[ { "id": "01-system-context", "title": "Enterprise Identity & Access Platform — System Context", "layout": "context", "canvas": { "width": 1700 }, "colWidth": 260, "system": { "label": "Enterprise Identity & Access Platform", "sub": "Zero-trust · multi-tenant · Azure" }, "groups": [ { "side": "left", "title": "Human identities", "nodes": [ { "id": "emp", "label": "Employees", "sub": "45,000", "kind": "actor", "rel": "SSO + passwordless", "dir": "in" }, { "id": "con", "label": "Contractors", "sub": "8,000 · sponsored", "kind": "actor", "rel": "time-bound package", "dir": "in" }, { "id": "adm", "label": "Privileged administrators", "sub": "190 role holders", "kind": "actor", "rel": "JIT elevation", "dir": "in" }, { "id": "bg", "label": "Break-glass accounts", "sub": "2 · standing", "kind": "risk", "rel": "emergency only", "dir": "in", "icon": "fa5_fire_extinguisher" } ] }, { "side": "top", "title": "External identities", "nodes": [ { "id": "part", "label": "Partner workforce", "sub": "34 partner tenants", "kind": "external", "rel": "B2B cross-tenant", "dir": "in" }, { "id": "cust", "label": "Customers", "sub": "1.2M CIAM", "kind": "external", "rel": "sign-up / sign-in", "dir": "in", "icon": "azure_users" } ] }, { "side": "right", "title": "Systems of record", "nodes": [ { "id": "hr", "label": "Workday HCM", "kind": "external", "rel": "worker records, hourly", "dir": "in", "kind2": "batch" }, { "id": "adds", "label": "On-premises AD DS", "kind": "external", "rel": "hybrid sync", "kind2": "bidirectional", "icon": "azure_AzureActiveDirectoryDomainServices (Identity)" }, { "id": "saas", "label": "SaaS applications", "sub": "900 apps", "kind": "external", "rel": "SSO + SCIM", "kind2": "sync", "icon": "azure_software-as-a-service" }, { "id": "snow", "label": "ServiceNow", "kind": "external", "rel": "approvals, tickets", "kind2": "bidirectional" } ] }, { "side": "bottom", "title": "Workloads and resources under control", "nodes": [ { "id": "azure", "label": "Azure resource estate", "sub": "22 subscriptions", "kind": "external", "rel": "Azure RBAC", "icon": "azure_subscriptions" }, { "id": "aks", "label": "AKS & app workloads", "sub": "3,400 workload IDs", "kind": "external", "rel": "workload identity", "icon": "azure_aks" }, { "id": "cicd", "label": "CI/CD pipelines", "sub": "GitHub · Azure DevOps", "kind": "external", "rel": "OIDC federation", "icon": "azure_AzurePipelines (DevOps)" }, { "id": "sec", "label": "Security operations", "sub": "Sentinel · Defender", "kind": "external", "rel": "identity signals", "kind2": "async", "icon": "azure_sentinel" } ] } ], "note": "Every arrow is an identity relationship. Business data flows between these systems are deliberately absent: this platform decides who may move that data, it never carries it.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "02-high-level-architecture", "title": "High-Level Architecture — one identity, end to end", "layout": "flow", "canvas": { "width": 1780 }, "chain": true, "align": "top", "stages": [ { "title": "Identity sources", "nodes": [ { "id": "hr", "label": "Workday HCM", "sub": "authoritative for people", "kind": "external" }, { "id": "adds", "label": "On-prem AD DS", "sub": "legacy apps only", "kind": "external", "icon": "azure_AzureActiveDirectoryDomainServices (Identity)" }, { "id": "pidp", "label": "Partner Entra tenants", "kind": "external", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "signup", "label": "Customer sign-up", "sub": "self-service", "kind": "external", "icon": "azure_azure-ad-b2c" } ] }, { "title": "Identity authority", "nodes": [ { "id": "entra", "label": "Microsoft Entra ID", "sub": "corporate tenant", "kind": "security", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "extid", "label": "Entra External ID", "sub": "CIAM tenant", "kind": "security", "icon": "azure_azure-ad-b2c" }, { "id": "prov", "label": "Inbound provisioning", "sub": "API-driven, hourly", "kind": "integration", "icon": "azure_entra-connect-sync" }, { "id": "sync", "label": "Entra Cloud Sync", "sub": "AD DS to cloud", "kind": "integration", "icon": "azure_entra-connect-sync" } ] }, { "title": "Access decision", "nodes": [ { "id": "ca", "label": "Conditional Access", "sub": "policy decision point", "kind": "security", "icon": "azure_conditional-access" }, { "id": "idp", "label": "Entra ID Protection", "sub": "risk signals", "kind": "security", "icon": "azure_entra-id-protection" }, { "id": "auth", "label": "Authentication methods", "sub": "FIDO2 · passkey · TAP", "kind": "security", "icon": "azure_multi-factor-authentication" }, { "id": "pim", "label": "Entra PIM", "sub": "JIT elevation", "kind": "security", "icon": "azure_entra-privleged-identity-management" } ] }, { "title": "Enforcement & authorization", "nodes": [ { "id": "apim", "label": "API Management", "sub": "JWT validation", "kind": "integration", "icon": "azure_api-management-services" }, { "id": "rbac", "label": "Azure RBAC", "sub": "resource authorization", "kind": "platform", "icon": "azure_entra-identity-roles-and-administrators" }, { "id": "roles", "label": "App roles & scopes", "sub": "application authorization", "kind": "platform", "icon": "azure_app-registrations" }, { "id": "kv", "label": "Azure Key Vault", "sub": "RBAC data plane", "kind": "security", "icon": "azure_key-vaults" } ] }, { "title": "Resources & assurance", "nodes": [ { "id": "res", "label": "Azure resource estate", "sub": "22 subscriptions", "kind": "app", "icon": "azure_subscriptions" }, { "id": "apps", "label": "Applications & AKS", "sub": "managed identity", "kind": "app", "icon": "azure_aks" }, { "id": "law", "label": "Log Analytics", "sub": "240 GB/day", "kind": "store", "icon": "azure_log-analytics-workspaces" }, { "id": "sent", "label": "Microsoft Sentinel", "sub": "identity detections", "kind": "security", "icon": "azure_sentinel" } ] } ], "edges": [ { "from": "idp", "to": "ca", "label": "risk level", "kind": "async" }, { "from": "pim", "to": "rbac", "label": "time-bound", "kind": "sync" }, { "from": "entra", "to": "law", "label": "sign-in & audit logs", "kind": "async", "route": "gutter" }, { "from": "law", "to": "sent", "label": "analytics rules", "kind": "sync" } ], "note": "The control plane drawn once, left to right. Governance, secret rotation and the failure paths are omitted here and carried by views 17, 18 and 27.