Roles or individuals? How user permissions are set up

Person by person

Setting permissions function by function for each user is flexible, and it feels precise. Over time, it drifts. Someone covers a colleague and keeps the extra access. A new starter is copied from whoever sat in the seat before. Nobody can say with confidence who can approve a write-off or authorise a client account payment.

By role

Role-based permissions define a small number of personas, such as partner, fee earner, assistant, cashier and administrator, and assign people to them. Joiners, movers and leavers become simple, access stays consistent, and the question "who can do this?" has a clear answer. Genuine exceptions still happen, but they are visible and deliberate.

Separation of duties

Whatever the model, some combinations should never sit with one person: raising, approving and paying the same bill, or creating a supplier and paying them. A good permissions model makes those conflicts impossible, not just discouraged.

What to ask, and what to see

1. Can permissions be assigned by role, with individual exceptions recorded?
2. Show a report of who can do each sensitive action, such as approving write-offs and authorising payments.
3. Are changes to permissions audited, and who can make them?
4. Can roles come from Microsoft Entra groups, so joiners and leavers are handled in one place?