> ## Documentation Index
> Fetch the complete documentation index at: https://help.lobyco.com/llms.txt
> Use this file to discover all available pages before exploring further.
# Access to Lobyco Admin Portal
> Connect your Azure AD, grant admin consent, and assign the admin roles that unlock each portal section.
A guide to setting up access to Lobyco Admin Portal
It's important for Lobyco that our clients' employees can easily access the Lobyco Portal. Therefore, we aim to enable them to use their corporate Azure accounts to log in and access the features they are authorized to read or contribute to.
To achieve this, we utilize an Azure Multi-tenant AD setup, which allows managing roles and groups for our Portal Application within your existing Azure AD.
## Configuration values provided by Lobyco
Client needs to share their Azure Tenant ID so that Lobyco can whitelist it and provide following admin portal configuration for pre-production and production environments:
| Environment name | Link | Azure AD app |
| ---------------- | --------------------------------------------------------------------------------------------- | ------------------------- |
| Pre-production | [https://admin.\{client\_name}.pre.lobyco.net/](https://admin.\{client_name}.pre.lobyco.net/) | \{client\_name}-admin-pre |
| Production | [https://admin.\{client\_name}.lobyco.net/](https://admin.\{client_name}.lobyco.net/) | \{client\_name}-admin-pro |
**Note**: links and app names are only for example and may be different according to the requirement. Contact Lobyco to receive configuration values.
## Admin roles
Each tab in the left panel requires the corresponding role — Game Admin, Store Reader, and so on. Which roles are available depends on your client scope.
Two roles are deprecated and kept only for backwards compatibility: `stampCards.admin` (use `challenge.admin`) and `member.admin.read` (use `member.reader`). Do not assign them to new users.
### Promotion Platform
| Role | Grants |
| ------------------------- | ------------------------------------------------------------------------------------------------------- |
| `promotion.admin` | Read and write access to the Promotion admin section |
| `game.admin` | Read and write access to the Game & Gameplay admin sections |
| `challenge.admin` | Read and write access to the Challenge admin section |
| `stampCards.admin` | **Deprecated** — read and write access to the Stamp cards admin section. Use `challenge.admin` instead. |
| `bonus.calculation.admin` | Read and write access to the bonus admin section |
| `feed.admin` | Read and write access to the Feed admin section |
| `push.admin` | Read and write access to the Push admin section |
| `banner.admin` | Read and write access to the Banner admin section |
### Member Management
| Role | Grants |
| ------------------- | ----------------------------------------------------------------------------------------------- |
| `member.admin` | Read and write access to the membership admin section |
| `member.reader` | Read-only access to the membership admin section |
| `member.admin.read` | **Deprecated** — read-only access to the membership admin section. Use `member.reader` instead. |
| `consent.admin` | Read and write access to the consents admin section |
| `consent.reader` | Read-only access to the consents admin section |
### Scan\&Pay
| Role | Grants |
| ------------------- | ---------------------------------------------------- |
| `scanandpay.admin` | Read and write access to the Scan\&Pay admin section |
| `scanandpay.reader` | Read access to the Scan\&Pay admin section |
| `scanandpay.write` | Write access to the Scan\&Pay admin section |
### Segmentation
| Role | Grants |
| ---------------- | ------------------------------------------------------- |
| `audience.admin` | Read and write access to the Segmentation admin section |
### Store Admin
| Role | Grants |
| -------------- | ------------------------------------------------- |
| `store.admin` | Read and write access to the Stores admin section |
| `store.reader` | Read-only access to the Stores admin section |
### System Configuration
| Role | Grants |
| --------------------- | ----------------------------------------------- |
| `dataimport.admin` | Access to the Data Import admin section |
| `eventlog.user` | Read-only access to Lobyco logs section |
| `global.config.admin` | Access to modify Product settings in Admin Tool |
### Other
| Role | Grants |
| -------------------- | ---------------------------------------- |
| `bonus.import.admin` | Access to Bonus bulk adjustments section |
## Access setup in the client tenant
Following steps should be performed in the client's tenant by [Global Administrator](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#cloud-application-administrator), an [Application Administrator](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#cloud-application-administrator), or a [Cloud Application Administrator](https://docs.microsoft.com/en-us/azure/active-directory/users-groups-roles/directory-assign-admin-roles#cloud-application-administrator):
### Open and log in to Lobyco Admin Portal
Open Lobyco Admin Portal of the target environment in the browser and log in using your organization credentials.
### Accept requested permissions
### Verify the empty portal
When permissions are accepted, then an empty Lobyco Admin Portal should be displayed.
### Locate the enterprise application
Go to the Azure portal. Go to Azure Active Directory and then select Enterprise applications. Search for the Lobyco app for the target environment and for the target client in enterprise applications:
### Grant permissions consent
Open the app and go to Permissions. Grant consent on behalf of all users in this directory, so that end users will not be required to consent when using Lobyco Admin Portal application.
### Assign users and groups to roles
Go to Users and Groups.
Press Add user/group button. Select users/security groups and assign roles. A single user or security group can have multiple roles assigned — for example, a user assigned `game.admin` gets access to the game admin section.
**NOTE**: If the client has Azure AD Premium, the admin can assign a security group to a role, and user members of the group will inherit the app role. This is a convenient way to manage roles, because the group owner doesn't need to be an admin or app owner.
### Verify access
Open Lobyco Admin Portal in another tab. The applications and services you have roles for should be available in the left panel:
