- Confirm the correct active sign-in account exists through the installation's identity onboarding process. Use stable Microsoft tenant/object identity for provisioning; email text alone is not sufficient.
- Open Roles. Review an existing role or create/configure one with the actions required. Starter roles are editable templates, not formal financial delegations.
- Under Responsibilities, choose Set responsibility for each relevant root record and assign its unit or programme.
- Under Assignments, choose Add assignment. Select the person or an already selected/synced Entra group, role and scope: organisation, unit, programme or supported individual record.
- Set descendant inclusion and expiry/active state deliberately. Multiple assignments add together, with each permission remaining tied to its own scope.
- Use Access review to inspect effective permissions, visible records, recovery access and warnings. Test intended access and a record/action that should be denied.
Complete when: The person can perform required duties without unintended access. New organisation-wide records and shared catalogues can require organisation-wide grants; a scoped writer may need an administrator to establish their root record first.