Understand Account login and administrator access

Use your installation's Account application when enabled. Login and registration requests go to that service. Start with account setup and first login.

A valid session differs from product permission. Login grants neither automatic mailbox access nor administrator rights. Connect the mailbox separately after login.

For redirect errors, ask the operator to check exact Account/BFF addresses and callbacks. See Microsoft setup or Google setup.

Check administrator access

A verified Microsoft identity alone is not administrator authority. Account establishes verified identity binding. AdminService checks current roles and group rights. Automatic root needs an active Global Administrator role. Eligible-only PIM is insufficient.

An older unbound account can receive 503 when required BFF bootstrap is unavailable. Do not bypass authorization to hide it.

An authorized operator can inspect /api/admin/context isRoot with a designated first-login Account-only Global Administrator. Revocation or deactivation must remove automatic rights on the next request. Another tenant or non-administrator cannot receive automatic root. Manual grants remain independent.

Use a designated test identity for authorized role checks. Missing provider connections do not justify root or general permission.