Microsoft Entra access

Users and role scopes

Everyone who can sign in, the roles that decide what they can see and do, and when they last signed in. Permissions are checked by the server on every request.

How sign-in works

When Microsoft sign-in is set up, roles will be assigned in Microsoft Entra ID, not here. Nothing on this page changes anyone's access.

People

Shown to signed-in administrators

Sign-in is not available yet, so this demo is view-only. Names, email addresses and sign-in times are personal information, so visitors who are not signed in cannot see them.

What each role can do

Permissions are checked on the server for every page and API request

Maker-checkerA control where one person prepares a transaction and a different person approves it. Nobody can approve their own work.

Role	Permissions
Finance preparer	approvals: read claim: read import: create, read period: prepare policy: manage premium: prepare, read receipt: prepare, read register: read remuneration: prepare statement: prepare, read
Finance approver	approvals: read claim: read import: read period: close premium: approve, read receipt: approve, read register: read remuneration: approve statement: approve, read
Claims preparer	approvals: read claim: prepare, read, register import: create, read register: read
Claims approver	approvals: read claim: approve, read import: read register: read
Underwriting	policy: manage premium: read register: read
Treasury	approvals: read bank: manage receipt: read register: read remittance: approve
Auditor	approvals: read audit: read claim: read import: read premium: read receipt: read register: read statement: read
Administrator	Everything, including administration only: apikey:manage, integration:manage, settings:manage, user:read