For the complete documentation index, see llms.txt. This page is also available as Markdown.
Roles & Permissions
AOH Sync uses role-based access control to determine what each user can see and do. Permissions are granted through permission groups — named sets of roles that you assign to users.
How access decisions work
Every permission check in AOH Sync is made on the server, on every request — the interface reflects what the backend permits, and never grants access on its own. This means:
If your access is revoked, the next request is denied immediately. There is no window where the UI still shows a permitted action after the backend has revoked it.
You cannot gain access by navigating directly to a URL or manipulating the interface; the backend is always the authority.
When your group membership changes, the change takes effect on the next request — no sign-out or cache-clear needed.
If someone has access they should not, the fix is in the permission group model — in one place — and takes effect immediately.
Built-in permission groups
AOH Sync ships with five system-defined permission groups. You can view and manage them from the Access Management screen under Administration.
Group
What it grants
Global Administrator
Unrestricted access to all system features and administration
System Administrator
System operations including configuration, Connectors, scheduling, and monitoring
Analyst
Read-only access to dashboards, lifecycle data, and provisioning status
Enterprise Resources
HR-facing access to Connectors, user lifecycle, and attribute information
Security
Audit logs, secrets management, user lock/unlock, and service monitoring
The Access Management screen showing five system permission groups — Analyst, Enterprise Resources, Global Administrator, Security, and System Administrator — with their descriptions and role counts. The Analyst role matrix is expanded below, showing 6 of 22 system roles granted.
The Access Management screen. Each group row shows the number of granular roles it includes. Expand a group to see its full role matrix.
Granular roles
Each permission group is made up of individual system roles. There are 22 system roles in total, covering areas such as:
Dashboard access and reports generation
Connector management and schedule management
Provisioning status and Entra log access
Attribute information and user lifecycle access
User management and user lock/unlock
Secrets management and Vault administration
Audit log access and service monitoring
The full role matrix for any group is visible on the Access Management screen by selecting the group and clicking View full matrix.
System permission groups cannot be deleted. You can create custom groups with any combination of the 22 system roles to match your organization's access model.
Assigning users to groups
User-to-group assignments are managed from the User Management screen under Administration. A user can belong to multiple permission groups; their effective permissions are the union of all roles granted by every group they belong to.
Every permission change is recorded in the audit trail — including who made the change, what was modified, and when it took effect.
