Enterprise Identity & Access Management Platform

Architecture Views

27 views, in reading order. Every view ships three ways: an HTML page, an SVG that re-opens in diagrams.net fully editable, and draw.io source.

A multi-tenant, zero-trust identity and access platform on Azure covering human, external and workload identity, authentication, layered authorization, privileged access, governance, secrets and auditability. The set reads in six acts: what sits inside the boundary, how the parts fit, where identity data lives and who owns it, what happens at runtime, how it is operated, and why it is safe. Five decisions carry the whole design — a second tenant for customer identity so the boundary is structural rather than procedural (views 03 and 19); managed identity and workload identity federation so long-lived credentials are eliminated instead of rotated (view 15); three separate authorization layers because an app role can never answer whose data a caller may touch (views 08 and 25); zero standing privileged access, with PIM as the only path rather than the preferred one (view 16); and every role, policy and Conditional Access rule deployed as code with drift reconciled daily (view 21).

Context and scope

What the platform is accountable for, which identity classes exist, and where the tenant boundaries fall.

01 System Context Who this platform issues identity to, what it governs access to, and what it deliberately never holds. HTML page SVG draw.io

02 High-Level Architecture The path from an identity source to an authorized action, in one picture. HTML page SVG draw.io

03 Identity Estate & Tenancy Model Which classes of identity exist, and which directory each one lives in. HTML page SVG draw.io

Structure

The layering rule, the components, every interface, the management-group topology, and the three questions authorization has to answer separately.

04 Layered Architecture What depends on what, and the one dependency that points the wrong way. HTML page SVG draw.io

05 Platform Component Architecture What is actually deployed, and the small part of it that we operate. HTML page SVG draw.io

06 Integration Architecture Every way an external system touches identity, with its protocol, direction and cadence. HTML page SVG draw.io

07 Tenant, Management Group & Environment Topology Where role assignments bind, and why a development identity cannot reach production. HTML page SVG draw.io

08 Authorization Layers Four gates, four different questions — and what happens when one is skipped. HTML page SVG draw.io

Data

The entitlement model access decisions read, how an HR record becomes an entitlement, and where identity data lives with its classification and retention.

09 Identity & Entitlement Data Model The state an access decision reads, and how a person joins to a permission. HTML page SVG draw.io

10 Identity Data Flow How a hire in Workday becomes an entitlement in an application, and evidence in an archive. HTML page SVG draw.io

11 Identity Data Zones, Classification & Retention What identity data exists, who owns each zone, and how long it stays. HTML page SVG draw.io

Runtime

The flows that matter: workforce sign-in, API authorization, workload identity, privileged elevation, the joiner-mover-leaver lifecycle, secret rotation and external identity.

12 Workforce SSO & Conditional Access One employee sign-in, including the parts that usually do not happen. HTML page SVG draw.io

13 Conditional Access Policy Matrix Eight personas, and what each is required to prove before access is granted. HTML page SVG draw.io

14 API Authorization One API call, from client token to the row it is allowed to read. HTML page SVG draw.io

15 Workload Identity Patterns Four kinds of workload, and how each proves who it is without holding a secret. HTML page SVG draw.io

16 Privileged Elevation How an administrator obtains production rights, and how they go away again. HTML page SVG draw.io

17 Joiner, Mover, Leaver The lifecycle, including the population that has no leaver event at all. HTML page SVG draw.io

18 Secret & Certificate Lifecycle The loop that has to close without a deployment. HTML page SVG draw.io

19 External Identity A customer signing in, a partner employee reaching a corporate resource, and the line between them. HTML page SVG draw.io

Operations

Where it runs, how an access change reaches production, what is watched, and how entitlements are recertified.

20 Deployment & Network Architecture What runs where, what is private, and which failure domain belongs to whom. HTML page SVG draw.io

21 Identity as Code How an access change reaches production, and what stops a bad one. HTML page SVG draw.io

22 Identity Observability & Detection Seven signal families, and what each one causes to happen. HTML page SVG draw.io

23 Access Review & Recertification Who still needs what, decided by someone who can actually tell. HTML page SVG draw.io

Assurance

The trust boundaries and what crosses them, how tenants are isolated at three layers, the emergency path, and what still fails.

24 Zero-Trust Zones & Enforcement Points Where an attacker arrives, what stops them, and what an administrator still cannot reach. HTML page SVG draw.io

25 Multi-Tenant Isolation Three layers, because each one alone has a known bypass. HTML page SVG draw.io

26 Break-Glass & Identity Recovery The path that exists precisely because every other path has failed. HTML page SVG draw.io

27 Threats & Failure Modes Eight ways this platform is degraded or attacked, and what is left over after the mitigation. HTML page SVG draw.io

Open svg/<view>.svg or drawio/<view>.drawio in draw.io Desktop or at app.diagrams.net to edit. The SVG carries the diagram inside it, so it is both the picture and the source. This folder is self-contained — copy it whole and every link still resolves.