Skip to main content
ThinkPlatform uses Microsoft Entra authentication for human sign-in. An eligible tenant user may sign in automatically, but organization and project access still depend on ThinkPlatform membership and roles.

​
Resolve a person’s access

  1. Ask the person to confirm the account, organization, and project selected in the browser.
  2. If sign-in fails, check the identity provider’s message and involve the organization’s identity administrator. If sign-in succeeds but the project is missing, check organization membership and the project role using Members and permissions.
  3. After any authorized membership change, have the person reopen the project and verify the specific resource and operation they need.
A successful sign-in establishes identity; it does not itself grant access to every project or action.

​
Review agent and workspace authority

Agent visibility, configured tools, and approval requirements are separate from the person’s membership. A workspace can use a managed identity for external services; its grants are distinct from the signed-in person’s role. When a workload is denied, identify the actor, selected project, allowed paths, tool restrictions, and underlying resource permissions. Grant only the access required and verify the intended operation at its destination. Workspace creation does not configure secret injection or network policy. Arrange and verify those controls with the deployment administrator. The API rejects writes containing the legacy secrets or internet_access fields. See Operate agent workspaces.

​
Check developer access

For programmatic sign-in and configuration, see SDK authentication and the developer overview. If a request is denied, check the identity and project context used by that request as well as the displayed error; a browser session does not automatically resolve a missing runtime grant.