Roles and permissions
Choose the least-privileged Tenvyr role for owners, administrators, approvers, auditors, and members.
Roles are tenant-scoped. Authentication factors belong to the global account, but sessions and authorization decisions remain bound to one tenant.
| Role | Typical responsibilities | Important limits |
|---|---|---|
| Owner | Identity roles, SCIM role mappings, tenant-wide administration, emergency disable | Cannot approve their own request; owner is never granted by SCIM |
| Admin | Resources, policies, enrollment, integrations, operational containment | Cannot assign the owner role |
| Approver | Review access requests and assigned access-review items | Cannot approve their own request or review their own grant |
| Auditor | Read tenant resources, integrations, audit evidence, and review state | Read-only except when explicitly named as a review decision maker |
| Member | Manage personal security and credentials, request allowed access | Sees only policy and request data authorized for that identity |
Recent MFA
High-impact changes require built-in MFA completed within the last five minutes. This includes policy changes, enrollment-token issuance, identity administration, connector changes, trust rotation, and containment.
OIDC sign-in does not replace this control. Tenvyr always applies its own MFA ceremony after primary authentication.
Directory-managed roles
SCIM user and group mappings may grant:
- member;
- auditor;
- approver; or
- admin.
The owner and platform-support roles remain manual. Direct role editing is disabled for an actor managed by SCIM so that directory mappings remain authoritative.
Practical role design
- Keep at least two independently protected owners for recovery.
- Use an approver role for duty managers who should not administer integrations.
- Give auditors read access without reusing an admin identity.
- Map Entra groups to roles instead of assigning users one by one.
- Test that no requester is the only eligible approver for their policy.