mirror of
https://github.com/okieselbach/AutopilotMonitor.git
synced 2026-10-24 04:32:32 +00:00
Oliver Kieselbach
dd4975b73e
A caller whose token shows it is not a member of the token's tenant (acct = 1, a #EXT# user name, or an idp naming another tenant, a personal Microsoft account or an external sign-in provider) no longer seeds DomainName/OnboardedBy or queues the activation, is never the first-user Tenant Admin, and cannot set the activation-page address in the roleless signup window. Positive evidence only: a token without these signals stays a member's, and tid/idp are read under their inbound-mapped names as well. Activation promotes OnboardedBy only; the UpdatedBy fallback is gone and a stored #EXT# UPN is refused. Explicit grants (TenantAdmins row, app role) still apply. The once-per-interval log gate of the client-app binding becomes Helpers/LogThrottle and also throttles the new warning, which the polling activation page would otherwise repeat. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>