> ## Documentation Index
> Fetch the complete documentation index at: https://docs.thinkplatform.ai/llms.txt
> Use this file to discover all available pages before exploring further.

> ## Agent Instructions
> Choose User guide for browser tasks, Developers for CLI, SDK and external agents, and Administration for organization management.
> Confirm identity and organization/project context before operations. Documentation access does not grant ThinkPlatform permissions.
> Review side effects, verify changes with a read, and do not blindly retry an operation with an uncertain outcome.
> Use documented UI steps for the web app and documented public CLI or SDK interfaces for automation. Follow each page’s prerequisites and authentication requirements.

# Security and authentication

> Understand user sign-in and the separate authority of agents and workspaces.

ThinkPlatform uses Microsoft Entra authentication for human sign-in. An eligible tenant user may sign in automatically, but organization and project access still depend on ThinkPlatform membership and roles.

## Resolve a person's access

1. Ask the person to confirm the account, organization, and project selected in the browser.
2. If sign-in fails, check the identity provider's message and involve the organization's identity administrator. If sign-in succeeds but the project is missing, check organization membership and the project role using [Members and permissions](https://docs.thinkplatform.ai/admin/members-and-permissions.md).
3. After any authorized membership change, have the person reopen the project and verify the specific resource and operation they need.

A successful sign-in establishes identity; it does not itself grant access to every project or action.

## Review agent and workspace authority

Agent visibility, configured tools, and approval requirements are separate from the person's membership. A workspace can use a managed identity for external services; its grants are distinct from the signed-in person's role. When a workload is denied, identify the actor, selected project, allowed paths, tool restrictions, and underlying resource permissions. Grant only the access required and verify the intended operation at its destination.

Workspace creation does not configure secret injection or network policy. Arrange and verify those controls with the deployment administrator. The API rejects writes containing the legacy `secrets` or `internet_access` fields. See [Operate agent workspaces](https://docs.thinkplatform.ai/guides/operations/workspaces.md).

## Check developer access

For programmatic sign-in and configuration, see [SDK authentication](https://docs.thinkplatform.ai/python-sdk/authentication.md) and the [developer overview](https://docs.thinkplatform.ai/developers/overview.md). If a request is denied, check the identity and project context used by that request as well as the displayed error; a browser session does not automatically resolve a missing runtime grant.


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.