Role Management

Provision portal users in the client's Entra ID tenant. Each user is created with a random complex password, force-change on first sign-in, and exactly one App Role. Protected admins (platform-admin and seed-admins) cannot be disabled or have their role changed via this UI — they are immutable break-glass accounts.