What happens at sign-in
the user is redirected to Entra ID, verifies their identity (including multi-factor authentication, if the company requires it), and the app receives a token with their identity. The password never passes through the app.
A company app should have no passwords of its own. Users sign in with the account they already have, and the app asks Entra ID who they are and what they may do. When an employee leaves, it is handled in one place — by disabling the account, not by hunting through apps.
Who is allowed to sign in at all
the app is not published to the whole tenant. Only someone assigned to the app may sign in, and assignment happens through group membership, not per individual.
Roles and permissions
membership in security groups decides what the user sees in the app. IT manages the groups where it always has; the app only asks. Roles are never set inside the app itself.
What the app may read
permissions stay as narrow as possible. Storage access is granted to one specific place, not to the whole tenant; until an administrator allows it, the app sees nothing.