Currently, the Manager field on the User [sys_user] table is maintained by an external source and is configured as read-only. As part of the Entra integration enhancement, this field needs to be populated during user creation rather than waiting for a subsequent update process.
The challenge is that write access needs to be granted exclusively to the Entra integration account for updating the Manager field during user creation. Even though the integration account has the admin role, the requirement is to prevent all other users, including administrators, from modifying this field manually while still allowing the Entra integration to update it. The current access controls are not enforcing this distinction as expected and require further evaluation.
