Join an organization
For a new Entra directory, the first user who creates the organization becomes its Owner and starts the seven-day trial. See Getting started. If the directory is already connected, an Owner must invite your work account. Sign in with that account and choose Accept invitation. An Entra sign-in alone does not grant membership in an existing organization. The organization is bound to its connected Entra directory. Use an account in that directory, and use the sign-in page’s account-switching action if Microsoft selected a different work account.Invite a colleague
An Owner can open Organization → Invitations → Invite member and:- Enter the colleague’s work email in the connected Entra directory.
- Choose Reader, Contributor, or Owner.
- Choose the invitation expiry and select Create invitation.
- Ask the colleague to open General Validation, sign in with that work account, and choose Accept invitation.
Product roles
Roles are cumulative:
An Owner can change or remove another person’s access from
Organization → Members. Removed members must accept a new invitation before
they can return. General Validation protects the last active Owner from
removal; keep another Owner available to manage your own access.
Product roles apply within the organization. They do not grant Azure
subscription administration, database access, or storage RBAC.
Reading exact results and failed rows
Viewing exact metrics and captured failed rows requires both General Validation membership and customer Azure storage read permission. The browser obtains a Microsoft Entra token for Azure Storage and reads the result artifact directly from your subscription. Environment setup grants Storage Blob Data Reader on the browser-artifact container to the Owner who starts setup and optionally to one customer Entra group. Include the colleagues who need result evidence in that group, or have your Azure administrator assign the appropriate container access. A Reader with the required storage permission can view exact evidence. An Owner without that permission can see result metadata but cannot read the underlying customer artifacts. Keep application membership and storage permissions aligned when someone joins or leaves the team; removing one does not automatically remove the other. See Security and the data boundary.Consent and identity administration
General Validation uses separate Entra application registrations for its browser app and hosted API. The browser requests the API’s delegatedGV.Access permission. Your directory administrator controls consent,
Conditional Access, MFA, and other Entra policies.
Environment setup may require admin consent to connect General Validation’s
application identity in your directory. Fabric setup and browser storage
reads have their own Microsoft permissions and customer access checks.
Follow the specific consent or access message shown for that operation.
Browser calls to the hosted API use bearer tokens. API authorization checks
the verified identity and active organization membership on each request.
Automation access
Workload identities use the hosted API’s application roles:GV.APIReader, GV.APIContributor, or GV.APIOwner. Your Entra administrator
assigns the lowest role needed to a customer-managed workload identity.
Machine callers do not need a person’s membership record, but their Entra
directory must already be connected to an organization. They cannot create an
organization or accept a person’s invitation. Their API role also does not
grant access to customer storage evidence.
Follow API authentication for the API audience,
role assignments, and token requirements.