Permissions | QOCS Square Analytics

Least-privilege access

Application permissions

Prepare who can report, operate tools, and change settings before Microsoft Entra sign-in is enabled. These rules remain dormant while Microsoft 365 authentication is disabled.

Admin Microsoft sign-in setup

QOCS.AdminSettings

Admin Settings

All application access, including credentials, authentication, permissions, SharePoint, and configuration.

QOCS.FullAccess

Full Access

Reports plus operational tools such as stocktake, catalogue, expiry, recovery, and EOFY workflows. No admin settings.

QOCS.ReportingAccess

Reporting Access

Read-only dashboards, live displays, reports, filters, printing, and exports. No operational changes or settings.

Exact-user assignments

Use comma-separated Microsoft email addresses for a small deployment or as an emergency override. If a person appears in more than one list, the settings will not save.

Admin Settings users Keep this to the one or two people trusted with credentials and application configuration. Full Access users Can run stocktake, catalogue, recovery, expiry, and EOFY tools, but cannot open Admin. Reporting Access users Can view dashboards and reports, apply report filters, print, and export. Cannot submit changes. Access for an authenticated but unassigned user No access is safest. Choose Reporting Access only if every account allowed to sign in should see reports.

Back to admin

Recommended Entra setup

For the cutover, create these app roles in the Entra app registration, then assign users or groups from the Enterprise application. Entra assignments take effect at the person’s next sign-in.

QOCS.AdminSettings
Admin Settings
QOCS.FullAccess
Full Access
QOCS.ReportingAccess
Reporting Access

If both an exact-user assignment and an Entra app role exist, exact-user assignment wins. Higher local access lists are checked first: Admin, Full, then Reporting.