Admin console access denied (403)

No console identity resolved from the Entra token. Sign in through the enterprise app; break-glass sessions appear in the audit chain exactly as they appear in Sentinel.

The console-only roles sit beyond Council's 8 product roles: CBCity-WHS-PlatformAdmin grants platform-admin and CBCity-WHS-SupportEngineer grants support-engineer. If you believe this is wrong, ask a platform-admin to check your Entra group membership. This denial is itself audited.