Pilot auth - real, individual email+password accounts (invite-gated for the pilot). Not yet per-tenant Entra sign-in (each customer's own admins authenticating against their own tenant) - that is future hardening work.