Roles: least privilege

The installer runs in your browser as you: every change is made with your own sign-in, so what it can do is exactly what your roles allow. Give the person installing only the roles below, and activate them through Privileged Identity Management for the install, not permanently.

Global Administrator isn't needed

Every change the installer makes is covered by a narrower role.

Entra ID, for an install or upgrade

Role	Used for
Groups Administrator	Creating the onboarding and promoted groups.
Authentication Policy Administrator	Adding the Passkey-StandardUsers passkey profile to the passkey (FIDO2) policy.
Conditional Access Administrator	Creating the MFA-StandardUsers authentication strength and the two Conditional Access policies.
Cloud Application Administrator	Creating the Auth-Onboard-Portal app registration, its sign-in secret and the admin assignment, and adding a custom domain's sign-in address. Application Administrator isn't needed.
Privileged Role Administrator	One step only: granting the Function App's managed identity its Microsoft Graph permissions (User.Read.All, GroupMember.ReadWrite.All, AuditLog.Read.All, RoleManagement.Read.Directory). Microsoft allows nothing less to grant Microsoft Graph application permissions.

Privileged Role Administrator can assign any role

Including Global Administrator. Activate it for the install only, ideally with approval in PIM, or have a second person do that step.

An update (a new version with no Entra changes) needs no Entra role at all.

Azure

Role and scope	Used for
Contributor on the subscription	Creating the resource group and resources, and registering the resource providers the first time. Once the resource group exists, Contributor on it is enough for updates.
Role Based Access Control Administrator on the subscription, with a condition	The install creates three role assignments: Storage Table Data Contributor and Key Vault Secrets User for the Function App's identity, and a temporary Contributor on the admin portal while it's published. Limit the condition to those three roles, instead of using Owner or User Access Administrator, which can assign any role.

The installer's own access

The installer only ever acts as you, in your browser tab, and Andy Kemp Consulting never receives your tokens.

Its enterprise app, AKC Auth-Onboard Deployer, stays in your tenant with the permissions you consented to, but it can only use them while someone signs in to it. When you consent:

• consent for yourself only, not on behalf of your organisation;
• remove the app, or its permissions, in Enterprise applications once you've finished.