Security Ingest Console

Your sign-in is your Mewah Microsoft 365 account. Passwords and MFA are managed there, not in this console.

• Microsoft 365 sign-in. The browser signs in with MSAL against the Mewah tenant; the API verifies every token's signature, tenant and audience before issuing a session.
• Allow-list. A valid Mewah account is not enough: the email must also be a built-in administrator (config.json) or be added below by an administrator.
• Roles. Admin manages users and everything else. User runs and schedules ingestion and enters secrets.
• Sessions are signed cookies that expire after 12 hours or as soon as an account is disabled, demoted or removed.
• Audit. Sign-ins, denied attempts, user changes, secret updates, runs and schedule changes are logged below.