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "03-identity-estate-and-tenancy", "title": "Identity Estate & Tenancy Model", "layout": "nested", "canvas": { "width": 1720 }, "boxes": [ { "title": "Corporate Entra tenant — contoso.com", "kind": "cloud", "dir": "col", "children": [ { "title": "Workforce identities — HR-sourced, never hand-created", "kind": "boundary", "nodes": [ { "id": "emp", "label": "Employees", "sub": "45,000", "kind": "actor" }, { "id": "con", "label": "Contractors", "sub": "8,000 · expiry mandatory", "kind": "actor" }, { "id": "adm", "label": "Administrators", "sub": "190 · eligible only", "kind": "actor" }, { "id": "bg", "label": "Break-glass", "sub": "2 · permanent Global Admin", "kind": "risk", "icon": "fa5_fire_extinguisher" } ] }, { "title": "Guest identities — governed by cross-tenant access settings", "kind": "boundary", "nodes": [ { "id": "b2b", "label": "B2B guests", "sub": "6,500 · 90-day review", "kind": "external" }, { "id": "ptn", "label": "Partner tenants", "sub": "34 · inbound trust", "kind": "external", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "mfa", "label": "Trusted MFA claims", "sub": "cross-tenant inbound", "kind": "security" } ] }, { "title": "Workload identities — no human owner, always an app owner", "kind": "boundary", "nodes": [ { "id": "mi", "label": "Managed identities", "sub": "2,600 · user + system", "kind": "security", "icon": "azure_entra-managed-identities" }, { "id": "fic", "label": "Federated credentials", "sub": "640 · OIDC subjects", "kind": "security", "icon": "azure_AzureAppRegistration (Identity)" }, { "id": "appreg", "label": "App registrations", "sub": "900 · roles & scopes", "kind": "platform", "icon": "azure_app-registrations" }, { "id": "sp", "label": "Secret-bearing SPs", "sub": "170 · legacy, decreasing", "kind": "risk" } ] } ] }, { "title": "Entra External ID tenant — customers.contoso.com", "kind": "cloud", "dir": "row", "children": [ { "title": "Customer identities", "kind": "boundary", "nodes": [ { "id": "cust", "label": "Customer accounts", "sub": "1.2M", "kind": "external", "icon": "azure_users" }, { "id": "social", "label": "Social & partner IdPs", "sub": "Google · Apple · SAML", "kind": "external", "icon": "azure_users" } ] }, { "title": "Customer-facing applications", "kind": "boundary", "nodes": [ { "id": "cweb", "label": "Customer web & mobile", "sub": "user flows", "kind": "app" }, { "id": "capi", "label": "Customer APIs", "sub": "tenant-scoped tokens", "kind": "integration" } ] } ] } ], "outside": [ { "id": "hr", "label": "Workday HCM", "sub": "system of record", "kind": "external" }, { "id": "adds", "label": "On-prem AD DS", "sub": "Kerberos apps", "kind": "external", "icon": "azure_AzureActiveDirectoryDomainServices (Identity)" } ], "edges": [ { "from": "hr", "to": "emp", "label": "provisioning, hourly", "kind": "batch" }, { "from": "adds", "to": "emp", "label": "Cloud Sync", "kind": "sync", "icon": "azure_entra-connect-sync" }, { "from": "ptn", "to": "b2b", "label": "invited, sponsored", "kind": "sync" }, { "from": "social", "to": "cust", "label": "federated sign-up", "kind": "sync" }, { "from": "sp", "to": "fic", "label": "migration target", "kind": "error" } ], "note": "Two tenants, one platform. The line between them is a tenant boundary rather than a policy, so no customer identity can ever be evaluated against a corporate administrative role.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "04-layered-architecture", "title": "Layered Architecture — what depends on what", "layout": "bands", "canvas": { "width": 1700 }, "layerHeaderWidth": 168, "bands": [ { "name": "Experience", "nodes": [ { "id": "wf", "label": "Workforce apps", "sub": "browser · desktop · mobile", "kind": "app" }, { "id": "adminp", "label": "Admin portals", "sub": "Azure · Entra · M365", "kind": "app" }, { "id": "cx", "label": "Customer web & mobile", "kind": "app" }, { "id": "myacc", "label": "My Access self-service", "sub": "request · review · attest", "kind": "app" } ] }, { "name": "Access enforcement", "nodes": [ { "id": "afd", "label": "Front Door + WAF", "kind": "integration", "icon": "azure_front-door-and-cdn-profiles" }, { "id": "apim", "label": "API Management", "sub": "validate-jwt policy", "kind": "integration", "icon": "azure_api-management-services" }, { "id": "gsa", "label": "Entra Private Access", "sub": "legacy app access", "kind": "integration", "icon": "azure_entra-private-access" }, { "id": "proxy", "label": "Application Proxy", "sub": "on-prem web apps", "kind": "integration", "icon": "azure_api-proxy" } ] }, { "name": "Identity authority", "nodes": [ { "id": "entra", "label": "Microsoft Entra ID", "sub": "OIDC · OAuth2 · SAML", "kind": "security", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "extid", "label": "Entra External ID", "kind": "security", "icon": "azure_azure-ad-b2c" }, { "id": "ca", "label": "Conditional Access", "sub": "policy decision point", "kind": "security", "icon": "azure_conditional-access" }, { "id": "idprot", "label": "ID Protection", "sub": "user & sign-in risk", "kind": "security", "icon": "azure_entra-id-protection" } ] }, { "name": "Authorization", "nodes": [ { "id": "rbac", "label": "Azure RBAC", "sub": "MG · sub · RG · resource", "kind": "platform", "icon": "azure_entra-identity-roles-and-administrators" }, { "id": "approle", "label": "App roles & scopes", "sub": "carried in the token", "kind": "platform", "icon": "azure_app-registrations" }, { "id": "pim", "label": "Entra PIM", "sub": "eligible, not active", "kind": "platform", "icon": "azure_entra-privleged-identity-management" }, { "id": "pdp", "label": "Application policy engine", "sub": "tenant + row decisions", "kind": "platform" } ] }, { "name": "Governance & secrets", "nodes": [ { "id": "gov", "label": "Entra ID Governance", "sub": "packages · reviews · LCW", "kind": "platform", "icon": "azure_AzureIdentityGovernance (Identity)" }, { "id": "kv", "label": "Azure Key Vault", "sub": "secrets · keys · certs", "kind": "security", "icon": "azure_key-vaults" }, { "id": "pol", "label": "Azure Policy", "sub": "deny · audit · DINE", "kind": "platform", "icon": "azure_policy" }, { "id": "iac", "label": "Identity as code", "sub": "Bicep + Terraform", "kind": "platform", "icon": "terraform" } ] }, { "name": "Resource plane", "nodes": [ { "id": "subs", "label": "Azure subscriptions", "sub": "22 · 4 environments", "kind": "app", "icon": "azure_subscriptions" }, { "id": "aks", "label": "AKS clusters", "sub": "workload identity", "kind": "app", "icon": "azure_aks" }, { "id": "data", "label": "Data services", "sub": "SQL · Cosmos · Storage", "kind": "store", "icon": "azure_sql-database" }, { "id": "saas", "label": "SaaS applications", "sub": "SSO + SCIM", "kind": "external", "icon": "azure_software-as-a-service" } ] }, { "name": "Telemetry", "nodes": [ { "id": "mon", "label": "Azure Monitor", "kind": "platform", "icon": "azure_monitor" }, { "id": "law", "label": "Log Analytics", "sub": "90-day interactive", "kind": "store", "icon": "azure_log-analytics-workspaces" }, { "id": "sent", "label": "Microsoft Sentinel", "sub": "identity analytics", "kind": "security", "icon": "azure_sentinel" }, { "id": "def", "label": "Defender for Cloud", "sub": "posture & CIEM", "kind": "security", "icon": "azure_defender" } ] } ], "edges": [ { "from": "apim", "to": "entra", "label": "OIDC metadata, JWKS", "kind": "sync" }, { "from": "ca", "to": "rbac", "label": "authorized principal", "kind": "sync" }, { "from": "pim", "to": "gov", "label": "eligibility & reviews", "kind": "sync" }, { "from": "iac", "to": "subs", "label": "role assignments", "kind": "sync" }, { "from": "subs", "to": "law", "label": "diagnostic settings", "kind": "async" }, { "from": "pdp", "to": "entra", "label": "group lookup on the request path", "kind": "error" } ], "note": "Dependencies point downward. The single upward call, an application resolving group membership from Graph while serving a request, is drawn red because it turns the identity service into a runtime dependency; view 27 carries its mitigation.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "05-platform-components", "title": "Platform Component Architecture", "layout": "nested", "canvas": { "width": 1740 }, "boxes": [ { "title": "Enterprise Identity & Access Platform — Azure", "kind": "cloud", "dir": "col", "children": [ { "title": "Identity control plane — configured SaaS, no infrastructure we run", "kind": "boundary", "nodes": [ { "id": "entra", "label": "Entra ID tenant", "sub": "directory + STS", "kind": "security", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "extid", "label": "External ID tenant", "sub": "CIAM user flows", "kind": "security", "icon": "azure_azure-ad-b2c" }, { "id": "ca", "label": "Conditional Access", "sub": "38 policies", "kind": "security", "icon": "azure_conditional-access" }, { "id": "pim", "label": "PIM", "sub": "roles + groups", "kind": "security", "icon": "azure_entra-privleged-identity-management" } ] }, { "title": "Provisioning & lifecycle", "kind": "boundary", "nodes": [ { "id": "inb", "label": "Inbound provisioning API", "sub": "Function · Workday feed", "kind": "integration", "icon": "azure_entra-connect-sync" }, { "id": "sync", "label": "Cloud Sync agents", "sub": "2 per AD forest", "kind": "integration", "icon": "azure_entra-connect-sync" }, { "id": "scim", "label": "SCIM outbound", "sub": "142 gallery apps", "kind": "integration" }, { "id": "lcw", "label": "Lifecycle Workflows", "sub": "joiner · mover · leaver", "kind": "integration", "icon": "azure_logic-apps" } ] }, { "title": "Governance & policy as code", "kind": "boundary", "nodes": [ { "id": "gov", "label": "ID Governance", "sub": "access packages", "kind": "platform", "icon": "azure_AzureIdentityGovernance (Identity)" }, { "id": "appr", "label": "Approval connector", "sub": "Logic Apps to ServiceNow", "kind": "integration", "icon": "azure_logic-apps" }, { "id": "iac", "label": "IaC repository", "sub": "Bicep + Terraform azuread", "kind": "platform", "icon": "terraform" }, { "id": "drift", "label": "Drift detector", "sub": "Function, daily what-if", "kind": "platform" } ] }, { "title": "Enforcement & secrets", "kind": "boundary", "nodes": [ { "id": "apim", "label": "API Management", "sub": "internal VNet mode", "kind": "integration", "icon": "azure_api-management-services" }, { "id": "afd", "label": "Front Door + WAF", "kind": "integration", "icon": "azure_front-door-and-cdn-profiles" }, { "id": "kv", "label": "Key Vault per environment", "sub": "RBAC · purge protection", "kind": "security", "icon": "azure_key-vaults" }, { "id": "hsm", "label": "Managed HSM", "sub": "signing & root keys", "kind": "security" } ] }, { "title": "Telemetry & detection", "kind": "boundary", "nodes": [ { "id": "diag", "label": "Diagnostic settings", "sub": "tenant + subscription", "kind": "integration" }, { "id": "eh", "label": "Event Hubs", "sub": "log fan-out", "kind": "queue", "icon": "azure_event-hubs" }, { "id": "law", "label": "Log Analytics workspace", "sub": "240 GB/day", "kind": "store", "icon": "azure_log-analytics-workspaces" }, { "id": "sent", "label": "Sentinel", "sub": "27 identity rules", "kind": "security", "icon": "azure_sentinel" } ] } ] } ], "outside": [ { "id": "hr", "label": "Workday HCM", "kind": "external" }, { "id": "adds", "label": "AD DS forests", "sub": "2", "kind": "external", "icon": "azure_AzureActiveDirectoryDomainServices (Identity)" }, { "id": "saas", "label": "SaaS estate", "sub": "900 apps", "kind": "external", "icon": "azure_software-as-a-service" }, { "id": "cicd", "label": "GitHub & Azure DevOps", "kind": "external", "icon": "azure_azure-devops" }, { "id": "snow", "label": "ServiceNow", "kind": "external" } ], "edges": [ { "from": "hr", "to": "inb", "label": "worker API, hourly", "kind": "batch" }, { "from": "adds", "to": "sync", "label": "LDAP, 2-min delta", "kind": "sync" }, { "from": "scim", "to": "saas", "label": "SCIM 2.0", "kind": "sync" }, { "from": "appr", "to": "snow", "label": "REST approval", "kind": "sync" }, { "from": "cicd", "to": "iac", "label": "pull request", "kind": "sync" }, { "from": "eh", "to": "sent", "label": "streamed events", "kind": "async" } ], "note": "Four components are ours to operate: the provisioning Function, the Cloud Sync agents, the approval connector and the drift detector. Everything else is configured Microsoft service, which is the point.