Customer 360 Enterprise Data Platform — Denodo on Azure  ·  View 35 of 39  ·  Assurance

Identity and Access

From a sign-in to a filtered, masked result set — and the one trade-off in the chain.

Editable source SVG draw.io All views
Relationship Manager Power BI Microsoft Entra ID Denodo Load Balancer Virtual DataPort Key Vault SAP S/4HANA Microsoft Sentinel 1. opens the account report 2. OIDC authorisation code flow 3. access token with group claims 4. ODBC connection, bearer token 5. least-busy node 6. validate signature, read claims 7. roles: rm_emea, no_payment_data 8. map roles to view grants 9. fetch the SAP service credential 10. secret, 60-minute lease 11. rows for the delegated predicate 12. row filter by book, mask payment columns 13. authorised rows only 14. principal, view, row count, masks Identity — From a Sign-In to a Filtered, Masked Result Set The source sees the platform identity, not the user. That is a deliberate trade: pass-through authentication was rejected because SAP and Salesforce cannot express the enterprise role model, so the filter must be applied where the model exists. v 1.0 · owner Data & AI Global Practice · date 2026-09

The trade-off, stated plainly

  • The source sees the platform identity, not the user. Pass-through authentication was rejected because SAP and Salesforce cannot express the enterprise role model — a region-scoped, book-scoped, column-masked entitlement has no equivalent in either.
  • The filter is therefore applied where the model exists, which is Denodo. The consequence is that source-side audit shows a service account, and the user-level record lives in Sentinel instead. That is an accepted, documented gap, not an oversight.

Decisions

  • Entra ID is the single identity provider; group claims map to Denodo roles, and roles map to view grants. No entitlement is expressed in a consumer application.
  • Every source credential is leased from Key Vault for 60 minutes. There is no long-lived secret in a configuration file anywhere in the estate.
  • Every query is audited with the principal, the view, the row count and the masks applied — enough to answer who saw what without storing what they saw.

Risks

  • Group sprawl in Entra ID. Roles are provisioned from a small set of named groups with quarterly attestation, because an entitlement model nobody reviews is an entitlement model that only grows.
◀  Trust Zones All views Authorisation Model  ▶
Solution Architecture v1.0 · Data & AI Global Practice · 2026-09 · 39 views · Denodo Platform, Microsoft Azure and open source35-identity-and-access