsoft Entra app-role assignment is authoritative, however, and can replace that initial role during the same sign-in.
How the effective tenant role is selected
AZExecute can receive a tenant role from either Microsoft Entra or a role configured in the product. The following precedence is applied at sign-in:
1. A recognized, explicit Microsoft Entra app role wins over the role configured in AZExecute.
2. If Entra supplies no recognized app role, the role configured in AZExecute is used.
3. If neither source provides a valid role, access defaults to User.
Recognized Entra values are AZExecute.Admin, AZExecute.TenantAdmin, TenantAdmin, AZExecute.Operator, Operator, AZExecute.User, and User. They are normalized to TenantAdmin, Operator, or User. If multiple recognized roles are assigned, the most privileged role wins: TenantAdmin, then Operator, then User.
After changing or removing an Entra app-role assignment, sign out and obtain a fresh token. TenantAdmins can review the resulting effective role and its source in System Access.
Assigning users and groups in Microsoft Entra
In the Azure portal, open the AZExecute Enterprise Application used for interactive sign-in and select Users and groups. Assign a recognized app role when Entra should be the authority for that user's tenant role. Assigning only Default Access leaves role management in AZExecute.
Direct user assignments and roles assigned through a group of which the user is a direct member are evaluated. After adding, changing, or removing an app-role assignment, have the user sign out and sign in again so Microsoft Entra issues a fresh token.
Managing User Access within AZExecute
Once users have logged in, TenantAdmins can review them in System Access. The user list shows the effective role and its source: Microsoft Entra, AZExecute, or Source unavailable.
Roles sourced from AZExecute can be changed here. Roles sourced from Microsoft Entra are read-only in AZExecute and must be changed on the Enterprise Application in Entra. If the source cannot be verified, role editing is disabled so the application does not accidentally overwrite an Entra-managed role.
Microsoft references: Add app roles and receive them in tokens and list a user's app-role assignments.
Choose how to grant access
Automation tasks and certificate templates can be shared with individual users or groups. A person can keep the normal User tenant role while receiving permission to use or maintain selected resources. Assign Operator or TenantAdmin when the person's responsibilities require broader access.
| Access source | Use it for | Where to maintain it |
|---|---|---|
| Tenant role | Operational or administrative responsibilities across the tenant. | The user's tenant role or authoritative Microsoft Entra app-role assignment. |
| Direct user grant | One person's access to a particular task or certificate template. | The resource's Access tab. |
| Group grant | A team whose members need the same access to a task or template. | The resource's Access tab for the permission; My groups for membership. |
Choose Viewer for read-only access, User to use the resource, Editor to maintain its configuration, or Owner to manage its access. User access on a task allows execution where permitted. User access on a certificate template allows ordering, renewal, and certificate downloads according to that template's configuration.
The User access level on a resource is separate from the User tenant role. Likewise, owning a group lets you manage its membership, while Owner access on a task or template lets you manage that resource. A group owner does not automatically receive Owner access on resources shared with the group.
Example: access for an application support team
Create an Application support group and add the team. An authorized task owner grants it User access to an approved maintenance task, and an authorized template owner grants it User access to the team's ACME certificate template. Team members can use those workflows while keeping their normal User tenant role. Group owners maintain who belongs to the team; resource owners maintain what the team is allowed to do.
Review effective access
The highest applicable permission from the tenant role, direct grants, and active group memberships determines resource access. A lower grant does not override a higher one. When removing access, check all sources: removing someone from one group may leave access through another group or a direct grant. Group grants require an active group and active membership within the same tenant.