Five stages, one direction. An identity is sourced, made authoritative, evaluated for risk, enforced at a gateway, and finally audited — and no stage is optional for any identity class.
Conditional Access sits between authentication and token issuance rather than in front of the application. Enforcing at the identity provider means every relying party inherits the policy without implementing it.
Log Analytics and Sentinel are on the main line, not off to the side. If an access decision is not reconstructable afterwards it has not really been made.
Why these services
Entra ID over a third-party IdP: the estate is Microsoft 365 and Azure, so an external IdP would add a federation hop in front of the system that already holds the directory, without removing the directory.
API Management as the token enforcement point rather than per-service middleware: JWT validation, quota and claims checks become one policy artefact reviewable in a pull request.
Entra External ID as a separate tenant instead of B2C-style policies inside the corporate tenant, so consumer sign-up flows can never be evaluated against workforce roles.
Deliberate omissions
Governance and lifecycle are not on this page; views 17 and 23 carry them end to end.
Secrets and certificates appear only as Key Vault. Their lifecycle is view 18.
Every failure path is omitted here so the happy path stays readable. Views 26 and 27 draw them.
