Admin authorization

Last updated: 20 September 2026

Goal: Ensure designated users receive Sandman admin privileges after sign-in.

Sandman grants admin when the sign-in ID token matches either configured path (OR logic). Configure at least one in the wizard or Settings.

Option A — App role (recommended)

1. App registrations → App roles — Create a role (Value e.g. Sandman.Admin).
2. Enterprise applications → Users and groups — Assign admins to that role.
3. Sandman — Enter the role Value under Authorization (Settings → Azure).

Option B — Security group

1. Entra → Groups — Create a security group, add members, copy the Object ID.
2. Token configuration — Add the groups claim to the ID token on the sign-in app.
3. Sandman — Enter the group Object ID under Authorization.

Verify: Sign in as an assigned admin; Settings, Users, and Audit appear in the navigation.