Microsoft access 5 min readUpdated September 19, 2026
Use security groups and manager scope
Keep each manager limited to the Microsoft Entra groups they are assigned to lead.
For OwnersFor Admins
The short answer
Admins choose which synced Entra groups are visible, then assign each manager a role and a specific set of groups. Managers inherit only that approved scope.
01
How scope works
Visible security groups organize reporting and access. Company admins can manage organization-wide configuration; managers are limited to assigned groups and the features their role permits.
A manager should not receive all-company visibility merely because they can sign in. Their assignment is the authorization boundary.
02
Recommended setup
- 1Review imported groups and hide groups that are unrelated to workforce reporting.
- 2Create or select groups that match real management responsibility, such as billing, front desk, or care coordination.
- 3Invite the manager using the same Microsoft identity they will use to sign in.
- 4Assign only the groups they lead and review sensitive screenshot or PHI-viewing permissions separately.
- 5Test with the manager account before announcing access.
Keep learning