OC Home

OC Administration

OC Access Control Instructions

Use this dashboard to manage the inner OC permission layer: who has a role, which subfolders are protected, and which roles or emails can open them.

Admin-only dashboard Entra group still required /oc/access-control

Access Model

Two gates
1. Microsoft / Entra

Paul or IT must add the person to the outer HandiProducts OC Access group before they can reach OC at all.

2. OC Dashboard

OC Access Control decides what that signed-in user can open inside oc.handiproducts.com.

3. Audit

The audit table records allows, denies, and admin edits so access questions can be traced later.

Add A User

User Roles form
Email

Use the full tenant email, usually name@internetengine.onmicrosoft.com. Add the @internetengine.com alias too only when needed.

Role

Assign one of the live roles. Keep role names lowercase and hyphenated.

sales customer-service creative oc-admin
Notes

Use a short reason such as Sales group, Customer Service group, or Nathan-designated OC admin, then click Add User Role.

Protect A Subfolder

Subfolder + rule
  • Subfolder PrefixThe path to protect, starting and ending with a slash, like /customer-service/order-lookup/.
  • App KeyThe permission bucket for that folder, like order-lookup, customer-service, fg-inventory, or photo-tagging.
  • ActionUsually view. Use a different action only for a specific app feature, such as preview_tracking_email.
  • RuleAdd an allow rule that gives a role or email the same app key and action.

Permission Rules

Allow or deny
  • Role rulerole + sales + order-lookup + view + allow lets all Sales users open Order Lookup.
  • Email ruleemail + a full email address is for a one-person exception.
  • Deny ruleUse sparingly. A deny overrides access and is best reserved for a deliberate exception.
  • Admin ruleoc-admin has broad access through *:*. Do not remove the last admin.

Deleting a user role, folder mapping, or rule takes effect immediately. The dashboard blocks deleting your own current oc-admin role, but still treat admin changes like production changes.