Users & roles

Organizations, tenants and people

An organization is your account in TenantThrift. It holds your plan, your team and your connected Azure tenants. Every piece of data belongs to exactly one organization, enforced in the database itself, not just in the app.

An organization can hold several Azure tenants: any number of your own on the Company plan (their spend is summed for your price), any number of clients' on the MSP plan. The same Azure tenant may also be connected from two organizations — typically the customer's own and their MSP's. Each sees only its own connection. The tenant belongs to one of them only: the organization whose first admin signed in from it and verified it. That ownership is what the automatic sign-in join below trusts, so an MSP's clients never join the MSP by holding a role in their own tenant.

An MSP whose technicians work in clients' tenants through GDAP cannot confirm the consent themselves — their partner accounts are foreign to the client tenant. On the dashboard, Create a connect link and send it to the client's admin: they approve in their own browser, without a TenantThrift account, and the tenant appears in the MSP's organization. Each link works once, for seven days.

The three roles

Role	Can do
Admin	Everything below, plus: manage the team, billing and plan, connect and delete tenants, rename the organization, white-label branding, read the activity log, export all data, delete the organization.
Editor	Run scans, verify access and change scope, edit schedules and alert thresholds, manage notification channels, ignore and restore findings, record commitment decisions, refresh cost, dismiss cost-spike alerts.
Reader	View dashboards, findings, cost and commitments. Download PDF reports and CSV exports, and create a share link for a report.

Roles are enforced on the server, not by hiding buttons. A Reader who guesses a URL still cannot change anything. The navigation follows the same line: Readers see the tenants' pages, Editors also each tenant's settings, and only Admins the organization's settings. Your own account — name, password, MFA — is under your name in the top bar, whatever your role.

Two things surprise people: a Reader can share a report externally via a 7-day link, and the activity log is Admin-only — Editors cannot see it.

Adding someone — two ways

Both end in the same place: a membership row with a role. They differ in who decides the access, and in whether the person's identity is proven.

Option A — assign a role in Entra (recommended)

Best when the people who should use TenantThrift live in your own Azure tenant — the one your first admin signed in from and your organization has connected, which is the tenant your organization belongs to. Access is granted and revoked where you manage every other application, and joiner–mover–leaver keeps working without anyone touching TenantThrift.

1. In the Azure portal, go to Entra ID → Enterprise applications → TenantThrift.
2. Open Users and groups → Add user/group.
3. Pick the person and select one of the three app roles:

App role in Entra	Becomes
TenantThrift Admin	Admin
TenantThrift Editor	Editor
TenantThrift Reader	Reader

The person then signs in with Continue with Microsoft and lands directly in your organization with that role. No invitation, no second account.

Worth knowing:

• No assignment means no access. Signing in with Microsoft without an assigned app role does not quietly make someone a Reader — it does nothing at all. The assignment is the authorization decision.
• Roles re-sync at every sign-in. Change the app role in Entra and it takes effect the next time they log in. Remove the assignment and they lose access at their next sign-in — the membership that the role created is removed, and the activity log records it. A session that is already open is not cut; to take someone out immediately, remove them under Settings → Team as well. People you invited by email keep their access regardless of app roles, and the last Admin is never removed.
• Only your own tenant's roles count. Your organization belongs to the tenant its first admin signs in with Microsoft from — from the moment that organization has connected and verified that same tenant. Until then, app roles join nobody. App roles assigned in a tenant you merely connected — a client's, if you are an MSP — never join anyone to your organization. Clients get access the other way, by invitation.
• The person needs an email address in Entra. Sign-in uses the Email field on the user (Entra ID → Users → the person → Edit properties → Contact information), and only an address on a domain verified in your tenant counts. Users without one — unlicensed accounts, admin-only accounts, anyone without a mailbox — are refused with "Unverified email". Setting the field to an address on a verified domain fixes it; name@yourtenant.onmicrosoft.com works, and no mailbox is needed.

One safeguard: the last remaining Admin is never demoted by this sync, so a misconfigured assignment cannot lock your organization out of its own account.

Option B — invite by email

Best for anyone outside the connected tenant — a consultant, a finance colleague in another directory, or a partner.

1. Go to Settings → Team (Admin role required).
2. Enter the email address, choose the role, press invite.

The address receives an invitation email with a link that works once and for seven days. Nobody is added by the invitation alone: the person joins when they open the link and accept it from an account with the invited address — signing in if they have one, creating one with that address if not. Open invitations are listed in the member list until they are accepted or withdrawn; inviting the same address again sends a fresh link.

The difference that matters: an invitation does not verify that the address belongs to your tenant. You can invite any address, including a personal one. With option A, membership of the tenant is proven by the sign-in token itself. So option A trusts your identity provider; option B trusts your admin.

When both apply to the same person

Entra wins. If someone was invited as an Editor and later signs in with Microsoft while holding the TenantThrift Reader app role, they become a Reader. If they hold no app role at all, nothing changes and their invited role stands.

Changing roles and removing people

In Settings → Team, an Admin can change any other member's role inline, or remove them. Two guardrails apply:

• You cannot change your own role — ask another Admin.
• You cannot remove yourself from the team list. To leave, delete your own account under your name → Your account: your login and your memberships go, the organization stays — provided it keeps another Admin. If you are the only member and the organization still holds a tenant or a subscription, delete the organization instead (see Your data).

Removing a member ends their access to the organization. It does not delete their login, because the same login may belong to another organization.

Everything here is recorded in Settings → Activity log — invitations, role changes and removals, with who did it and when.

Sign-in, passwords and MFA

• Microsoft sign-in. Multi-factor authentication is handled by your own Entra Conditional Access policies. TenantThrift adds nothing on top and shows no MFA settings for these accounts.
• Email and password. Manage the password under your name → Your account, and enable app-based two-factor authentication (TOTP) there — scan the QR code, confirm one six-digit code, done.
• Step-up is mandatory once enabled. A session that has TOTP enrolled but has not yet entered a code is blocked from every page and every request until it does. There is no partially-authenticated state to slip through.
• Forgotten password — the link on the sign-in screen sends a reset email.

Terms acceptance

When the terms change, everyone is asked to accept the new version at their next visit, whatever page they are on. This also catches accounts created through Microsoft sign-in, which never passed the sign-up checkbox.