Manage access
People sign in to the EIDGuard dashboard with their Microsoft Entra account. What they can do depends on the app role assigned to them: Viewer, Operator or Admin. Roles are assigned in Microsoft Entra, not in the dashboard.
Roles#
| Role | Intended for | Can |
|---|---|---|
| Viewer | Auditors, stakeholders | View the Overview, recovery points and captured objects, comparison and restore reports, jobs and their logs, and settings |
| Operator | Day-to-day operators | Everything a Viewer can, plus run backups and comparisons, preview any restore, and apply Missing only restores of the resource types that cannot grant access |
| Admin | Identity administrators who own recovery | Everything an Operator can, plus apply Full restores and restores of resource types that can grant access, onboard and offboard tenants, rotate certificates, change settings, raise deletion protection, export recovery points, and configure private networking |
A user who holds more than one role gets the highest. The administrator who completed first-run setup is assigned Admin automatically.
What each role can do#
| Action | Viewer | Operator | Admin |
|---|---|---|---|
| View the dashboard, recovery points, reports and jobs | Yes | Yes | Yes |
| Run a backup now | Yes | Yes | |
| Run a comparison | Yes | Yes | |
| Preview a restore | Yes | Yes | |
| Apply a Missing only restore of Users, IdentityProviders, UserFlowAttributes, CustomAuthExtensions, ApiConnectors, ConditionalAccess or Branding | Yes | Yes | |
| Apply a restore that includes Groups, Applications, ServicePrincipals, UserFlows, Policies, TenantPolicies, GroupSettings, DirectoryRoles or AdministrativeUnits | Yes | ||
| Apply a Full restore | Yes | ||
| Onboard and offboard tenants, and change per-tenant protection | Yes | ||
| Rotate certificates | Yes | ||
| Change the schedule, retention, verification, alerting and branding | Yes | ||
| Raise deletion protection | Yes | ||
| Export recovery points | Yes | ||
| Configure private networking | Yes | ||
| View role assignments on the Users page | Yes |
These rules are enforced by the service, not only by the dashboard. For why some restores need Admin, see Who can apply a restore.
Assign a role#
You need permission to manage the enterprise application in your workforce tenant, for example as its owner, or as a Cloud Application Administrator.
- In the Microsoft Entra admin center, go to Enterprise applications and open EIDGuard-WebUI (<web app name>).
- Select Users and groups > Add user/group.
- Select the users or groups, select a role (Viewer, Operator or Admin), and select Assign.
The new role applies the next time the person signs in. To remove access, remove the assignment.
Tip
Where your Microsoft Entra license allows assigning groups to applications (Microsoft Entra ID P1 or P2), assign roles to groups rather than individuals. Keep the Admin role to a small number of people. Make sure more than one person holds Admin, so a restore is never blocked by one person's absence.
Review who has access#
Admins can open Users in the dashboard to see every user and group assigned a role, with Name, Type, Role and Assigned. The page is read-only and reads the assignments with your own sign-in. Select Load assignments to show them. To change roles, use the steps in Assign a role.
People without a role#
Only users and groups assigned a role can sign in. Anyone else who tries is told which roles exist and that a role is assigned in Entra under Enterprise applications > EIDGuard-WebUI (<web app name>) > Users and groups. They can select Sign in as someone else to try another account.