diff --git a/.gitleaksignore b/.gitleaksignore
index 4bca537f..cbfb0ad5 100644
--- a/.gitleaksignore
+++ b/.gitleaksignore
@@ -109,3 +109,9 @@ feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_proces
 feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:131
 feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:150
 feafe758d7c1e85472cc81c5c275aae9ec078cef:tests/services/dicom/test_upload_processor.py:ipv4:174
+
+# Ignore the SCREENING_ENTRA_GROUP_ID
+infrastructure/environments/prod/variables.tfvars:generic-api-key:2
+infrastructure/environments/preprod/variables.tfvars:generic-api-key:2
+infrastructure/environments/dev/variables.tfvars:generic-api-key:2
+infrastructure/environments/review/variables.tfvars:generic-api-key:2
diff --git a/infrastructure/environments/dev/variables.tfvars b/infrastructure/environments/dev/variables.tfvars
index a1042038..0ba14f7a 100644
--- a/infrastructure/environments/dev/variables.tfvars
+++ b/infrastructure/environments/dev/variables.tfvars
@@ -1 +1,2 @@
-enable_gateway_test_vm = true
+enable_gateway_test_vm   = true
+screening_entra_group_id = "f20d9f9a-b1ac-4875-a5e1-f9dfc0307c34"
diff --git a/infrastructure/environments/preprod/variables.tfvars b/infrastructure/environments/preprod/variables.tfvars
index f560dcbc..34c404fa 100644
--- a/infrastructure/environments/preprod/variables.tfvars
+++ b/infrastructure/environments/preprod/variables.tfvars
@@ -1 +1,2 @@
 # All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true
+screening_entra_group_id = "ab8fd001-2722-4118-9659-3d4425db7894"
diff --git a/infrastructure/environments/prod/variables.sh b/infrastructure/environments/prod/variables.sh
index 6bc7e584..8f96ca86 100644
--- a/infrastructure/environments/prod/variables.sh
+++ b/infrastructure/environments/prod/variables.sh
@@ -7,5 +7,7 @@ HUB=prod
 ENABLE_SOFT_DELETE=true
 ADO_MANAGEMENT_POOL=private-pool-prod-uks
 CLOUD_API_HOSTNAME=manage-breast-screening.nhs.uk
+SCREENING_ENTRA_GROUP_ID="3b2b22b0-ac8e-4904-a94b-9010ff08698a"
 # ring1 = first real sites (one per PACS vendor)
+# To onboard more rings: set GATEWAY_RINGS="ring0 ring1 ring2 ..." in this file
 GATEWAY_RINGS="ring1"
diff --git a/infrastructure/environments/prod/variables.tfvars b/infrastructure/environments/prod/variables.tfvars
index f560dcbc..7a560678 100644
--- a/infrastructure/environments/prod/variables.tfvars
+++ b/infrastructure/environments/prod/variables.tfvars
@@ -1 +1,2 @@
 # All values use defaults: enable_gateway_test_vm = false, enable_arc_servers = true
+SCREENING_ENTRA_GROUP_ID = "3b2b22b0-ac8e-4904-a94b-9010ff08698a"
diff --git a/infrastructure/environments/review/variables.tfvars b/infrastructure/environments/review/variables.tfvars
index a1042038..2a9578a0 100644
--- a/infrastructure/environments/review/variables.tfvars
+++ b/infrastructure/environments/review/variables.tfvars
@@ -1 +1,2 @@
-enable_gateway_test_vm = true
+enable_gateway_test_vm   = true
+screening_entra_group_id = "14f915c3-ef0a-471b-b9bf-31187d18f8b6"
diff --git a/infrastructure/modules/arc-infra/arc.tf b/infrastructure/modules/arc-infra/arc.tf
index 58ab3b44..d8d7127b 100644
--- a/infrastructure/modules/arc-infra/arc.tf
+++ b/infrastructure/modules/arc-infra/arc.tf
@@ -12,11 +12,12 @@ data "azuread_service_principal" "arc_onboarding" {
   display_name = "spn-azure-arc-onboarding-screening-${var.env_config}"
 }
 
