Routes through Azure Entra ID for authentication only — permission role still comes from MoveDesk's local Users setup.