--- title: "Configure Additional User Permissions in Microsoft Entra ID and Lasernet Core" slug: "configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-core" description: "Describes how to add an app role and add users to it in Entra ID, and then how to create external roles in Lasernet Config and add them to security roles, to enable external users to log in to Lasernet." updated: 2026-08-03T09:28:08Z published: 2026-08-03T09:28:08Z canonical: "kb.lasernetgroup.com/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-core" --- > ## Documentation Index > Fetch the complete documentation index at: https://kb.lasernetgroup.com/llms.txt > Use this file to discover all available pages before exploring further. # Configure Additional User Permissions in Microsoft Entra ID and Lasernet Core **Applies to:** Lasernet Core 11 Lasernet Core uses “security roles” to manage permissions for users. Lasernet Core security roles are bound to app roles in Microsoft Entra ID through Lasernet Core “external roles”. Microsoft Entra ID users and groups can be assigned any number of app roles (that correspond to external roles), thereby enabling granular permission management directly in Microsoft Entra ID. > [!NOTE] > Note > > For more information about Lasernet Core users, groups, and security roles, see [Configure Users, Groups, and Security Roles](/v1/docs/configure-users-and-roles). The process of binding users to specific permissions requires the following steps: 1. [Add an app role to the app registration in Microsoft Entra ID](/v1/docs/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-core#add-a-new-app-role-to-the-azure-app-registration). 2. [Assign users and groups to the app role](/v1/docs/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-core#assign-users-and-groups-to-the-new-app-role). 3. [Add a corresponding external role in Lasernet Config Server](/v1/docs/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-core#add-a-new-external-role-in-lasernet-config-server). 4. [Add and configure a security role in Lasernet Config Server (if necessary)](/v1/docs/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-core#add-a-new-security-role-in-lasernet-config-server). 5. [Add the external role to one or more security roles in Lasernet Config Server](/v1/docs/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-core#configure-new-security-role). The following sections describe how to complete each stage of this process. The example described in the following sections involves configuring Lasernet Core and Microsoft Entra ID to allow specific users to only edit forms in Lasernet Developer. ## Add a New App Role to the Azure App Registration Follow these steps: 1. Navigate to the app registration for Lasernet Core by going to **Azure Portal** > **Microsoft Entra ID** > **App registrations**. 2. After selecting the app registration, navigate to the **App Roles** page and click **Create app role**. 3. Fill in the information as shown. ![The Create app role page in the Azure Portal.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-image-khyb5md0.png) > [!NOTE] > Note > > The name you enter into the **Value** field must match the name that you enter when you later [add an external role in Lasernet Config Server](/v1/docs/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-core#add-a-new-external-role-in-lasernet-config-server). 4. Click **Apply**. ## Assign Users and Groups to the New App Role Follow these steps: 1. Navigate to **Azure Portal** > **Microsoft Entra ID** > **Enterprise applications**. 2. Use the search function to locate the Lasernet Core enterprise application. 3. Click the Lasernet Core enterprise application to modify it. 4. Click **Manage** > **Users and groups**, then click **Add user/group**. 5. Select the users and groups that you want to allow to edit forms in Lasernet Core. 6. Select the **Form Editors** role. 7. Click **Assign**. ## Add a New External Role in Lasernet Config Server The “external role” in Lasernet Core is the glue that binds Azure app roles to Lasernet Core security roles. Every app role you define in the Azure app registration must have a corresponding external role in Lasernet Core. The binding between an Azure app role and a Lasernet Core external role is done by name, so it is important that the **Name** field of the external role matches the **Value** field of the corresponding Azure app role. An external role can be assigned to one or more security roles. The steps for adding an external role depend on which tool you are using. ### Manage 1. [Sign in to Manage](/v1/docs/sign-in-to-the-lasernet-core-administration-tool). 2. In the **User Management** menu (see 1 in the image below), click **External Roles**. ![A number-annotated screenshot that indicates the User Management menu and the New Role button on the External Roles page.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/external roles new role button.png) 3. Click **New Role** (2). 4. Enter a **Name** and **Description** for the external role. ![The Add External Role window with a Name and Description entered into it.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/external roles add external role.png) > [!WARNING] > Important > > Ensure that **Name** matches the **Value** that you entered when [you created the app role](/v1/docs/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet#add-a-new-app-role-to-the-azure-app-registration). 5. Click **Confirm**. ### Lasernet Config Web App > [!NOTE] > **Note** > > The Lasernet Config web app was provided with earlier versions of Lasernet Core. It is a legacy web app and will be deprecated in a future version of Lasernet Core. **Expand for information** 1. Navigate and log in to the Lasernet Config Server web app. 2. Go to the **External Roles** page then click **Add**. ![The Add button on the External Roles page of the Lasernet Config web app.