What is a one sentence summary of your feature request?
After single sign on has been configured (AzureAD), any users added to the provisioned groups should have greated restrcited access and not have a (super or normal) admin roles
Please describe your idea in detail. What is your problem, why do you feel this idea is the best solution, etc.
Upon successful implementation of AzureAD single sign on it would be beneficial for the users that are created to be set up with a read only role initially. Once it is verified that the user should have access (or the level of access) then it should be the responsibility of a super administrator to then determine what level of access the user should have. Instead currently users are created automatically with normal administrative access which allows them access to change settings in areas users shouldn’t have.
How do you currently solve the challenges you have by not having this feature?
Manuel user creation, lack of password rotation and efficent multi-factor authenticaion with geographical controls.