Administrative access

Identity, policy, and audit controls

Access remains subject to tenant claims, role policy, antiforgery validation, session expiry, and redacted audit logging. URL knowledge never grants permission.

Credentials

Fine print: local credentials are accepted only in Development; production authentication must be supplied by the configured Microsoft Entra ID tenant. Successful authentication creates a time-limited, HttpOnly session and does not expose password material to the browser after submission.