Users & roles

Organizations, tenants and people

An organization is your account in TenantThrift. It holds your plan, your team and your connected Azure tenants. Every piece of data belongs to exactly one organization, enforced in the database itself, not just in the app.

An organization can hold several Azure tenants (on the MSP plan). The reverse is what you want to avoid: the same Azure tenant connected from two different organizations. Nothing breaks visibly, but the tenant gets scanned twice, and the automatic sign-in join described below switches itself off because it can no longer tell which organization a person belongs in.

The three roles

Role	Can do
Admin	Everything below, plus: manage the team, billing and plan, connect and delete tenants, rename the organization, white-label branding, read the activity log, export all data, delete the organization.
Editor	Run scans, verify access and change scope, edit schedules and alert thresholds, manage notification channels, ignore and restore findings, record commitment decisions, refresh cost, dismiss cost-spike alerts.
Reader	View dashboards, findings, cost and commitments. Download PDF reports and CSV exports, and create a share link for a report.

Roles are enforced on the server, not by hiding buttons. A Reader who guesses a URL still cannot change anything.

Two things surprise people: a Reader can share a report externally via a 7-day link, and the activity log is Admin-only — Editors cannot see it.

Adding someone — two ways

Both end in the same place: a membership row with a role. They differ in who decides the access, and in whether the person's identity is proven.

Option A — assign a role in Entra (recommended)

Best when the people who should use TenantThrift already live in the Azure tenant you connected. Access is granted and revoked where you manage every other application, and joiner–mover–leaver keeps working without anyone touching TenantThrift.

1. In the Azure portal, go to Entra ID → Enterprise applications → TenantThrift.
2. Open Users and groups → Add user/group.
3. Pick the person and select one of the three app roles:

App role in Entra	Becomes
TenantThrift Admin	Admin
TenantThrift Editor	Editor
TenantThrift Reader	Reader

The person then signs in with Continue with Microsoft and lands directly in your organization with that role. No invitation, no second account.

Two properties are worth knowing:

• No assignment means no access. Signing in with Microsoft without an assigned app role does not quietly make someone a Reader — it does nothing at all. The assignment is the authorization decision.
• Roles re-sync at every sign-in. Change the app role in Entra and it takes effect the next time they log in. Remove the assignment and their role stops being refreshed — remove the member in TenantThrift too if you want them out immediately.

One safeguard: the last remaining Admin is never demoted by this sync, so a misconfigured assignment cannot lock your organization out of its own account.

Option B — invite by email

Best for anyone outside the connected tenant — a consultant, a finance colleague in another directory, or a partner.

1. Go to Settings → Team (Admin role required).
2. Enter the email address, choose the role, press invite.

A brand-new address receives an invitation email and sets a password on first use. An address that already has a TenantThrift login is simply added — no email needed. Pending invitations are marked in the member list until the person first signs in.

The difference that matters: an invitation does not verify that the address belongs to your tenant. You can invite any address, including a personal one. With option A, membership of the tenant is proven by the sign-in token itself. So option A trusts your identity provider; option B trusts your admin.

When both apply to the same person

Entra wins. If someone was invited as an Editor and later signs in with Microsoft while holding the TenantThrift Reader app role, they become a Reader. If they hold no app role at all, nothing changes and their invited role stands.

Changing roles and removing people

In Settings → Team, an Admin can change any other member's role inline, or remove them. Two guardrails apply:

• You cannot change your own role — ask another Admin.
• You cannot remove yourself. To leave entirely, delete the organization (see Your data).

Removing a member ends their access to the organization. It does not delete their login, because the same login may belong to another organization.

Everything here is recorded in Settings → Activity log — invitations, role changes and removals, with who did it and when.

Sign-in, passwords and MFA

• Microsoft sign-in. Multi-factor authentication is handled by your own Entra Conditional Access policies. TenantThrift adds nothing on top and shows no MFA settings for these accounts.
• Email and password. Manage the password under Settings → Account, and enable app-based two-factor authentication (TOTP) there — scan the QR code, confirm one six-digit code, done.
• Step-up is mandatory once enabled. A session that has TOTP enrolled but has not yet entered a code is blocked from every page and every request until it does. There is no partially-authenticated state to slip through.
• Forgotten password — the link on the sign-in screen sends a reset email.

Terms acceptance

When the terms change, everyone is asked to accept the new version at their next visit, whatever page they are on. This also catches accounts created through Microsoft sign-in, which never passed the sign-up checkbox.