A Global Administrator signs in to Avvi and is refused. Nothing is broken.

Avvi keeps its own access list. A Microsoft directory role, however senior, does not carry across on its own.

This page covers what the refusal looks like, why it happens, and how an administrator grants access.

Symptom

Sign-in completes against Microsoft, then Avvi shows a page headed Access denied with the address that was used.

For a Global Administrator the message reads:

“Being a Global Administrator in Azure AD doesn’t grant Avvi access on its own.”

Anyone else refused at the same point sees a different line:

“Your account isn’t a member of any authorized group in your organization.”

Both pages end with the same suggestion, to ask an IT administrator or MSP for access, or to confirm the account you signed in with.

Colleagues in the same organization may sign in without any trouble.

Cause

Avvi decides access from its own access groups rather than from directory roles.

Somebody can reset passwords and change almost anything in Microsoft and still have no Avvi access, because nobody has added them to a group Avvi recognizes.

The separation is deliberate.

Avvi manages many client organizations from one place. A directory role that granted platform access on its own would be a wide grant that nobody had reviewed.

Fix

An administrator with master admin access grants this, and most of the work happens in Microsoft rather than in Avvi.

1. In Avvi, open Settings, then Users & Roles.
2. Under Access Groups, note which security group your organization uses.
3. In Microsoft, add the person to that security group.
4. Ask them to sign in to Avvi again.

They reach the portal on their next sign-in. Avvi reads group membership from Microsoft every time it works out what somebody is allowed to do, so nothing further is saved in Avvi.

If something doesn’t look right

If they are in the group and still refused, confirm it is the group listed under Access Groups. Organizations often keep several similarly named groups.

A directory change can take a few minutes to become visible to other services. Waiting briefly and trying again clears most of what is left.

If Avvi cannot reach Microsoft to read group membership, it refuses rather than guessing. To the person signing in that looks the same as having no access.

If the person reaches the portal and is then blocked inside it, this is a different problem. See “You do not have permission to perform this action”.

If the same page appears after all of that, open a support conversation from the Help drawer.

Include the person’s email address, the group you added them to, and your organization name.

What to do next

If you were the person refused, send your administrator the email address you signed in with and the organization you expected to reach.

The change happens in your own Microsoft directory, so it is quick once the right person knows which group to use.

FAQ

Q: I am a Global Administrator. Can I grant myself access?

A: Only by adding yourself to the security group Avvi is mapped to. The directory role on its own does not do it.

Q: Does a client’s own Global Administrator work the same way?

A: Almost. Avvi has one opt-in setting that admits a client’s Global Administrator, and it is off for every client unless somebody has turned it on.

Q: What does that setting grant?

A: A limited access rather than a full one. It never grants the ability to manage everything in that client, and there is no screen for turning it on yourself.

Q: Why does the page single out Global Administrators?

A: They are the people most likely to expect access, so the message gives the reason rather than leaving them to guess.

Q: If I remove the group later, does their access go with it?

A: Yes. Removing a group from Access Groups takes away the permissions it granted. The Microsoft group itself is left alone.