Controlling who can see what apps and how that shifts with changes role is done through groups and active directory. So, for example, if a person is hired as an HR manager, they'll be added to an HR group or an HR distribution list in Azure. If that person changes their role to the marketing team, they would be removed from the HR group and added to the marketing group. So, we can deploy applications based on those same groups to update their account. So, they transition from one role to the next; what they see in that store and that company portal reflects their position.