Overview
This article describes how to add, manage, and remove users and groups in Business Applications when your Turbo360 account uses Microsoft Entra ID authentication.
Business value
Microsoft Entra ID integration allows you to manage Business Application access using your organization's existing identity structure. You can add individual users or entire Entra ID groups, apply role assignments at module or scoped levels, and leverage transitive group membership — reducing manual access management overhead as teams change.
Prerequisites
Required permissions
| Role | Access |
|---|---|
| Account owner | Full access — add, update, and remove users and groups |
| Owner | Full access — add, update, and remove users and groups |
| Custom role with Manage users enabled | Full access — add, update, and remove users and groups |
| Custom role without Manage users | No access to user management |
To perform user management operations, you must have the Account owner or Owner role, or a custom role with the Manage users permission enabled. Administrators can enable this under Specify management permissions when configuring a custom role.
How it works
Business Applications supports two role assignment models for Entra ID users and groups:
- Direct role assignment — assigns a role to a user or group that applies across the entire module. For example, assigning the Reader role to a group gives all members of that group read access to all Business Application groups and applications.
- Specified access — assigns different roles on different module-specific areas. Use this when a user or group should only see a subset of groups or applications. For example, a contractor or a group with guest users can be restricted to the Development environment only.
When specifying custom permissions, access is granted hierarchically. Selecting a Business Application group automatically includes all its child groups and applications. Assigning a role to a selected group applies that role to all items within it.
Users and groups already added to Turbo360 (through another module, or with no module permission) can be added from the Existing user and Existing group tabs respectively.
Entra ID directory listing behavior: The first 500 users or groups from your Microsoft Entra ID are listed. Use Load more to retrieve the next set. You can filter users by User Principal Name, and groups by group name. If the item you're looking for doesn't appear in the list, apply the same filter directly in Microsoft Entra ID to retrieve it.
Permission evaluation: When a user is added directly to Turbo360, their individual role assignment takes precedence over any group memberships. When a user signs in only through a group (not added directly), their permissions are evaluated against the roles assigned to that group. If a user belongs to multiple groups, the highest-level permissions across all groups apply. The same logic applies when a user is the direct owner of a group added to Turbo360.
Although Turbo360 supports direct owners of Microsoft Entra ID groups, the recommended approach is to manage group access through members — where owners are also members of those groups.
Transitive group authentication: If a parent group is added to Turbo360, all child groups at every nesting level are authenticated automatically, even if those child groups are not explicitly added. You can add child groups separately if different permission levels are required for different subsets of users.
Steps
Use the following steps to add, update, and remove users and groups in Business Applications. Navigate to the User management section in the Business Application module to get started.
Add a user or group
Adding a user or group from Microsoft Entra ID grants module access using the roles and permissions configured at the time of addition.
- Click Add user or Add group in the Users tab.
- Select the required users or groups from the directory list.
- Click Add.
Assign a role
Assigning a role determines what each user or group can do within Business Applications — either across the entire module or within specific areas.
After adding a user or group, select the role assignment type:
- Select Direct role assignment to apply a role to the entire module.
- Select Specified access to assign roles to specific Business Application groups or applications only.
When specifying custom permissions, access is granted hierarchically. Selecting a Business Application group automatically includes all its child groups and applications. The same applies when a role is assigned to the selected parent group.
Update user or group permissions
Updating permissions lets you change the role scope for a user or group — for example, switching from direct access to specified access, or adjusting which groups are accessible.
- Navigate to the User management section of the module.
- Click the Edit permission icon next to the user or group.
- Update the role — either at a specified level or as a direct role.
- Click Update.
To update permissions for multiple users or groups at once:
- Select the users or groups whose roles you want to update.
- Click Edit permission at the top of the list.
- Assign a role — either at a specified level or as a direct role.
- Click Update.
The selected role is applied to all chosen users and groups.
View and manage access at a specified level
Viewing access at the group or application level lets you audit and revoke permissions for a specific scope without opening the full user list.
To view users and groups with access to a specific Business Application group, click the Context menu ( ⋮ ) next to the group in the tree view and select Users.
To view users and groups with access to a specific Business Application, click the Context menu ( ⋮ ) next to the application in the tree view and select Users.
Only users and groups with direct access to a Business Application or group can have their access revoked from the Users widget at that level.
Remove a user or group
Removing a user or group revokes their access to the Business Application module. They remain in Turbo360's directory and can be re-added later.
- To remove a single user or group, click the Remove user icon next to the entry.
- To remove multiple entries, select them and click Remove at the top of the list.
A user or group removed from a module still exists in Turbo360's directory. To remove them from Turbo360 entirely, navigate to Settings > Users and select Remove user/group.
Example scenario
A team has three Business Application groups: Production, Staging, and Development. A Microsoft Entra ID group for contractors exists but should only access Development. An owner adds the group with Specified access and assigns the Reader role to the Development group only. When a new contractor joins the Entra ID group, they automatically gain access to Development in Business Applications — no manual update required in Turbo360.
Troubleshooting
-
User or group not appearing in the directory list
Cause: Only the first 500 entries are returned by default, and the item may not be in the initial set.
Fix: Use the filter field to search by User Principal Name (for users) or group name (for groups). If still not found, apply the same filter directly in Microsoft Entra ID. -
Cannot see the Add user or Add group option
Cause: Your role does not have permission to manage users.
Fix: Only users with the Account owner, Owner role, or a custom role with Manage users enabled can add users and groups. Contact your Account owner to request the appropriate access. -
Group member is not getting the expected permissions
Cause: The user may also be added directly to Turbo360, and direct membership takes precedence over group membership.
Fix: Check whether the user is listed individually in the User management section. If so, update or remove the direct assignment as appropriate. -
Bulk Edit permission option is greyed out
Cause: No users or groups have been selected in the list.
Fix: Select one or more entries using the checkboxes before clicking Edit permission. -
Cannot revoke access from the Business Application's Users widget
Cause: The user or group has specified access (not direct access) at this level.
Fix: Go to the full User management section and update or remove the permissions from there.