> ## Documentation Index
> Fetch the complete documentation index at: https://docs.generalvalidation.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Sign-in and team access

> Use Microsoft work accounts, invite organization members, assign product roles, and control access to customer-stored evidence.

Sign in to [General Validation](https://app.generalvalidation.com) with your
Microsoft work account. Microsoft Entra authenticates you under your
organization's identity policies. General Validation membership determines
what you can do in the application.

## Join an organization

For a new Entra directory, the first user who creates the organization becomes
its Owner and starts the seven-day trial. See
[Getting started](/getting-started).

If the directory is already connected, an Owner must invite your work account.
Sign in with that account and choose **Accept invitation**. An Entra sign-in
alone does not grant membership in an existing organization.

The organization is bound to its connected Entra directory. Use an account in
that directory, and use the sign-in page's account-switching action if Microsoft
selected a different work account.

## Invite a colleague

An Owner can open **Organization → Invitations → Invite member** and:

1. Enter the colleague's work email in the connected Entra directory.
2. Choose Reader, Contributor, or Owner.
3. Choose the invitation expiry and select **Create invitation**.
4. Ask the colleague to open General Validation, sign in with that work
   account, and choose **Accept invitation**.

General Validation does not send an invitation email automatically. Pending
invitations can expire or be revoked. Acceptance binds the invitation to the
verified Microsoft account.

## Product roles

Roles are cumulative:

| Role        | Access                                                                                                    |
| ----------- | --------------------------------------------------------------------------------------------------------- |
| Reader      | Inspect configuration, dataset readiness, run history, and result metadata                                |
| Contributor | Reader access, plus author Pairs and Tests and start permitted discovery and validation work              |
| Owner       | Contributor access, plus administer organization membership, discovery sources, environments, and billing |

An Owner can change or remove another person's access from
**Organization → Members**. Removed members must accept a new invitation before
they can return. General Validation protects the last active Owner from
removal; keep another Owner available to manage your own access.

Product roles apply within the organization. They do not grant Azure
subscription administration, database access, or storage RBAC.

## Reading exact results and failed rows

Viewing exact metrics and captured failed rows requires both General Validation
membership and customer Azure storage read permission. The browser obtains a
Microsoft Entra token for Azure Storage and reads the result artifact directly
from your subscription.

Environment setup grants **Storage Blob Data Reader** on the browser-artifact
container to the Owner who starts setup and optionally to one customer Entra
group. Include the colleagues who need result evidence in that group, or have
your Azure administrator assign the appropriate container access.

A Reader with the required storage permission can view exact evidence. An
Owner without that permission can see result metadata but cannot read the
underlying customer artifacts. Keep application membership and storage
permissions aligned when someone joins or leaves the team; removing one does
not automatically remove the other.

See [Security and the data boundary](/security-and-data-boundary).

## Consent and identity administration

Your directory administrator controls consent, Conditional Access, MFA, and
other Microsoft Entra policies. If sign-in or environment setup requests admin
consent, have that administrator review the request, then retry the pending
step.

To connect a Fabric workspace, an Organization Owner must also be an Admin or
Member of that workspace. The guided setup requests Viewer access for your
customer execution identity. That permission permits reads across the selected
workspace, including its lakehouse and warehouse SQL data. Review
[Fabric setup and permissions](/connect-microsoft-fabric)
before connecting a source. Reading result artifacts has its own Storage
permission requirements, described above.

## Automation access

An Entra administrator can authorize a customer-managed workload identity to
call the API with the least access its task needs. Its directory must already
be connected to an organization. Workload access does not grant a person
application membership or permission to read customer storage evidence.

Follow [API authentication](/api-authentication) for setup and permissions.

## Resolve access problems

| What you see                                  | What to check                                                                                   |
| --------------------------------------------- | ----------------------------------------------------------------------------------------------- |
| Directory already connected                   | Ask an existing Owner for an invitation                                                         |
| No matching invitation                        | Confirm the invited work email, selected Microsoft account, and invitation expiry               |
| Access removed                                | Ask an Owner for a new invitation if access should be restored                                  |
| Admin consent needed                          | Have the relevant directory administrator review the request, then retry the pending setup step |
| Verdict visible but exact values fail to load | Check the user's customer storage RBAC and network access, then retry the result read           |
| An action is unavailable                      | Check the required product role, current trial or subscription access, and resource readiness   |