Moved DeviceManagementRBAC.Read.All and Group.Read.All from
'required' to 'granted' section after adding them in Azure AD.
These permissions are now active and will resolve:
- Scope tag IDs to display names
- Group IDs to group names for assignments
Next step: Create new backup to verify scope tag name resolution works.
Changes:
- Status labels: 'ok' → 'granted' (clearer meaning)
- Badge colors: granted=green, missing=orange, error=red
- Updated tests to match new status values
This makes the permission status more intuitive and visually
distinguishable on the Tenant detail page (/admin/tenants/1).
Added two new required permissions for Feature 004:
- DeviceManagementRBAC.Read.All: Resolve scope tag IDs to names
- Group.Read.All: Resolve group IDs for assignments
These permissions will be displayed on the Tenant detail page
(/admin/tenants/1) as 'missing' until added in Azure AD.
Steps to complete setup:
1. Add permissions in Azure AD App Registration
2. Grant admin consent
3. Move permissions from 'Required' to 'Tatsächlich granted' in this config
4. Clear cache: php artisan cache:clear
5. Verify on Tenant detail page
