For IT administrators

How to let your organization sign in to Rogue Productions with Microsoft work accounts, and control who gets which role — from your own Microsoft Entra tenant.

Short version: sign in to Organization with your admin work account, choose Connect with Microsoft, approve, then assign people or groups to Rogue Productions roles. Everything below explains exactly what that does.

The two Rogue Productions apps

App (as shown by Microsoft)	Used for	Permissions
Rogue Productions `ebb177f4-a5ef-4ca7-9376-660fb8889018`	Signing your people in. This is the app that appears in your Enterprise applications once approved.	Delegated only: `openid`, `profile`, `email` (Microsoft Graph). No application permissions. No mail, files, calendar or directory access.
Rogue Productions – Organization Setup `c16f7142-961d-4afe-8c3d-46c42051f76e`	Only when you choose to manage access from inside Rogue Productions. You sign in to it; changes are made as you, while you’re present.	Delegated only: `Application.ReadWrite.All` (assignment-required and visibility on the Rogue Productions app, and removing it on disconnect), `AppRoleAssignment.ReadWrite.All` (assigning roles), `User.ReadBasic.All` and `GroupMember.Read.All` (people and group pickers), `Policy.Read.All` (read-only: which Conditional Access policies apply to Rogue Productions). No application permissions, no offline access, nothing kept after your session (at most one hour).

Delegated permissions never exceed what your own admin account can do. When you approve the Organization Setup app you can grant consent only for yourself — you don’t need to grant it for your whole organization.

Connecting your organization

Sign in to account.rogueproductions.net with your work account (create a Rogue Productions account with it if needed).
Open Organization → Connect with Microsoft. Microsoft asks you to approve Rogue Productions for your organization (tenant-wide consent for sign-in).
Rogue Productions confirms — with a fresh, Microsoft-signed sign-in — that you hold one of: Global Administrator, Privileged Role Administrator, Cloud Application Administrator or Application Administrator. You become the organization’s Owner.
Start an administrator session (sign in to Organization Setup), choose a tier, turn on assignment required, and assign people. Refresh the roster to activate.

Two ways to run access

Tier	How it works	Best for
Assigned access	Turn on “assignment required”. Everyone you assign — with any role or Microsoft’s default access — is a Member. Assign Owner/Admin/Billing Admin to a few people as needed.	“Everyone on this team can use it.”
Role-managed	People get exactly the Rogue Productions roles you assign, and nothing without one.	Mixed audiences, delegated administration, billing separated from use.

Roles (app roles on the “Rogue Productions” enterprise app)

Role	App role value	In Rogue Productions they can
Owner	`RP.Owner`	Everything: security settings, tier, transfer ownership, disconnect, delete
Admin	`RP.Admin`	Members, roles, access settings, roster refresh, sign members out, activity
Billing Admin	`RP.BillingAdmin`	Organization plans, seats and billing
Member	`RP.Member`	Use what the organization provides

You can assign roles in Rogue Productions (administrator session) or in the Microsoft Entra admin center (Enterprise applications → Rogue Productions → Users and groups). Assigning groups requires Microsoft Entra ID P1 or higher; nested group members are included.

Recommended settings

Assignment required: On — only assigned people can sign in (Microsoft refuses everyone else).
Visible to users: your choice — On shows a tile in My Apps / the Microsoft 365 launcher.
Re-check interval: 60 minutes by default; 15 or 30 for faster offboarding. Each check applies your tenant’s current rules.
Separate passwords on managed accounts: Off — so removing someone in Entra really removes them.
Accept Microsoft MFA: Off unless your Conditional Access requires MFA for Rogue Productions and you want to skip the Rogue Productions code. What it trusts

Conditional Access

Target the Rogue Productions enterprise application (or “All cloud apps”) like any other app. Your policies — MFA, compliant devices, locations, sign-in risk, sign-in frequency — are enforced by Microsoft at every sign-in and at every re-check. Rogue Productions shows which of your policies apply on the Organization overview (read-only).

Guests (B2B)

By default only members of your tenant get organization roles. Turn on Include guests and share your organization sign-in link (Organization → Overview): guests who sign in through it get the roles you assign them.

Doing it without the Rogue Productions pages (PowerShell)

Prefer your own tooling? Download Setup-RogueProductionsOrg.ps1 (Microsoft Graph PowerShell; safe to re-run; supports -WhatIf). It can:

add the Rogue Productions app to your tenant and grant tenant-wide consent for openid profile email;
set assignment required and My Apps visibility;
assign users or groups to roles from parameters or a CSV;
report assignments and the Conditional Access policies that apply;
-Disconnect: remove both Rogue Productions apps from your tenant.

After running it, an administrator still connects the organization once from Organization so Rogue Productions knows who its Owner is.

Revoking or disconnecting

Remove a person: remove their assignment. With assignment required, Microsoft stops their sign-ins; Rogue Productions ends their organization sessions at the next roster refresh or re-check.
Pause everyone: disable the Rogue Productions enterprise app (Enabled for users to sign in? No).
Leave entirely: Organization → Danger zone → Disconnect (optionally also removing our apps from your tenant). You choose whether accounts you managed become personal accounts or are paused.
Deleting the enterprise app in Entra also works; Rogue Productions detects it and marks the organization “consent revoked”.

Data handling

We store, per person: Microsoft’s account identifier and tenant identifier (to recognise them), display name and email hint, roles, and sign-in times. Tenant and object identifiers are never put in tokens we issue and never shown to other customers.
We don’t store Microsoft tokens. An administrator’s Organization Setup access token lives only in their encrypted session for at most an hour.
Roster entries for removed people are deleted after 90 days.

Publisher

Both apps are published by Rogue Productions (publisher domain RogueProductions.net). Microsoft shows the publisher and its verification status on the consent screen.

Still stuck? Contact Rogue Productions support — include the “Reference” shown on any sign-in error page. This guide describes how sign-in works today; it is updated with every change to it.