Skip to content

RBAC · 9.6

Set up RBAC in the settings

If you skipped RBAC in the Initial Setup Wizard or clicked Later, set it up in the settings:

  1. Click Settings… and open the tab RBAC.
  2. Switch on Enable RBAC (role-based access control).
  3. Identity directory: Use the switch to select Active Directory or Entra ID. The directory is used to look up users and groups and for the sign-in to the WebUI. Entra sign-in is available only in the WebUI, so TLSPilot offers to turn on the WebUI when you select Entra ID. The Desktop Admin console continues to use Windows authentication, so roles granted to Entra users and groups do not apply there.
  4. For Entra ID, select the App registration certificate, that is, a certificate with a deployed App registration target, see chapter App registration. TLSPilot shows the Tenant ID, the Application (client) ID, the Redirect URI and the expiry of the certificate from it. Click Run helper to add the Graph permissions User.Read.All and Group.Read.All, the Redirect URI and the admin consent to this app; you sign in as an Entra administrator. Alternatively, click Show script and run the script yourself. The Initial Setup Wizard can create the app registration and its certificate for you. In the WebUI, only Show script is available.
  5. Click Test to verify the connection, then Save. Assign the roles as described in chapter Assign roles.