Security model

Concern	How it's handled
Privileged accounts	Active and eligible roles, roles held through groups and administrative units, custom roles, your privileged group and break-glass are all checked: at import, immediately before every group add, and on every hourly run, which removes any it finds from both groups.
Enrol links	A 256-bit random token per email, with only its SHA-256 hash stored, and a 21-day expiry. Opening the link only shows a page; pressing Start does the enrolment, so mail scanners can't. There is no way in by email address alone.
Admin access	Sign-in through the Auth-Onboard-Portal app with assignment required, a role check in every function, and same-origin JSON for every change.
Permissions	No permission to change anyone's authentication methods, no Temporary Access Passes, no certificates, no Mail.Send in Entra. Storage access is limited to its own storage account.
Output	Everything about a person is encoded before it's shown. Pages send a strict Content Security Policy and no referrer.
Your data	In your subscription only. Andy Kemp Consulting holds no tokens, keys or user data.

For the roles needed to install it, see Roles: least privilege.