Team & Roles

M365Suite uses role and scope together. A role controls which actions a person can perform. A scope limits which SharePoint sites those actions apply to.

Roles

Admin

Admins have tenant-wide access. They can manage users, connection settings, backup settings, credentials, backup deletion, tenant disconnect, and purge actions. They can back up and restore all tenant sites.

Hub Manager

Hub Managers can view, back up, restore, and delete versions for assigned hubs and their spokes. At least one hub scope is required.

Site Manager

Site Managers can view, back up, restore, and delete versions for assigned SharePoint site URLs. At least one site scope is required.

Type Manager

Type Managers can view, back up, restore, and delete versions for sites matching assigned site types. At least one site-type scope is required.

Viewer

Viewers can inspect backup history, version data, comparisons, and exports. They cannot start backups, restore, delete versions, or change tenant settings. A Viewer with no assigned scope is tenant-wide read-only. A Viewer with scopes is limited to those scopes.

Guest

Guests have signed in but do not have an M365Suite role yet. They cannot see site or backup data. They can request access from an administrator.

How access is assigned

A user becomes an admin after completing verified tenant consent or supported BYOA setup. Administrators can also invite people or update an existing user's role through Access & Roles in the Command Center.

Signing in by itself does not grant access. A guest can request access, and an admin can assign a role and any required scope. The portal and API reject Hub Manager, Site Manager, and Type Manager assignments without at least one scope, so an operator cannot be approved into an unusable scoped role.

Invite a person

1. Open Access & Roles as an admin.
2. Choose Invite user.
3. Enter the person's email address.
4. Choose a role.
5. Add scope rules when the role requires them.
6. Optionally add a message.
7. Send the invitation.

A pending invitation is redeemed when a matching user signs in, provided the invitation is still valid and has not been revoked. If an existing user is invited, the portal can update that user's role and scopes instead of creating a separate pending invitation.

Scope matching

• Hub scope matches the hub and associated spokes using stored structural hub data.
• Site scope matches the normalized SharePoint URL.
• Site-type scope matches the classified site type.

The server enforces tenant isolation, permission, and scope. Hiding an action in the interface does not grant or remove authorization.