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "06-integration-architecture", "title": "Integration Architecture — every identity interface", "layout": "hub", "canvas": { "width": 1720 }, "left": { "title": "Inbound — systems that call the platform", "nodes": [ { "id": "hr", "label": "Workday HCM", "sub": "worker API", "kind": "external", "rel": "hourly worker delta", "kind2": "batch" }, { "id": "adds", "label": "AD DS forests", "sub": "2 forests", "kind": "external", "rel": "Cloud Sync, 2 min", "kind2": "sync", "icon": "azure_AzureActiveDirectoryDomainServices (Identity)" }, { "id": "ptn", "label": "Partner Entra tenants", "sub": "34", "kind": "external", "rel": "cross-tenant OIDC", "kind2": "sync", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "cxapp", "label": "Customer applications", "kind": "external", "rel": "OIDC + PKCE", "kind2": "sync" }, { "id": "cicd", "label": "GitHub & Azure DevOps", "kind": "external", "rel": "OIDC federation", "kind2": "sync", "icon": "azure_azure-devops" }, { "id": "aks", "label": "AKS clusters", "sub": "11 clusters", "kind": "external", "rel": "projected SA token", "kind2": "sync", "icon": "azure_aks" } ] }, "centre": { "title": "Enterprise Identity & Access Platform", "nodes": [ { "id": "entra", "label": "Entra ID tenant", "sub": "STS + directory", "kind": "security", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "extid", "label": "Entra External ID", "sub": "CIAM tenant", "kind": "security", "icon": "azure_azure-ad-b2c" }, { "id": "apim", "label": "API Management", "sub": "token enforcement", "kind": "integration", "icon": "azure_api-management-services" } ] }, "right": { "title": "Outbound — systems the platform calls", "nodes": [ { "id": "saas", "label": "SaaS estate", "sub": "900 apps", "kind": "external", "rel": "SCIM 2.0 + SAML", "dir": "out", "kind2": "sync", "icon": "azure_software-as-a-service" }, { "id": "arm", "label": "Azure Resource Manager", "kind": "external", "rel": "role assignments", "dir": "out", "kind2": "sync", "icon": "azure_subscriptions" }, { "id": "snow", "label": "ServiceNow", "kind": "external", "rel": "approvals & JML tickets", "dir": "out", "kind2": "sync" }, { "id": "kv", "label": "Key Vault estate", "sub": "18 vaults", "kind": "external", "rel": "certificate issuance", "dir": "out", "kind2": "sync", "icon": "azure_key-vaults" }, { "id": "sent", "label": "Microsoft Sentinel", "kind": "external", "rel": "log stream, near real time", "dir": "out", "kind2": "async", "icon": "azure_sentinel" }, { "id": "teams", "label": "Teams & Exchange", "kind": "external", "rel": "approval notifications", "dir": "out", "kind2": "async" } ] }, "note": "Twelve interfaces, none of them bespoke: eleven are Microsoft-supported connectors or standard protocols, and only the Workday inbound feed is custom code we maintain.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "07-tenant-and-environment-topology", "title": "Tenant, Management Group & Environment Topology", "layout": "nested", "canvas": { "width": 1760 }, "boxes": [ { "title": "Microsoft Entra tenant — contoso.com · the identity boundary for every scope below", "kind": "trust", "dir": "col", "children": [ { "title": "Platform management group — run by the platform team, never by application teams", "kind": "cloud", "dir": "row", "children": [ { "title": "Identity subscription", "kind": "boundary", "nodes": [ { "id": "psync", "label": "Cloud Sync agents", "kind": "integration", "icon": "azure_entra-connect-sync" }, { "id": "pkv", "label": "Platform Key Vault", "kind": "security", "icon": "azure_key-vaults" } ] }, { "title": "Management subscription", "kind": "boundary", "nodes": [ { "id": "plaw", "label": "Log Analytics", "sub": "tenant-wide", "kind": "store", "icon": "azure_log-analytics-workspaces" }, { "id": "psent", "label": "Sentinel", "kind": "security", "icon": "azure_sentinel" } ] }, { "title": "Connectivity subscription", "kind": "boundary", "nodes": [ { "id": "phub", "label": "Hub VNet + Firewall", "kind": "platform", "icon": "azure_virtual-networks" }, { "id": "ppe", "label": "Private DNS zones", "kind": "platform", "icon": "azure_dns-zones" } ] } ] }, { "title": "Landing zone management groups — RBAC differs by environment, and only by environment", "kind": "cloud", "dir": "row", "children": [ { "title": "DEV", "kind": "boundary", "nodes": [ { "id": "dsub", "label": "6 subscriptions", "kind": "app", "icon": "azure_subscriptions" }, { "id": "drole", "label": "Contributor, standing", "sub": "team group", "kind": "platform", "icon": "azure_entra-identity-roles-and-administrators" } ] }, { "title": "TEST", "kind": "boundary", "nodes": [ { "id": "tsub", "label": "4 subscriptions", "kind": "app", "icon": "azure_subscriptions" }, { "id": "trole", "label": "Contributor, standing", "sub": "engineering group", "kind": "platform", "icon": "azure_entra-identity-roles-and-administrators" } ] }, { "title": "STAGE", "kind": "boundary", "nodes": [ { "id": "ssub", "label": "3 subscriptions", "kind": "app", "icon": "azure_subscriptions" }, { "id": "srole", "label": "PIM eligible", "sub": "no approval, MFA", "kind": "security", "icon": "azure_entra-privleged-identity-management" } ] }, { "title": "PROD — stricter by construction", "kind": "trust", "nodes": [ { "id": "psub", "label": "5 subscriptions", "kind": "app", "icon": "azure_subscriptions" }, { "id": "prole", "label": "PIM eligible", "sub": "approval + MFA + 4 h", "kind": "security", "icon": "azure_entra-privleged-identity-management" }, { "id": "plock", "label": "Resource locks", "sub": "CanNotDelete", "kind": "platform", "icon": "fa5_lock" } ] } ] }, { "title": "Sandbox & decommissioned — policy-isolated, no connectivity to the hub", "kind": "cloud", "dir": "row", "children": [ { "title": "Sandbox", "kind": "boundary", "nodes": [ { "id": "sbox", "label": "2 subscriptions", "sub": "no data, no peering", "kind": "app", "icon": "azure_subscriptions" } ] }, { "title": "Decommissioned", "kind": "boundary", "nodes": [ { "id": "decom", "label": "Quarantine", "sub": "deny all inbound roles", "kind": "risk" } ] } ] } ] } ], "outside": [ { "id": "grp", "label": "Entra security groups", "sub": "one per app per environment", "kind": "platform", "icon": "azure_AzureActiveDirectoryGroup (Identity)" }, { "id": "pol", "label": "Azure Policy", "sub": "cross-environment deny", "kind": "platform", "icon": "azure_policy" } ], "edges": [ { "from": "grp", "to": "drole", "label": "assigned at MG scope", "kind": "sync" }, { "from": "grp", "to": "prole", "label": "eligible at MG scope", "kind": "sync" }, { "from": "pol", "to": "psub", "label": "deny foreign-env principal", "kind": "error" } ], "note": "There is no cross-environment principal. A group that holds any role in DEV is denied every role assignment in PROD by policy, so an over-permissioned developer identity cannot become a production incident.