Managing users with Microsoft Entra ID

Overview

This article describes how to manage users and groups in Azure Documenter for a Turbo360 account using Microsoft Entra ID authentication — adding users and groups, assigning roles, managing role assignments, and removing users or groups.

Business value

Managing access through Microsoft Entra ID groups, not just individual users, lets teams apply consistent permissions across an entire group and have membership changes reflected automatically, reducing manual per-user role management.

Prerequisites

Required permissions

Role	Access
Account owner, Owner	Full access to add users and groups, assign or edit role assignments, and remove users or groups.
Other roles	No access to user management actions.

How it works

Users or groups with Account owner or Owner access can add new users and Microsoft Entra ID groups to the module. The first 500 users or groups from the connected Microsoft Entra ID are listed, with a Load more option to retrieve the next set.

Microsoft Entra ID users in the retrieved list can be filtered by User principal name. If a user isn't in the retrieved list, the same filter can be run directly against Microsoft Entra ID.
Microsoft Entra ID groups in the retrieved list can be filtered by group name. If a group isn't in the retrieved list, the same filter can be run directly against Microsoft Entra ID.

Role assignment

A user or group can be assigned a role in either of two ways:

Direct role assignment — applies a role across the entire module. For example, assigning Reader directly to a user or group gives complete read access to all groups in the module.
Specified access — assigns different roles to different module-specific areas. For example, if an organization has separate Production and Development groups, a contractor or a Microsoft Entra ID group containing guest users can be restricted from even Reader access to Production. In this case, assign Specified access, choosing only the groups they should see and a role per group.

Users or groups already added to Turbo360 — members of other modules, or without any module permission yet — can be added from the Existing user or Existing group tab instead.

Permission evaluation

When a Microsoft Entra ID user is added directly as a Turbo360 member, their permissions are evaluated against the roles assigned to that user directly. If the same user also belongs to a Microsoft Entra ID group added to Turbo360, the group's permissions aren't evaluated — direct user membership takes precedence.
When a user signs in as a member of a Microsoft Entra ID group (without being added to Turbo360 directly), their permissions are evaluated against the roles assigned to that group. If the user belongs to multiple such groups, their effective permission is the highest-level role across all those groups.
The same evaluation applies when a user signs in as a direct owner of a Microsoft Entra ID group that's been added to Turbo360, rather than being added directly.

Note:

Although Turbo360 supports direct owners of Microsoft Entra ID groups, the recommended approach is to manage access through group membership, where owners are also members of the group.

Transitive group authentication

Microsoft Entra ID group authentication is transitive: if a parent group is added to Turbo360, all child groups at every inner level are authenticated too, even if those child groups aren't individually added. Child groups can still be added individually when users in different child groups need different permissions.

Steps

Use the following steps to add, manage, or remove users and groups. Go to the Users tab in the User management section of Azure Documenter to get started.

Add a user or group

Adding a user or group grants them access to the module based on the role assignment method you choose.

Select Add user or Add group.
Locate the user or group — using the filter above the list, or by filtering directly against Microsoft Entra ID if they don't appear in the first 500 retrieved.
Choose a role assignment method — Direct role assignment or Specified access.

Manage role assignments

Editing role assignments lets you adjust access for a user or group without removing and re-adding them.

To edit an individual user or group's role assignments, click Edit permission in the Actions column under the Users tab.
To manage a group's role assignments from its own page, use the Users option in the group's context menu on the module's home page.

Remove a user or group

Removing a user or group revokes their access to the module.

To remove one user or group, select Remove user/group in the Actions column.
To remove multiple at once, select them and click Remove above the list.

Note:

Removing a user or group from a module doesn't remove them from Turbo360's directory. To remove them completely from Turbo360, go to Settings > Users and select Remove user/group there.

Permission behavior

Only Account owner and Owner can add, edit, or remove users and groups. When permissions are evaluated for sign-in, direct user membership always takes precedence over group membership; if only group membership applies, the highest-level role across all the user's groups determines their effective access.

Example scenario

An organization adds a Microsoft Entra ID group containing all contractors, assigning it Specified access limited to the Development group only. A contractor who is a member of that Microsoft Entra ID group — but not added directly to Turbo360 — automatically inherits Development-only access, and loses it automatically if removed from the Entra ID group.

Limitations

Removing a user or group from Azure Documenter only revokes access to this module — they remain in Turbo360's directory and any other modules they belong to. Group permission evaluation does not apply when a user is also added directly; direct membership always takes precedence, even if the group would otherwise grant broader or narrower access.

Troubleshooting

A user's permissions don't reflect their Microsoft Entra ID group role
Cause: The user is also added directly to Turbo360, and direct membership always takes precedence over group-based permissions.
Fix: Adjust the user's direct role assignment, since their group membership won't be evaluated while direct membership exists.
Can't find a user or group when adding one
Cause: Only the first 500 users or groups from Microsoft Entra ID are loaded initially.
Fix: Use Load more, or filter directly against Microsoft Entra ID by User principal name or group name.
A child group has access even though it was never added to Turbo360
Cause: Microsoft Entra ID group authentication is transitive — child groups of an added parent group are authenticated automatically.
Fix: This is expected behavior. Add the specific child group individually only if it needs different permissions than the parent.

FAQs

What happens if a user is both added directly and a member of an added group?
Direct membership takes precedence. The user's permissions are evaluated against their direct role assignment, and the group's permissions aren't evaluated.
What if a user belongs to multiple Microsoft Entra ID groups added to Turbo360?
Their effective permission is the highest-level role across all the groups they belong to.
Do child groups need to be added separately from their parent group?
No, not by default — authentication is transitive. Add a child group individually only if its users need different permissions from the parent group.
Does removing a user or group from Azure Documenter delete them from Turbo360 entirely?
No. It only removes access to this module. They remain in Turbo360's directory unless removed separately from account-level Settings.