Sign-in and roles | ATX AnalyticsTable Docs

Sign-in and rolesEntra ID sign-in and its three switches, the viewer, analyst and admin roles, how roles are mapped — from Entra, OIDC, SAML or SCIM — service tokens and project roots. A server answers a request only when it carries the shared API token. That answers one question: may this caller talk to this process. A sign-in — Entra ID, OpenID Connect or SAML 2.0 (see Single sign-on with OpenID Connect and SAML 2.0) — answers a different one: who is asking. The two compose; neither replaces the other. A user token is never accepted in place of the shared token, and it travels in its own header, x-analytics-user-token.

Where to find it

Settings → Settings → Set / Restore → Identity (Entra ID)

What this page covers

Two credentials, not one
The three switches
What happens to a request
Configuration
Setting it up in Azure
Roles
Where a person's role comes from
Setting up app roles in Entra ID
Service tokens
Project roots
Read-only SQL for viewers

Settings and controls documented

Sign in with Entra ID
Require sign-in
Run queries as the signed-in user
No tenant configured
A valid user token
An invalid user token
No token, sign-in optional
No token, sign-in required
ANALYTICS_ENTRA_TENANT_ID
ANALYTICS_ENTRA_CLIENT_ID
ANALYTICS_ENTRA_AUDIENCE
ANALYTICS_ENTRA_AUTHORITY_HOST
ANALYTICS_ENTRA_REQUIRE_SIGN_IN
ANALYTICS_ENTRA_ON_BEHALF_OF
Open projects and dashboards, browse tables
Run read-only queries (local DuckDB and connections)
Download what they can see (Excel or CSV of their own view, semantic bundle)
Ask the AI agent
Write SQL that changes data; save projects; import; materialise
Export to databases, e-mail, cloud storage or server folders; schedules; Git
Use shared connections
Create, edit and delete shared connections and mail profiles
Reveal or export stored credentials
Change AI providers and policy, logging, engine limits, identity settings
Install or remove the licence; read the usage ledger
Read the audit trail and the effective role policy
ANALYTICS_RBAC_ROLE_MAP
ANALYTICS_RBAC_DEFAULT_ROLE
ANALYTICS_RBAC_REQUIRE_SIGNIN
ANALYTICS_RBAC_ANALYSTS_MANAGE_CONNECTIONS
ANALYTICS_PROJECT_ROOTS
ANALYTICS_API_TOKENS_FILE

Full page

The full page — procedures and the explanation of every setting — is available to signed-in users.

Glossary terms on this page

ATX Institute on LinkedIn

This site needs JavaScript for the full experience. Every page above is reachable without it.