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "08-authorization-layers", "title": "Authorization Layers — from claim to row", "layout": "flow", "canvas": { "width": 1780 }, "chain": true, "align": "top", "stages": [ { "title": "Token presented", "nodes": [ { "id": "tok", "label": "Access token", "sub": "JWT, 1 h lifetime", "kind": "integration" }, { "id": "sig", "label": "Signature & issuer", "sub": "JWKS cached 24 h", "kind": "decision" }, { "id": "claims", "label": "Claims read", "sub": "tid · oid · roles · scp · amr", "kind": "platform" } ] }, { "title": "Layer 1 — Azure RBAC", "nodes": [ { "id": "scope", "label": "Scope resolution", "sub": "MG to resource", "kind": "decision" }, { "id": "assign", "label": "Role assignment", "sub": "group-based, PIM-activated", "kind": "platform", "icon": "azure_entra-identity-roles-and-administrators" }, { "id": "deny", "label": "Deny assignment", "sub": "policy-managed", "kind": "security", "icon": "azure_entra-identity-roles-and-administrators" } ] }, { "title": "Layer 2 — Application RBAC", "nodes": [ { "id": "approle", "label": "App role check", "sub": "roles claim", "kind": "decision", "icon": "azure_app-registrations" }, { "id": "scp", "label": "Scope check", "sub": "delegated scp", "kind": "decision" }, { "id": "consent", "label": "Consent state", "sub": "admin consent only", "kind": "security" } ] }, { "title": "Layer 3 — Data & tenant", "nodes": [ { "id": "tid", "label": "Tenant predicate", "sub": "tid from token, never body", "kind": "decision" }, { "id": "row", "label": "Row / partition filter", "sub": "RLS · partition key", "kind": "platform" }, { "id": "field", "label": "Field-level policy", "sub": "classification-aware", "kind": "platform" } ] }, { "title": "Outcome", "nodes": [ { "id": "allow", "label": "Allow", "sub": "with effective scope", "kind": "app" }, { "id": "reject", "label": "Deny", "sub": "403 + reason code", "kind": "risk" }, { "id": "aud", "label": "Audit record", "sub": "who · what · which layer", "kind": "store" } ] } ], "edges": [ { "from": "sig", "to": "reject", "label": "invalid token", "kind": "error", "route": "gutter" }, { "from": "scope", "to": "reject", "label": "no assignment", "kind": "error", "route": "gutter" }, { "from": "approle", "to": "reject", "label": "role absent", "kind": "error", "route": "gutter" }, { "from": "tid", "to": "reject", "label": "tenant mismatch", "kind": "error", "route": "gutter" } ], "note": "Four gates, four different questions. Collapsing layer 3 into layer 2 is the most common design error in multi-tenant systems: an app role says what a caller may do, never whose data they may do it to.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "09-identity-data-model", "title": "Identity & Entitlement Data Model", "layout": "er", "canvas": { "width": 1760, "cols": 4 }, "rowGap": 250, "entities": [ { "id": "tenant", "name": "tenant", "kind": "store", "row": 0, "col": 0, "attrs": [ "tenant_id PK", "kind ENUM(CORP,CIAM,PARTNER)", "home_domain", "isolation_tier", "data_residency" ] }, { "id": "ident", "name": "identity", "kind": "store", "row": 0, "col": 1, "attrs": [ "object_id PK", "tenant_id FK -> tenant", "upn", "kind ENUM(EMP,CTR,GUEST,CUST,BG)", "hr_worker_id", "account_enabled", "last_sign_in_at" ] }, { "id": "grp", "name": "group", "kind": "store", "row": 0, "col": 2, "attrs": [ "group_id PK", "tenant_id FK -> tenant", "name (app-env scoped)", "source ENUM(DYNAMIC,ASSIGNED,PIM)", "owner_id FK -> identity" ] }, { "id": "app", "name": "application", "kind": "store", "row": 0, "col": 3, "attrs": [ "app_id PK", "tenant_id FK -> tenant", "display_name", "sign_in_audience", "owner_group_id FK -> group" ] }, { "id": "wl", "name": "workload_identity", "kind": "store", "row": 1, "col": 0, "attrs": [ "principal_id PK", "tenant_id FK -> tenant", "kind ENUM(SYS_MI,USER_MI,SP)", "app_id FK -> application", "credential ENUM(MI,FIC,SECRET)", "owner_group_id" ] }, { "id": "gm", "name": "group_membership", "kind": "store", "row": 1, "col": 1, "attrs": [ "group_id FK -> group", "member_id FK -> identity", "source ENUM(HR,PACKAGE,PIM)", "granted_at", "expires_at NULL = permanent" ] }, { "id": "pkg", "name": "access_package", "kind": "store", "row": 1, "col": 2, "attrs": [ "package_id PK", "catalog_id", "name", "approver_group_id FK -> group", "duration_days", "review_cadence_days" ] }, { "id": "arole", "name": "app_role", "kind": "store", "row": 1, "col": 3, "attrs": [ "role_id PK", "app_id FK -> application", "value (roles claim)", "allowed_member_types", "requires_admin_consent" ] }, { "id": "fic", "name": "federated_credential", "kind": "store", "row": 2, "col": 0, "attrs": [ "fic_id PK", "principal_id FK -> workload_identity", "issuer (OIDC)", "subject (repo:env / ns:sa)", "audience", "created_by" ] }, { "id": "rbac", "name": "rbac_role_assignment", "kind": "store", "row": 2, "col": 1, "attrs": [ "assignment_id PK", "principal_id (group preferred)", "role_definition_id", "scope (MG/sub/RG/resource)", "condition ABAC NULL", "is_pim_eligible" ] }, { "id": "ent", "name": "entitlement_assignment", "kind": "store", "row": 2, "col": 2, "attrs": [ "assignment_id PK", "package_id FK -> access_package", "identity_id FK -> identity", "state ENUM(PENDING,ACTIVE,EXPIRED)", "justification", "expires_at" ] }, { "id": "pim", "name": "pim_activation", "kind": "store", "row": 3, "col": 1, "attrs": [ "activation_id PK", "assignment_id FK -> rbac_role_assignment", "ticket_ref", "approver_id FK -> identity", "activated_at", "expires_at (max 8 h)", "auth_strength_met" ] }, { "id": "rev", "name": "access_review_decision", "kind": "store", "row": 3, "col": 2, "attrs": [ "review_id PK", "assignment_id FK -> entitlement_assignment", "reviewer_id FK -> identity", "decision ENUM(APPROVE,DENY,NO_RESP)", "decided_at", "evidence_uri" ] } ], "relations": [ { "from": "tenant", "to": "ident", "label": "1 : N", "from_side": "e", "to_side": "w" }, { "from": "tenant", "to": "wl", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "ident", "to": "gm", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "grp", "to": "gm", "label": "1 : N", "from_side": "w", "to_side": "e" }, { "from": "pkg", "to": "grp", "label": "grants N : M", "from_side": "n", "to_side": "s" }, { "from": "pkg", "to": "arole", "label": "grants N : M", "from_side": "e", "to_side": "w" }, { "from": "pkg", "to": "ent", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "app", "to": "arole", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "wl", "to": "fic", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "gm", "to": "rbac", "label": "principal N : 1", "from_side": "s", "to_side": "n" }, { "from": "rbac", "to": "pim", "label": "1 : N", "from_side": "s", "to_side": "n" }, { "from": "ent", "to": "rev", "label": "1 : N", "from_side": "s", "to_side": "n" } ], "note": "Sign-in and audit events are deliberately absent: they are append-only telemetry with a different owner and retention, and view 11 places them. Everything drawn here is state that access decisions read.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "10-identity-data-flow", "title": "Identity Data Flow — HR record to entitlement to evidence", "layout": "flow", "canvas": { "width": 1780 }, "chain": true, "align": "top", "stages": [ { "title": "Sources of truth", "nodes": [ { "id": "hr", "label": "Workday worker record", "sub": "hire · transfer · leave", "kind": "external" }, { "id": "ad", "label": "AD DS objects", "sub": "legacy apps only", "kind": "external", "icon": "azure_AzureActiveDirectoryDomainServices (Identity)" }, { "id": "signup", "label": "Customer sign-up", "sub": "self-service", "kind": "external", "icon": "azure_azure-ad-b2c" }, { "id": "cat", "label": "Application catalogue", "sub": "owner-attested", "kind": "external", "icon": "azure_app-registrations" } ] }, { "title": "Ingest & correlate", "nodes": [ { "id": "inb", "label": "Inbound provisioning", "sub": "hourly, 45k workers", "kind": "integration", "icon": "azure_entra-connect-sync" }, { "id": "sync", "label": "Cloud Sync", "sub": "2-minute delta", "kind": "integration", "icon": "azure_entra-connect-sync" }, { "id": "map", "label": "Attribute mapping", "sub": "employeeId is the join key", "kind": "platform" }, { "id": "gate", "label": "Quality gate", "sub": "manager & cost centre required", "kind": "decision" }, { "id": "exc", "label": "Exception queue", "sub": "~40 defects/day", "kind": "risk" } ] }, { "title": "Identity store", "nodes": [ { "id": "dir", "label": "Entra directory", "sub": "corporate tenant", "kind": "store", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "cdir", "label": "External ID directory", "sub": "1.2M customers", "kind": "store", "icon": "azure_azure-ad-b2c" }, { "id": "dyn", "label": "Dynamic group evaluation", "sub": "~4 min to converge", "kind": "platform" }, { "id": "ent", "label": "Entitlement state", "sub": "packages & assignments", "kind": "store" } ] }, { "title": "Distribution", "nodes": [ { "id": "scim", "label": "SCIM outbound", "sub": "142 apps, 40-min cycle", "kind": "integration" }, { "id": "claims", "label": "Claims at token issuance", "sub": "roles · groups · tid", "kind": "integration" }, { "id": "rbacw", "label": "Azure RBAC writes", "sub": "IaC only", "kind": "integration", "icon": "azure_entra-identity-roles-and-administrators" }, { "id": "wb", "label": "Group writeback", "sub": "cloud groups to AD DS", "kind": "integration", "icon": "azure_entra-connect-sync" } ] }, { "title": "Consumption & evidence", "nodes": [ { "id": "apps", "label": "Applications", "sub": "900", "kind": "app" }, { "id": "res", "label": "Azure resources", "kind": "app", "icon": "azure_subscriptions" }, { "id": "law", "label": "Log Analytics", "sub": "90 days interactive", "kind": "store", "icon": "azure_log-analytics-workspaces" }, { "id": "arch", "label": "Immutable archive", "sub": "7 years, privileged evidence", "kind": "store", "icon": "azure_storage-accounts" } ] } ], "edges": [ { "from": "gate", "to": "exc", "label": "reject, no identity created", "kind": "error" }, { "from": "dyn", "to": "claims", "label": "membership in token", "kind": "sync" }, { "from": "scim", "to": "law", "label": "provisioning logs", "kind": "async", "route": "gutter" }, { "from": "law", "to": "arch", "label": "nightly export", "kind": "batch" } ], "note": "One join key carries the whole flow. If Workday does not emit employeeId, no identity is created and the record lands in the exception queue: a missing person is a visible defect, an unmatched duplicate is a silent one.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "11-identity-data-zones", "title": "Identity Data Zones, Classification & Retention", "layout": "nested", "canvas": { "width": 1740 }, "boxes": [ { "title": "Identity state — read on every access decision, replicated by Microsoft", "kind": "cloud", "dir": "row", "children": [ { "title": "Directory data · Confidential · owner: IAM platform", "kind": "boundary", "nodes": [ { "id": "dir", "label": "Entra directory objects", "sub": "geo-pinned to EU", "kind": "store", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "cdir", "label": "External ID directory", "sub": "customer PII", "kind": "store", "icon": "azure_azure-ad-b2c" }, { "id": "ent", "label": "Entitlement & review state", "sub": "retained 7 years", "kind": "store" } ] }, { "title": "Credential material · Secret · owner: security engineering", "kind": "trust", "nodes": [ { "id": "kv", "label": "Key Vault", "sub": "soft delete + purge protection", "kind": "security", "icon": "azure_key-vaults" }, { "id": "hsm", "label": "Managed HSM", "sub": "FIPS 140-3 Level 3", "kind": "security" }, { "id": "meth", "label": "Authentication methods", "sub": "non-exportable by design", "kind": "security", "icon": "azure_multi-factor-authentication" } ] } ] }, { "title": "Identity telemetry — append-only, ours to retain and defend", "kind": "cloud", "dir": "row", "children": [ { "title": "Hot · 90 days interactive · owner: SecOps", "kind": "boundary", "nodes": [ { "id": "sin", "label": "Sign-in logs", "sub": "2.6M/day", "kind": "store" }, { "id": "aud", "label": "Audit logs", "sub": "every directory write", "kind": "store" }, { "id": "prov", "label": "Provisioning logs", "kind": "store" }, { "id": "risk", "label": "Risk detections", "sub": "ID Protection", "kind": "store", "icon": "azure_entra-identity-risky-users" } ] }, { "title": "Long-term · evidence · owner: compliance", "kind": "boundary", "nodes": [ { "id": "arch", "label": "Log Analytics archive", "sub": "2 years, low cost tier", "kind": "store", "icon": "azure_log-analytics-workspaces" }, { "id": "worm", "label": "Immutable storage", "sub": "7 years, WORM policy", "kind": "store", "icon": "azure_storage-accounts" }, { "id": "ev", "label": "Privileged-access evidence", "sub": "PIM + review packs", "kind": "store" } ] } ] } ], "outside": [ { "id": "hrsys", "label": "Workday HCM", "sub": "system of record for people", "kind": "external" }, { "id": "sent", "label": "Microsoft Sentinel", "sub": "detection consumer", "kind": "security", "icon": "azure_sentinel" }, { "id": "audit", "label": "Internal audit & regulator", "kind": "actor" } ], "edges": [ { "from": "hrsys", "to": "dir", "label": "person attributes only", "kind": "batch" }, { "from": "sin", "to": "sent", "label": "continuous", "kind": "async" }, { "from": "aud", "to": "arch", "label": "at 90 days", "kind": "batch" }, { "from": "ev", "to": "audit", "label": "on request, read-only", "kind": "sync" } ], "note": "Nothing here is a copy of the directory. The one deliberate duplication is the evidence archive, because an audit trail that a tenant administrator can delete is not an audit trail.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "12-workforce-sso-flow", "title": "Workforce SSO & Conditional Access — one sign-in", "layout": "sequence", "canvas": { "width": 1760 }, "lifelines": [ { "id": "emp", "label": "Employee", "kind": "actor" }, { "id": "app", "label": "Application", "kind": "app" }, { "id": "entra", "label": "Entra ID", "kind": "security", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "ca", "label": "Conditional Access", "kind": "security", "icon": "azure_conditional-access" }, { "id": "dev", "label": "Intune device state", "kind": "platform" }, { "id": "key", "label": "FIDO2 passkey", "kind": "security", "icon": "azure_multi-factor-authentication" }, { "id": "law", "label": "Log Analytics", "kind": "store", "icon": "azure_log-analytics-workspaces" } ], "messages": [ { "from": "emp", "to": "app", "label": "open application", "kind": "call" }, { "from": "app", "to": "entra", "label": "302 /authorize — OIDC + PKCE", "kind": "call" }, { "from": "entra", "to": "entra", "label": "evaluate existing session (PRT)", "kind": "self" }, { "from": "entra", "to": "ca", "label": "evaluate policies: user, app, risk", "kind": "call" }, { "from": "ca", "to": "dev", "label": "device compliance state", "kind": "call" }, { "from": "dev", "to": "ca", "label": "compliant, Entra-joined", "kind": "return" }, { "from": "ca", "to": "entra", "label": "grant: phishing-resistant MFA", "kind": "return" }, { "from": "entra", "to": "key", "label": "WebAuthn challenge", "kind": "call" }, { "from": "key", "to": "entra", "label": "signed assertion", "kind": "return" }, { "from": "entra", "to": "app", "label": "authorization code", "kind": "return" }, { "from": "app", "to": "entra", "label": "code + verifier -> /token", "kind": "call" }, { "from": "entra", "to": "app", "label": "id_token + access_token (CAE)", "kind": "return" }, { "from": "app", "to": "emp", "label": "session established", "kind": "return" }, { "from": "entra", "to": "law", "label": "sign-in log + CA result", "kind": "async" }, { "from": "entra", "to": "app", "label": "CAE event: session revoked", "kind": "error" } ], "note": "Steps 8 and 9 are skipped when the session already meets the required authentication strength, which covers roughly 71% of sign-ins. Step 15 is the leaver path: revocation reaches CAE-aware resources in about a minute rather than waiting an hour for token expiry.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "13-conditional-access-matrix", "title": "Conditional Access Policy Matrix", "layout": "grid", "canvas": { "width": 1790 }, "laneHeaderWidth": 185, "columns": [ "Signals evaluated", "Authentication strength", "Device & network", "Session control", "Outcome" ], "lanes": [ { "title": "Employee, managed device", "cells": [ [ { "label": "Low user & sign-in risk", "kind": "platform" } ], [ { "label": "Passkey or MFA", "kind": "security" } ], [ { "label": "Compliant device", "kind": "platform" } ], [ { "label": "Sign-in frequency 12 h", "kind": "platform" } ], [ { "label": "Grant", "kind": "app" } ] ] }, { "title": "Administrator to portals", "cells": [ [ { "label": "Any privileged role", "kind": "platform" } ], [ { "label": "Phishing-resistant only", "kind": "security" } ], [ { "label": "Privileged workstation", "kind": "platform" } ], [ { "label": "No persistent session", "kind": "platform" } ], [ { "label": "Grant", "kind": "app" } ] ] }, { "title": "PIM role activation", "cells": [ [ { "label": "Activation request", "kind": "platform" } ], [ { "label": "Phishing-resistant + approval", "kind": "security" } ], [ { "label": "Compliant PAW", "kind": "platform" } ], [ { "label": "Lifetime = activation", "kind": "platform" } ], [ { "label": "Grant, time-bound", "kind": "app" } ] ] }, { "title": "High-risk sign-in", "cells": [ [ { "label": "ID Protection: high", "kind": "risk" } ], [ { "label": "Password change + MFA", "kind": "security" } ], [ { "label": "Any", "kind": "platform" } ], [ { "label": "Revoke all sessions", "kind": "security" } ], [ { "label": "Block until remediated", "kind": "risk" } ] ] }, { "title": "B2B guest", "cells": [ [ { "label": "Guest + resource app", "kind": "platform" } ], [ { "label": "MFA trusted from home tenant", "kind": "security" } ], [ { "label": "Unmanaged permitted", "kind": "platform" } ], [ { "label": "1 h, no download", "kind": "platform" } ], [ { "label": "Grant, restricted", "kind": "app" } ] ] }, { "title": "Workload identity", "cells": [ [ { "label": "Service principal sign-in", "kind": "platform" } ], [ { "label": "Not interactive", "kind": "platform" } ], [ { "label": "Named location allowlist", "kind": "security" } ], [ { "label": "Not applicable", "kind": "platform" } ], [ { "label": "Block outside allowlist", "kind": "risk" } ] ] }, { "title": "Legacy authentication", "cells": [ [ { "label": "POP · IMAP · SMTP basic", "kind": "risk" } ], [ { "label": "Cannot satisfy MFA", "kind": "risk" } ], [ { "label": "Any", "kind": "platform" } ], [ { "label": "Not applicable", "kind": "platform" } ], [ { "label": "Block, all users", "kind": "risk" } ] ] }, { "title": "Break-glass accounts", "cells": [ [ { "label": "Excluded from all but one", "kind": "risk" } ], [ { "label": "FIDO2 hardware key only", "kind": "security" } ], [ { "label": "Any — lockout safety", "kind": "platform" } ], [ { "label": "Alert on every sign-in", "kind": "security" } ], [ { "label": "Grant + P1 alert", "kind": "risk" } ] ] } ], "note": "Read as rows, not policies: a persona is the unit a reviewer can reason about. The eight rows compile to 38 Conditional Access policies deployed as code, each in report-only for 14 days before enforcement.