For a joiner, create/link the directory person if needed, complete authorised sign-in onboarding, assign the least necessary role/scope and verify access. A customer guest requires the installation's guest invitation/admission process; adding an external contact does not invite them.
For an invited reviewer in an Entra-integrated installation, the operator creates or reuses a Microsoft Entra B2B guest for the exact approved work email and assigns the relevant application-admitted role group. The reviewer accepts the Microsoft invitation using their own work account and completes the applicable MFA requirements. A permitted email domain alone grants no avowr access. Keep the chosen role and responsibility scope explicit: CFO access is broader than read-only review, including when assigned to a Privacy Officer.
After membership changes, sync the selected Entra group and review the active application assignment. Both layers are required: group membership does not activate an inactive Manager/Team Lead mapping. The reviewer must also connect from a network allowed by the installation's ingress rules; accepting the invitation does not bypass those rules. Have them demonstrate an allowed task and a denied action or record before marking onboarding complete. Directory creation, email delivery, invitation redemption and successful application access are separate statuses.
Use an approved environment for onboarding and access checks. A separate staging environment needs isolated data and document stores; assigning another role or clearing a view does not create that separation. Follow the organisation's information-handling policy before uploading any sensitive records.
Confirm the reviewer can reach the branded avowr entry page and choose Continue with Microsoft. The application uses Microsoft SSO only; administrators do not create avowr passwords. Explain the nine-minute inactivity warning, ten-minute timeout and need to save edits before leaving. This timeout does not replace account deactivation or removal of assignments, and its duration is not an organisation-configurable setting in this release.
For a mover, update directory facts, assignments and record responsibility separately, then check that old access is removed as intended. For a leaver, deactivate/revoke access using the organisation's identity process, end relevant assignments, transfer outstanding work and verify denial with the appropriate administrator. Preserve business and audit history under the retention process.
Keep at least one approved recovery administrator. Record material access decisions and use the technical identity guide (administrator reference) and tenant setup runbook (administrator reference) for provisioning/integration details. These internal runbooks require adaptation before customer publication.