Partner Admin Setup Guide – Manage who can sign in to the Onboarding Portal
This guide describes how a partner company manages access to the Exflow Cloud Onboarding Portal: which accounts can sign in, and how a Microsoft Entra administrator grants the Partner admin role so your company can maintain that list itself.
How access works
Sign-in to the portal is managed per partner. Your company has a partner entry, and only the email addresses listed as consultants on that entry can sign in. Consultants sign in with their Microsoft work account; no separate password is needed.
Two kinds of users exist on the partner side:
- Consultants can deploy, edit, delete, restart and migrate your company's own deployments.
- Partner admins can do the same, and additionally maintain the consultant list of your company's entry in the portal. If your company has several entries that belong together (for example one per country), a Partner admin can also view the deployments of the whole group, while changes stay on their own entry.
The Partner admin role is granted in your own Microsoft Entra tenant. Truvio does not need to be involved once the application is present in your tenant.
Step 1: Make sure the application is present in your tenant
The portal appears in your tenant as an enterprise application the first time a user from your company signs in to it.
- Ask a colleague who is already a listed consultant to sign in to the portal once, or sign in yourself if your email is listed.
- Sign in to the Azure portal as a Microsoft Entra administrator.
- Navigate to Microsoft Entra ID > Enterprise applications and confirm that signup-xfw-onboarding-prod is listed.
If your tenant blocks user consent for applications from other organizations, the first sign-in ends with a "Consent required" message. A tenant administrator then has to grant consent once; the application appears under Enterprise applications afterwards.
Step 2: Assign the PartnerAdmin App Role
- Sign in to the Azure portal.
- Navigate to Microsoft Entra ID > Enterprise applications.
- Locate and open signup-xfw-onboarding-prod from Step 1.
- Go to Users and groups > Add user/group.
- Under Users, select the colleague who should manage access for your company.
- Under Select a role, choose
PartnerAdmin. - Click Assign.
The role does not grant sign-in by itself. The person must also be a listed consultant on your company's partner entry. If they are not listed yet, ask an existing Partner admin to add them, or contact ExFlow support.
Step 3: Sign out and back in
Roles are read when a user signs in. After the assignment in Step 2, the new Partner admin signs out of the portal and back in once. The Partners tab then appears in the portal.
Step 4: Add or remove consultants in the portal
- Sign in to the portal and open the Partners tab. It shows your company's entry.
- Expand the entry and press Edit consultants.
- Press Add consultant and enter the colleague's email address, with an optional name. To remove someone, delete their row.
- Press Save.
New consultants can sign in right away with their Microsoft work account. Removed consultants lose access within minutes.
You cannot remove your own email address. Another Partner admin, or ExFlow support, has to do that, so a company can never lock itself out by accident.
What a Partner admin can and cannot do
| Capability | Consultant | Partner admin |
|---|---|---|
| Sign in | listed consultant | listed consultant |
| See deployments | own partner entry | every entry in the company group |
| Deploy, edit, delete, restart, migrate | own partner entry | own partner entry |
| Add or remove consultants | — | own partner entry |
| Rename the entry, change its group or former names | — | — (contact support) |
Entries of other companies in the same group open in a read-only view.
Troubleshooting
- "You do not have access. Please contact our support team for Registration." – The signed-in email address is not a listed consultant on any partner entry. Ask your Partner admin to add it (Step 4), or contact ExFlow support. Check that you signed in with your work account, not a personal one.
- The Partners tab is missing after the role was assigned – Sign out and back in (Step 3). If it is still missing, confirm in Step 2 that the role was assigned on the correct application and to the correct user.
- "Consent required" during sign-in – Your tenant requires an administrator to consent to the application once. See the note in Step 1.
- "Duplicate email" when saving consultants – Saving validates the whole consultant list, not only the row you changed. The flag sits under the second occurrence of a duplicated address; remove one of the pair and save again.