+# Awaiting approval from Administrator team, a bit of push back with regards to giving Group.Read.All permission to the service principal, so for now we will use the group ID from the environment variable instead of looking it up by name.
 # Look up the Entra ID group that manages this environment
-data "azuread_group" "screening" {
-  count        = var.enable_arc_servers ? 1 : 0
-  display_name = "screening_${var.app_short_name}_${var.env_config}"
-}
+# data "azuread_group" "screening" {
+#   count        = var.enable_arc_servers ? 1 : 0
+#   display_name = "screening_${var.app_short_name}_${var.env_config}"
+# }
 
 # Assign "Azure Connected Machine Onboarding" role to allow Arc server enrollment
 module "arc_onboarding_role" {
@@ -37,5 +38,8 @@ module "arc_wac_admin_login_role" {
 
   scope                = data.azurerm_resource_group.arc_enabled_servers[0].id
   role_definition_name = "Windows Admin Center Administrator Login"
-  principal_id         = data.azuread_group.screening[0].object_id
+  # Awaiting approval from Administrator team, a bit of push back with regards to giving Group.Read.All permission to the service principal, so for now we will use the group ID from the environment variable instead of looking it up by name.
+  # principal_id         = data.azuread_group.screening[0].object_id
+  principal_id = var.screening_entra_group_id
+
 }
diff --git a/infrastructure/modules/arc-infra/variables.tf b/infrastructure/modules/arc-infra/variables.tf
index 412cfe8b..cd2fb9f2 100644
--- a/infrastructure/modules/arc-infra/variables.tf
+++ b/infrastructure/modules/arc-infra/variables.tf
@@ -28,3 +28,8 @@ variable "static_arc_machine_names" {
   type        = list(string)
   default     = []
 }
+
+variable "screening_entra_group_id" {
+  description = "Group ID for the environment"
+  type        = string
+}
diff --git a/infrastructure/modules/gateway-test-vm/vm.tf b/infrastructure/modules/gateway-test-vm/vm.tf
index f3fab2ca..020e385e 100644
--- a/infrastructure/modules/gateway-test-vm/vm.tf
+++ b/infrastructure/modules/gateway-test-vm/vm.tf
@@ -39,8 +39,8 @@ module "gateway_test_vm" {
 
   account_credentials = {
     admin_credentials = {
-      username                          = "arcadmin"
-      password                          = data.azurerm_key_vault_secret.vm_admin_password.value
+      username                           = "arcadmin"
+      password                           = data.azurerm_key_vault_secret.vm_admin_password.value
       generate_admin_password_or_ssh_key = false
     }
   }
diff --git a/infrastructure/terraform/main.tf b/infrastructure/terraform/main.tf
index ac3fbfc1..fe5dbb42 100644
--- a/infrastructure/terraform/main.tf
+++ b/infrastructure/terraform/main.tf
@@ -6,11 +6,12 @@ module "arc_infra" {
     azuread = azuread
   }
 
-  region              = local.region
-  app_short_name      = var.app_short_name
-  env_config          = var.env_config
-  resource_group_name = local.resource_group_name
-  enable_arc_servers  = var.enable_arc_servers
+  region                   = local.region
+  app_short_name           = var.app_short_name
+  env_config               = var.env_config
+  resource_group_name      = local.resource_group_name
+  enable_arc_servers       = var.enable_arc_servers
+  screening_entra_group_id = var.screening_entra_group_id
 
   # Create the HC for the test VM in the same run as VM creation.
   # The Arc data source won't see a machine registered in the same apply.
diff --git a/infrastructure/terraform/variables.tf b/infrastructure/terraform/variables.tf
index db894346..21a73b95 100644
--- a/infrastructure/terraform/variables.tf
+++ b/infrastructure/terraform/variables.tf
@@ -44,6 +44,11 @@ variable "bastion_sku" {
   default     = "Standard"
 }
 
+variable "screening_entra_group_id" {
+  description = "Group ID for the environment"
+  type        = string
+}
+
 variable "gateway_test_vm_size" {
   description = "SKU size for the gateway test VM"
   type        = string