Configure access and LocoDELEGATIONS roles

Microsoft Entra ID controls who can authenticate. LocoDELEGATIONS then uses nominated security-group memberships to determine what an authenticated user can do.

Restrict access to the enterprise application

The council can require users or groups to be assigned to the LocoDELEGATIONS enterprise application. When assignment is required, only assigned users and members of assigned groups can authenticate. Apply this in accordance with the council’s identity and access-management policies.

LocoDELEGATIONS role groups

Create or nominate the security groups agreed with LocoSOFT. The standard application roles are:

• Administrators — full application access, including user-management functions.
• Editors — can maintain application content, including legislation, bylaws and delegations, but do not have Administrator-level user management.

A separate Microsoft Entra security group is required for users who can be assigned as delegates for warrants. The council may use its own group name; LocoDELEGATIONS references the group by its Object ID (GUID), not its display name.

How the groups are used

When a user signs in, LocoDELEGATIONS checks the Microsoft Entra security-group claims and grants the corresponding application permissions. The security groups are not copied or provisioned into LocoDELEGATIONS.

Good access-management practice

• Keep Administrator membership limited to users who genuinely require it.
• Review Administrator and Editor membership regularly.
• Remove access promptly when a person changes role or leaves the council.
• Test each role with a suitable test user before rollout.
• Provide the Object ID (GUID) for each nominated group, including the warrant-delegation group, to LocoSOFT through the agreed secure setup process.

For help confirming the required group design, contact support@locosoft.co.nz.