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-image-adgltzii.png) 3. Add a **Name** and **Description** for the external role. ![The Add External Role window.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-image-c5agtwqm.png) > [!WARNING] > Important > > Ensure that **Name** matches the **Value** that you entered when [you created the app role](/v1/docs/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet#add-a-new-app-role-to-the-azure-app-registration). 4. Click **OK**. ## Add a New Security Role in Lasernet Config Server A security role defines which permissions are granted to its members. Security roles are separated into areas corresponding to the different Lasernet Core applications. The steps for adding a security role depend on which tool you are using. ### Manage 1. In the **User Management** menu, click **Security Roles**. ![The Security Roles menu item.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/external roles security roles menu item.png) 2. Click the **Config & Developer** tab (see 1 in the image below). 3. Click **New Role** (2). ![A number-annotated screenshot of the Security Roles page with the Config & Developer tab and New Role button annotated.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/external roles security roles page.png) 4. Enter a **Name** and **Description** for the security role. ![The Add Security Role window with a Name and Description entered in it.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/external roles add security role.png) 5. Click **Confirm** to create the security role. ### Lasernet Config Web App > [!NOTE] > **Note** > > The Lasernet Config web app was provided with earlier versions of Lasernet Core. It is a legacy web app and will be deprecated in a future version of Lasernet Core. **Expand for information** 1. Navigate to the **Security Roles** page, click **Config Server and Developer**, then click **Add**. ![The Add button on the Security Roles page of the Lasernet Config web app.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-image-1sabbxyc.png) 2. Enter a **Name** and **Description** for the role. ![The Add Config Server and Developer Role window.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-image-wkqlzsgq.png) 3. Click **OK**. ## ## Configure the New Security Role In this example, the newly created security role must be configured to only allow access to edit forms. The users assigned this role will be able to edit forms, but will be unable to do any tasks in Manage (or the Lasernet Config web app), and will be unable deploy configurations to environments. They will also be unable to access any part of a configuration in the Lasernet Developer other than the forms (in that configuration). The steps for configuring a security role depend on which tool you are using. ### Manage 1. Click the newly added security role. 2. In the **Security** area of the role editing pane for the **Form Editors** role: - Remove all items from the **Administrative Rights** list. - Remove all items except **Forms** from the **Lasernet Developer** list. 3. In the **Deployment** area, remove all items from the **Environment Deployment Access** list. ![The security role editing panel for the Form Editors security role.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/external roles configure example security role 1.png) 4. In the **Members** area, add **Editor.Form** to the **Security Role Members** list. ![The Security Role Members list contains the Editor.Form item.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/external roles configure example security role 2.png) 5. Click **Confirm**. The users that you selected when you [assigned users and groups to the new app role](/v1/docs/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-core#assign-users-and-groups-to-the-new-app-role) will now be asked for their Microsoft Entra ID credentials when they start Lasernet Developer. After they sign in, they will be able to edit forms. ### Lasernet Config Web App > [!NOTE] > **Note** > > The Lasernet Config web app was provided with earlier versions of Lasernet Core. It is a legacy web app and will be deprecated in a future version of Lasernet Core. **Expand for information** 1. Select the newly added security role, then click **Edit**. ![The Edit button on the Security Roles page of the Lasernet Config web app.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-image-62lvuflp.png) 2. On the **Security** tab, clear all checkboxes except **Forms**. ![The Security tab with only the Forms checkbox selected.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-image-0yt4uf7o.png) 3. On the **Deployment** tab, clear all checkboxes. ![The Deployment tab with no environment checkboxes selected.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-image-apririrj.png) 4. On the **Members** tab: 1. Click **Add** 2. Select **Editor.Form** (the newly created Lasernet Core external role) from the **Select group to add** list. 3. Click **OK**. ![The Add Role Member window.](https://cdn.document360.io/c831ef63-c6b3-48ee-b443-3e33644e4e2e/Images/Documentation/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-image-v8t2s9pl.png) 5. Click **OK** in the security role editing window to save your changes to the security role. The users that you selected when you [assigned users and groups to the new app role](/v1/docs/configure-additional-user-permissions-in-microsoft-entra-id-and-lasernet-core#assign-users-and-groups-to-the-new-app-role) will now be asked for their Microsoft Entra ID credentials when they start Lasernet Developer. After they sign in, they will be able to edit forms.