> ## Documentation Index
> Fetch the complete documentation index at: https://docs.generalvalidation.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-in and team access

> Sign in with your Microsoft work account, obtain administrator approval when your tenant requires it, activate your Organization, invite teammates, assign roles, and manage Fabric access separately.

Sign in to [General Validation](https://app.generalvalidation.com) with your
Microsoft work account. Microsoft Entra authenticates you under your
organization's identity policies, and your General Validation membership and
role determine what you can do in the application. Access to your Tables,
Results, and evidence in Fabric is a separate matter that your Fabric
administrators control; see
[Fabric access is separate](#fabric-access-is-separate).

## Sign in with Microsoft

Sign-in is Microsoft-only. There is no General Validation username or
password.

1. Open [app.generalvalidation.com](https://app.generalvalidation.com).
2. Choose **Get started free** to start a new Organization, or **Sign in** if
   you are joining an Organization that already exists. Both take you to
   Microsoft.
3. Sign in with a work account from your organization's Microsoft Entra
   directory. You sign in directly with Microsoft; General Validation never
   asks for your Microsoft password.
4. Approve the permission request Microsoft shows. As the **What happens
   next** panel on the sign-in page explains, Microsoft asks you to approve
   workspace discovery, Spark job execution, and access to OneLake.

Every permission in that request is delegated: the app acts as you and can do
nothing your own Fabric roles do not already allow. The app requests no
application permissions, no Microsoft Graph permission, and no Azure Service
Management permission. The full list of permissions and what each one is used
for is in
[What General Validation creates and needs in Fabric](https://docs.generalvalidation.com/get-started/fabric-resources.md).

If Microsoft selected a different account than the one you intend to use, for
example the account that was invited to your Organization, choose **Use
another Microsoft account** on the sign-in page.

After Microsoft returns, the page shows Opening your workspace… and then
opens your workspace, the activation page, or the invitation page, depending
on your directory and membership. If Fabric or OneLake access later needs your
attention, the app shows Connect Microsoft Fabric or **Allow OneLake
access**; complete that step with the same Microsoft account and directory as
your General Validation sign-in.

## Tenants that require administrator approval

Some organizations require a Microsoft Entra administrator to approve new
applications before people can sign in. In that case sign-in stops at the
Administrator approval page, headed **Your organization needs to approve
General Validation**. This is a routine step, not an error.

1. Choose **Copy** next to Approval link for your administrator and send
   the link to a Microsoft Entra administrator.
2. The administrator opens the link, signs in with their own account, and
   approves the application for everyone in the organization.
3. After they approve it, sign in again. Choose **Try again** to return to the
   sign-in page.

One approval covers the General Validation sign-in scope and every Fabric and
OneLake permission listed in
[What General Validation creates and needs in Fabric](https://docs.generalvalidation.com/get-started/fabric-resources.md).
Nothing is installed in your tenant to grant it. General Validation is
registered as a multitenant application with a verified publisher and the
publisher domain generalvalidation.com, so your administrator can confirm the
publisher before approving.

If an administrator declined the request, or the approval did not complete,
the page says so and offers the same link to send again. Administrator
approval covers the permissions, not membership: each person still signs in
with their own account and still needs to activate an Organization or accept an
invitation. If a later release adds a Microsoft permission, users or an
administrator may be asked to consent again.

## Activate your organization

The first person to sign in from a directory that has no Organization yet sees
the activation page, Name your workspace.

1. Enter an Organization name. This is how your team will see the
   workspace. It does not rename your Microsoft directory, and you can change
   it later.
2. Choose **Start 7-day trial**.

This links your Entra directory to the new Organization and makes you its
first Owner. The trial summary beside the form confirms Trial 7 days,
Payment No card required, and Your access Organization owner. The
trial begins when the workspace is created, needs no credit card, and allows
up to five active Table Pairs; see
[Plans and trial](https://docs.generalvalidation.com/administration/plans.md). Activation creates
nothing in your Fabric tenant. Fabric items are created only when an Owner
completes [Set up your Environment](https://docs.generalvalidation.com/get-started/environment.md), which the app
opens next.

Each Entra directory has one Organization. If yours is already connected, the
page says that your directory is already connected to an organization and
offers **Accept invitation**. Ask an Owner of that Organization to invite your
work account, then accept the invitation as described below. The error code
behind this message is
[organization.directory\_already\_activated](https://docs.generalvalidation.com/errors/organization.directory_already_activated).

An Owner can rename the Organization later from Organization by editing
Organization name and choosing Save name.

## Invite teammates

Only Owners can invite teammates. General Validation does not send invitation
email. You create the invitation, share the sign-in link yourself, and the
invitee accepts it after signing in.

