Managing access: Airflow roles
================================

This page covers day-to-day access management for an Airflow instance
secured through **Microsoft Entra ID**: the roles that exist, what each
one can do, and how to grant or revoke them for a user. For the one-time
setup that gets Entra ID sign-in working in the first place, see
:doc:`onboarding-entra-id`.

Roles
------

Two Entra ID **App Roles** are defined on the Airflow Enterprise
Application. They map directly to Airflow's own built-in RBAC roles of
the same tier:

``Airflow User``
   Day-to-day operational access for people who build and run pipelines:

   - View, trigger, pause/unpause, and clear runs for DAGs
   - Browse task logs, Grid/Graph view, and XCom values
   - View (but not edit) connections, variables, and pools

``Airflow Admin``
   Everything **Airflow User** can do, plus platform-administration
   actions:

   - Create, edit, and delete connections, variables, and pools
   - Manage users, roles, and permissions inside Airflow itself
   - Access the Airflow configuration view and DAG import errors panel

A user can hold both roles at once, though there's no real need to:
**Airflow User** is a subset of **Airflow Admin**, so holding Admin
already implies User-level access. There is no separate "read-only
viewer" role; the narrowest access available is **Airflow User**.

Granting a role
-----------------

Do this in the Azure portal, not in Airflow itself. Role membership is
synced *from* Entra ID into Airflow, not the other way around.

1. Sign in to `portal.azure.com <https://portal.azure.com>`_ with an
   account that can manage the Airflow Enterprise Application (the
   **Cloud Application Administrator** account used during onboarding, or
   any account your organization has since granted equivalent rights).

2. Open **Microsoft Entra ID** → **Enterprise Applications**, search for
   **airflow**, and open the application.

3. Click **Manage** → **Users and groups**.

4. To grant a new user or group access: click **Add user/group**, pick
   the user or group, choose **Airflow User** or **Airflow Admin** as the
   role, then **Assign**.

   To change an existing assignment: select the checkbox next to the
   user or group, click **Edit assignment**, pick the role, then save.

   .. tip::
      Prefer assigning roles to a **group** rather than individual users
      where you can — it's one place to add or remove people later,
      instead of editing the Enterprise Application every time someone
      joins or leaves the team.

5. Revoking access works the same way: select the user or group and
   remove the assignment, or delete them from the group the role is
   assigned to.

Role sync timing
------------------

A role change doesn't apply to an already-open Airflow session
immediately. The affected user should log out of Airflow to force
re-sync, then wait before logging back in (sync can take up to 15
minutes). Until then they may still see the old permission set, or a
**403 Forbidden** if this is their first-ever role assignment.