Open Account and check access

Open your installation's Account HTTPS address, for example https://account.your-instance.ecas.local:8443. Account handles login, profile, and administration. Complete account login setup.

MailGen BFF uses another hostname. The operator configures exact addresses and provider callbacks. Login cookies and redirects work only across approved origins. See first login.

Product licenses, group permissions, and models require their corresponding administration rights. A direct URL cannot restore a forbidden menu item.

Prepare an existing installation

From the motherrepo root, bash configureNpmProxyHosts.sh --service account prepares a missing Account proxy host. Inspect its plan and instance before applying. The certificate must cover account.<instance>.ecas.local. The helper preserves existing hosts.

Existing databases need additive schema DB_Lib/Sql/20260930_account_microsoft_bindings.sql, generated Prisma clients in both apps, and compatible Account/AdminService deployments. User and mailbox IDs remain stable.

The tenant marker authorization.actor_rights_migrations records completed actor-rights migration. Its absence does not authorize disabling checks or writing the marker manually.

Automatic Microsoft administrator rights need a working tenant connection and RoleManagement.Read.Directory application permission. Without them, login can work while automatic EcasRoot assignment fails. See Microsoft Graph setup.

After authorized deployment, check Microsoft/local login, the shared BFF session, logout revocation, and exact callback origin. Internal health does not prove public HTTPS host/certificate behavior.