# Enterprise Identity & Access Management Platform **Solution Architecture v1.0 · Data & AI Global Practice · 2026-08 · 27 views · Microsoft Azure** A multi-tenant, zero-trust identity and access platform on Azure covering human, external and workload identity, authentication, layered authorization, privileged access, governance, secrets and auditability. Five decisions carry the design: a second tenant for customer identity so the boundary is structural rather than procedural; managed identity and workload identity federation so long-lived credentials are eliminated instead of rotated; three separate authorization layers, because an app role can never answer whose data a caller may touch; zero standing privileged access, with PIM as the only path rather than the preferred one; and every role, policy and Conditional Access rule deployed as code with drift reconciled daily. --- ## What is here | Path | Contents | |---|---| | `diagrams/index.html` | The view index — 27 views grouped into six acts, every format linked | | `diagrams/*.html` | One self-contained page per view: the inlined diagram plus the reasoning it deliberately omits, with copy / PNG / PDF export | | `diagrams/svg/*.svg` | The same 27 views as SVG with the diagram XML embedded — re-opens in diagrams.net fully editable | | `diagrams/drawio/*.drawio` | draw.io native source | | `specs/views.json` | Diagram specifications — the source of truth for every view (assembled from `part-a..f.json`) | | `specs/manifest.json` | Acts, page titles, subtitles and the decision / assumption / risk cards (assembled from `manifest-a..b.json`) | | `scripts/build.sh` | Rebuilds every deliverable from the specs | | `ask.md` | The original requirement | Every component carries its own mark — 512 icons embedded in the files, so the deliverable renders identically anywhere with no external requests. Each view page links to its own SVG and draw.io source, back to the index, and to the previous and next view. To rebuild after editing a spec: ```bash bash scripts/build.sh # requires Node 20+ and draw.io Desktop ``` Edit `specs/part-a.json` … `part-f.json` and `specs/manifest-a.json` / `manifest-b.json`; the build script assembles `views.json` and `manifest.json` from them. --- ## The six acts | Act | What it lands | Views | |---|---|---| | 1 · Context and scope | The boundary, the identity classes, and where the tenant boundaries fall | 01–03 | | 2 · Structure | Layering rule, components, every interface, management-group topology, the three authorization questions | 04–08 | | 3 · Data | The entitlement model, how an HR record becomes an entitlement, classification and retention | 09–11 | | 4 · Runtime | Sign-in, API authorization, workload identity, elevation, lifecycle, secrets, external identity | 12–19 | | 5 · Operations | Where it runs, how access changes ship, what is watched, how entitlements are recertified | 20–23 | | 6 · Assurance | Trust zones, tenant isolation, the emergency path, and what still fails | 24–27 | --- ## The 27 views | # | View | Layout | What it answers | |---|---|---|---| | 01 | System Context | context | Who this platform issues identity to, and what it governs access to | | 02 | High-Level Architecture | flow | The path from an identity source to an authorized action | | 03 | Identity Estate & Tenancy Model | nested | Which classes of identity exist, and which directory each lives in | | 04 | Layered Architecture | bands | What depends on what, and the one dependency pointing the wrong way | | 05 | Platform Component Architecture | nested | What is deployed, and the small part of it we operate | | 06 | Integration Architecture | hub | Every interface, with protocol, direction and cadence | | 07 | Tenant, MG & Environment Topology | nested | Where role assignments bind, and why DEV cannot reach PROD | | 08 | Authorization Layers | flow | Four gates, four different questions, from claim to row | | 09 | Identity & Entitlement Data Model | er | The state an access decision reads | | 10 | Identity Data Flow | flow | HR record to entitlement to evidence, with cadence | | 11 | Identity Data Zones & Retention | nested | Who owns each zone of identity data, and how long it stays | | 12 | Workforce SSO & Conditional Access | sequence | One employee sign-in, including what usually does not happen | | 13 | Conditional Access Policy Matrix | grid | Eight personas, and what each must prove | | 14 | API Authorization | sequence | One API call, from client token to the row it may read | | 15 | Workload Identity Patterns | swimlane | Four workload classes proving identity without a secret | | 16 | Privileged Elevation | sequence | How production rights are obtained, and how they expire | | 17 | Joiner, Mover, Leaver | swimlane | The lifecycle, including the population with no leaver event | | 18 | Secret & Certificate Lifecycle | cycle | The rotation loop that closes without a deployment | | 19 | External Identity | sequence | Customer sign-in, partner federation, and the line between them | | 20 | Deployment & Network Architecture | nested | What runs where, what is private, whose failure domain is whose | | 21 | Identity as Code | flow | How an access change reaches production, and what stops a bad one | | 22 | Identity Observability & Detection | grid | Seven signal families, and what each causes to happen | | 23 | Access Review & Recertification | flow | Who still needs what, decided by someone who can tell | | 24 | Zero-Trust Zones & Enforcement | zones | Where an attacker arrives, and what stops them | | 25 | Multi-Tenant Isolation | nested | Three isolation layers, because each alone has a known bypass | | 26 | Break-Glass & Identity Recovery | flow | The path that exists because every other path has failed | | 27 | Threats & Failure Modes | grid | Eight degradations, with the residual risk after each mitigation | --- ## Stated assumptions Every figure below is an exercise assumption. They shape log retention cost, review campaign size and the group model, so they are the first things to confirm with the client. - 45,000 employees, 8,000 contractors, 6,500 B2B guests, 1.2M customer identities - 3,400 workload identities across 900 applications and 22 subscriptions in four environments - 2.6M sign-ins per day, peaking near 420 per second; 240 GB per day of identity telemetry - EU data residency for directory data and logs - Workday as the HR system of record, two AD DS forests remaining, ServiceNow for approvals - RTO 4 hours for tenant-level recovery; 90-day interactive log retention, 7 years for privileged-access evidence ## Open items for the client - **170 service principals still hold client secrets.** Needs a funded burn-down with dates, or explicit acceptance with a named owner (views 15, 27). - **Tier 1 privileged roles require a single approver.** Raising it to two costs activation latency; the trade is the client's to make (view 16). - **Layer 3 authorization lives in application code** the platform does not own. The shared library and contract tests reduce but do not remove that exposure (views 08, 25). - **Per-application SCIM provisioning health has no alert.** A visible gap on view 22 rather than a hidden one.