Four control layers
SSO is not the same as authorisation
Entra establishes identity and can avoid a second agent password. It does not by itself grant the correct support-channel visibility or WebChat configuration rights. The daily agent path follows Teams-channel access; the configuration path also uses WebChat's administrator list.
Approval needs a task matrix rather than a successful login: who reads enquiries, replies externally, writes internal notes, manages membership, changes widget/channel settings or approves the Teams app for the organisation? None of these tasks automatically justifies the highest Microsoft or product role.
| Layer | What it controls | Acceptance test |
|---|---|---|
| Entra identity | Sign-in, account and possible guest state | Active/disabled identity and tenant MFA/Conditional Access |
| Team and channel | Thread visibility and participation | Standard/private/shared membership and history |
| Teams role | Owner, member, guest or moderator powers | Separate membership, app, channel and reply tasks |
| WebChat admin list | Channel-specific WebChat configuration | Listed email plus channel membership and revocation |
| App/flow identity | Approval, connectors, automation or service identity | Owner, secret, runtime rights, cover and offboarding |
Channel type
Standard, private and shared channels change the audience
A standard channel is generally visible to team members. A private channel limits access to selected team members. A shared channel can include selected people across teams or organisations. This changes visibility, ownership, guests, apps, storage and revocation.
Microsoft also documents that a newly added private-channel member can see earlier conversations. Removing someone from the team removes their private-channel memberships; if they return, those memberships must be assigned again. Private is therefore not a substitute for need-to-know and retention rules.
Joiner, mover, leaver
Govern access across every role change
- 01
Constrain joiners
Assign only the required team and channels; test agent reply, internal note and WebChat administration separately.
- 02
Reassess movers
Remove old department, brand or country channels and backend-admin rights before granting the new scope.
- 03
Disable leavers
Disable the Entra account and revoke team, channel, guest, group, app and access-package routes under the real tenant model.
- 04
Close product paths
Check WebChat admin list, flow owners, connector connections, service accounts, secrets, Meta assets and website/tag-manager access.
- 05
Prove revocation
After removal, negatively test sign-in, old browser session, Teams Mobile, direct channel link, backend URL and flow/API execution.
Least-privilege acceptance
Eight role cases before production
- Agent reads and replies in the intended channel but cannot manage members or WebChat settings.
- WebChat administrator changes a harmless setting and loses that power after removal from admin list or channel.
- Team owner manages members without unnecessary tenant-wide Entra or Teams administration.
- Guest or external participant sees only the explicit surface; reply and history are assessed separately.
- A user outside the channel cannot reach its thread or backend configuration.
- A mover loses old brand/country channels and receives only the new scope.
- A leaver loses web, desktop, mobile, direct links, flow/connector and product administration within target time.
- At least two accountable owners provide continuity; elevated privileges are time-limited and traceable.