Enterprise Identity & Access Management Platform · View 21 of 27 · Operations

Identity as Code

How an access change reaches production, and what stops a bad one.

Editable source SVG draw.io All views

Bicep for Azure RBAC and Policy, Terraform with the azuread provider for directory objects, Conditional Access policies as JSON. One repository, one review path, one history.
The deploy identity federates and activates through PIM for 60 minutes. A pipeline with a standing Owner role is the most over-privileged principal in most estates, and this one does not exist between deployments.
Portal changes are detected rather than blocked. The drift detector raises a pull request within 24 hours, so an emergency fix is reconciled instead of being punished — controls that block incident response get switched off.

What-if or plan output is posted on every pull request and a destructive change to a role assignment blocks the merge outright.
IAM code owners enforce a two-person rule on anything touching privileged roles, Conditional Access or break-glass exclusions.
Conditional Access changes serve 14 days in report-only with an impact query before enforcement. That is a schedule constraint on the change, not a suggestion.

A misconfigured Conditional Access policy can lock out the tenant. Break-glass exclusions are asserted by a test in the pipeline, and view 26 is the recovery path when the assertion is wrong.
Terraform state for directory objects is itself sensitive; it lives in a storage account with a private endpoint and its own RBAC, and is never in the repository.
Emergency changes bypass the pipeline by design. They must be reconciled within 24 hours, and the reconciliation rate is a reported metric.