1. Open Organization and, under Invitations, expand **Invite
   member**.
2. Enter the colleague's Work email. The account must be in your connected
   Microsoft Entra directory.
3. Choose a Role: Reader, Contributor, or Owner.
4. Choose Expires in: 1 day, 7 days, or 30 days.
5. Choose **Create invitation**.
6. Send your colleague the link
   [app.generalvalidation.com](https://app.generalvalidation.com) and ask them
   to sign in with that work email.

The invitee chooses **Sign in**, signs in with the invited work account, and
sees Join your team workspace. They choose **Accept invitation**.
Acceptance binds the invitation to the verified Microsoft account that
accepts it. If the page reports that no pending invitation matches their
account, confirm that the invited address matches the account they signed
in with; Use another Microsoft account on the sign-in page switches
accounts.

The Invitations table lists each invitation's Email, Role,
Status (Pending, Accepted, Expired, or Revoked), and Expires. Use
**Show invitations** to switch between Pending and **All invitations**.
Choose **Revoke** to cancel a pending invitation. An invitation that has
expired or been revoked cannot be accepted; create a new one instead.

## Roles

Roles are cumulative: each role includes the permissions of the role before
it.

| Role | Can do |
| - | - |
| Reader | View Table Pairs, Tests, Runs, and Results. Open a Result's details and mismatch evidence, which the browser reads from OneLake with the Reader's own Fabric access. Readers do not see Run all, Add Table Pair, Add Test, Run validation, or edit and delete actions. |
| Contributor | Everything a Reader can do, plus create, edit, and delete Table Pairs and Tests, Run validation on a Table Pair, and Run all. |
| Owner | Everything a Contributor can do, plus set up, Reinstall, and Remove the Environment; rename the Organization; manage Members and Invitations; and the subscription and purchase actions on Billing. |

An Owner changes or removes another person's access from Organization
under Members:

1. Choose **Edit access** on the member's row.
2. To change the role, pick a New role and choose **Save access**. To
   remove the person, choose **Remove access** and then **Confirm removal**.

General Validation checks membership and role on every request, so a role
change applies to that person's next action, and a removed member loses access
immediately. Their history remains, and they must accept a new invitation
before they can return.

The last active Owner cannot be removed or demoted; promote another member to
Owner first. The error code for this refusal is
[membership.last\_owner\_protected](https://docs.generalvalidation.com/errors/membership.last_owner_protected).
An Owner cannot change their own role; ask another Owner to change your
access.

Product roles apply only inside General Validation. They grant no Fabric,
OneLake, or Azure permission, and the Owner role grants no privilege outside
your own Organization. Automation clients use the same three role levels
through Microsoft Entra application roles; see
[API authentication](https://docs.generalvalidation.com/api/authentication.md).

Errors on Organization show a reference with the error code and request
ID. Include both when you contact
[support@generalvalidation.com](mailto:support@generalvalidation.com).

## Fabric access is separate

Membership in your General Validation Organization grants no access in
Fabric, and access in Fabric adds no one to your Organization. Every call the
app makes to Fabric and OneLake runs as the signed-in user, and Fabric checks
that user's own permissions on every call. Your Fabric administrators grant
that access through Fabric.

In short: the Owner who runs setup needs to create workspaces on the chosen
capacity; anyone who authors or runs validation needs access to the source
and target Tables; and anyone who opens details needs read access to the
Results Lakehouse in the dedicated workspace. The full table is under
[Access your users need in Fabric](https://docs.generalvalidation.com/get-started/fabric-resources.md#access-your-users-need-in-fabric).

Ask a Fabric workspace administrator to share the dedicated General
Validation workspace with the teammates who run validation or open details.
Keep the two kinds of access aligned when someone joins or leaves: removing a
person from the Organization does not remove their Fabric access, and removing
their Fabric access does not remove them from the Organization. See
[Set up your Environment](https://docs.generalvalidation.com/get-started/environment.md) and
[What General Validation creates and needs in Fabric](https://docs.generalvalidation.com/get-started/fabric-resources.md).

## Sign out and account switching

Choose **Sign out** from the account panel in the header. The panel shows
your name, your Organization, your role, and your email address. The
activation and invitation pages also offer **Sign out** in their header.

Your General Validation sign-in lives in the browser tab where you signed in.
A new tab, or a tab whose Microsoft session has ended, asks you to sign in
again and returns you to the page you requested. If your organization's
sign-in policy, such as Conditional Access or multifactor authentication,
needs you to act, the page Sign in again to continue. offers **Continue
with Microsoft**. Your directory administrator controls those Microsoft Entra
policies, not General Validation.

To use a different Microsoft account, sign out, then choose **Use another
Microsoft account** on the sign-in page. An Organization is bound to its
connected Entra directory, so the account you switch to must belong to that
directory and be a member of the Organization or hold a pending invitation.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.