docs(governance): require User.Read.All for Entra group access

[andrewconnor-arcade]

Summary

The group access page says an Entra ID backend needs only GroupMember.Read.All. With only that permission, Microsoft Graph refuses every user-centric membership lookup, so every gated tool is hidden from every caller, including group members. This changes the Entra section to require User.Read.All as well, and says what each permission is for.

What we saw

While setting up group access with the Entra backend for the Arcadia Wealth demo project, we granted GroupMember.Read.All (application, admin consent granted; the app's token carried roles: ["GroupMember.Read.All"]). A member of the required group was refused (tool_not_found) the same as an unknown user.

Probing Graph with the same app's credentials:

Call	GroupMember.Read.All only	plus User.Read.All
GET /users/{upn}/memberOf	403	200
GET /users/{objectId}/memberOf	403	200
GET /users/{objectId}/transitiveMemberOf	403	200
POST /users/{objectId}/checkMemberGroups	403	200

This matches Microsoft's docs for listing another user's memberships, which list no app-only path through GroupMember.Read.All.

After adding User.Read.All and waiting out the 5-minute membership cache, the group member's Math.Add call completed and an unknown user was still refused.

Change

• The Entra ID app permissions section now lists both permissions in a table, with what breaks without each.
• The warning callout now says neither permission is enough on its own. The old callout's point about User.Read.All alone returning IDs without names is kept in the table row for GroupMember.Read.All.

Draft until the end-to-end setup is fully confirmed.

🤖 Generated with Claude Code

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated
docs	Ready	Preview	Oct 13, 2026 12:22am UTC