Skip to content
  • There are no suggestions because the search field is empty.

Part 3: Providing Staff restricted access to Princh locations

In this step, you will configure restrictions specifically for the Staff Restricted role. This setup allows selected users to sign in to the Princh Admin Panel with their Microsoft account, but only for the locations explicitly assigned to them

  1. Navigate to https://entra.microsoft.com and sign in with your Entra admin user. In the Azure portal, use the left-hand navigation menu to select “App registrations”.
    Step_1[1]-1

  2. Click "+ New registration" at the top of the App registrations page to create the application.
    1. Name: Specify a name for the application. For example, you could use “Princh-staff-restrictions” or another name that clearly indicates its association with Princh staff restrictions.
    2. Redirect URI: Leave this field blank - no redirect URI is required for Staff Restricted role configuration.
    3. Once completed, click "Register" to create the application.

  3. Once the application has been successfully registered, go to App roles > Create app role.
    Step_3[1]

  4. Select “Create app role” to add a new role to the registered application. Each App Role you define should correspond to a specific Princh location.
    1. If you want to restrict staff users access to only one location, create a single app role. To restrict access to additional locations, repeat this process and create separate app roles in Microsoft Entra for each location.
    Step_4[1]

  5. After creating the App Role(s), go to the “Overview” tab, then click on “Managed application in local directory” to open the Enterprise Application view.
    Step_5[1]-1

  6. In the Enterprise Application view:
    1. Go to Assign users and groups > Add user/group. Select users and assign the relevant App role(s). The user’s assigned App role(s) determine which locations they can access
    Step_6[1]

  7. Log in to the Princh Admin Panel and go to the User Accounts tab. If your Microsoft Tenant is properly connected to Princh, the “+ Add New App Role” button will be visible in the the User Accounts section of the Princh Admin Panel.
    Step_5[1]

  8. For each of the app role you created in Microsoft entra, complete the following steps:
    1. In the Princh Admin Panel, click “+ Add New App Role” and paste in the App Role ID. You can find the App Role IDs in the “App roles” section of the corresponding application in Microsoft Entra. Then, select the Princh location that corresponds to your App Role ID.
    Step_8[1]

  9. Click “Create” to finalize the assignment. This links the App Role to the specific location, ensuring that users with the Staff Restricted role can only access the designated site.
    Step_9[1]

  10. Users assigned the Restricted Staff Role will now be able to log in to the Princh Admin Panel with with restricted access.