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "14-api-authorization-flow", "title": "API Authorization — token to gateway to backend to data", "layout": "sequence", "canvas": { "width": 1780 }, "lifelines": [ { "id": "cli", "label": "Client application", "kind": "app" }, { "id": "entra", "label": "Entra ID", "kind": "security", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "apim", "label": "API Management", "kind": "integration", "icon": "azure_api-management-services" }, { "id": "api", "label": "Orders API", "kind": "app" }, { "id": "down", "label": "Downstream API", "kind": "app" }, { "id": "sql", "label": "Azure SQL", "kind": "store", "icon": "azure_sql-database" } ], "messages": [ { "from": "cli", "to": "entra", "label": "auth code or client credentials", "kind": "call" }, { "from": "entra", "to": "cli", "label": "access_token aud=api://orders", "kind": "return" }, { "from": "cli", "to": "apim", "label": "GET /orders/{id} + Bearer", "kind": "call" }, { "from": "apim", "to": "apim", "label": "validate-jwt: iss, aud, exp, signature", "kind": "self" }, { "from": "apim", "to": "apim", "label": "require scp Orders.Read, quota by tid", "kind": "self" }, { "from": "apim", "to": "api", "label": "forward + tenant id from claim", "kind": "call" }, { "from": "api", "to": "api", "label": "app role check, then tenant predicate", "kind": "self" }, { "from": "api", "to": "entra", "label": "on-behalf-of exchange", "kind": "call" }, { "from": "entra", "to": "api", "label": "downstream token, user-scoped", "kind": "return" }, { "from": "api", "to": "down", "label": "call with delegated token", "kind": "call" }, { "from": "down", "to": "api", "label": "result", "kind": "return" }, { "from": "api", "to": "sql", "label": "managed identity + RLS context", "kind": "call" }, { "from": "sql", "to": "api", "label": "rows for this tenant only", "kind": "return" }, { "from": "api", "to": "apim", "label": "200 OK", "kind": "return" }, { "from": "apim", "to": "cli", "label": "200 + correlation id", "kind": "return" }, { "from": "apim", "to": "cli", "label": "401 invalid_token / 403 insufficient_scope", "kind": "error" } ], "note": "No connection string and no client secret appears anywhere in this flow. The gateway rejects a malformed or foreign-tenant token before the backend is reached, and the backend still re-checks: the gateway is defence, not the authority.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "15-workload-identity-patterns", "title": "Workload Identity Patterns — four ways in, one authority", "layout": "swimlane", "canvas": { "width": 1790 }, "laneHeaderWidth": 200, "stages": [ "Identity issued", "Credential held", "Token acquired", "Resource authorized", "Evidence" ], "lanes": [ { "title": "Azure-hosted app — App Service, Functions", "cells": [ [ { "label": "System-assigned identity", "sub": "created with the resource", "kind": "security", "icon": "azure_entra-managed-identities" } ], [ { "label": "None to hold", "sub": "platform-managed", "kind": "platform" } ], [ { "label": "IMDS token endpoint", "sub": "no network egress", "kind": "integration" } ], [ { "label": "Azure RBAC", "sub": "Key Vault, SQL, Storage", "kind": "platform", "icon": "azure_entra-identity-roles-and-administrators" } ], [ { "label": "MI sign-in log", "sub": "+ resource activity", "kind": "store" } ] ] }, { "title": "AKS pod — workload identity", "cells": [ [ { "label": "User-assigned identity", "sub": "bound to service account", "kind": "security", "icon": "azure_entra-managed-identities" } ], [ { "label": "Projected SA token", "sub": "1 h, auto-rotated", "kind": "platform" } ], [ { "label": "Federated exchange", "sub": "cluster OIDC issuer", "kind": "integration", "icon": "azure_AzureAppRegistration (Identity)" } ], [ { "label": "RBAC at namespace RG", "sub": "one identity per workload", "kind": "platform", "icon": "azure_entra-identity-roles-and-administrators" } ], [ { "label": "AKS audit + SP sign-in", "kind": "store" } ] ] }, { "title": "CI/CD pipeline — GitHub, Azure DevOps", "cells": [ [ { "label": "App registration", "sub": "one per repo per env", "kind": "security", "icon": "azure_app-registrations" } ], [ { "label": "Federated credential", "sub": "subject = repo:env", "kind": "platform", "icon": "azure_AzureAppRegistration (Identity)" } ], [ { "label": "OIDC exchange at job start", "sub": "no stored secret", "kind": "integration", "icon": "azure_AzureAppRegistration (Identity)" } ], [ { "label": "PIM-activated deploy role", "sub": "60 minutes", "kind": "security", "icon": "azure_entra-privleged-identity-management" } ], [ { "label": "Run log + activation record", "kind": "store" } ] ] }, { "title": "Legacy SaaS or on-premises — the exception path", "cells": [ [ { "label": "Service principal", "sub": "170 remaining", "kind": "risk" } ], [ { "label": "Client secret in Key Vault", "sub": "never in config", "kind": "risk" } ], [ { "label": "Client credentials grant", "kind": "integration" } ], [ { "label": "Least-privilege app role", "sub": "no Graph write", "kind": "platform" } ], [ { "label": "Secret access log", "sub": "90-day rotation SLA", "kind": "store" } ] ] } ], "note": "Three lanes hold no credential at all. The fourth exists only because 170 integrations cannot yet federate; it is tracked as a burn-down with a named owner per principal, not accepted as a steady state.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "16-privileged-elevation-flow", "title": "Privileged Elevation — zero standing access", "layout": "sequence", "canvas": { "width": 1780 }, "lifelines": [ { "id": "adm", "label": "Administrator", "kind": "actor" }, { "id": "pim", "label": "Entra PIM", "kind": "security", "icon": "azure_entra-privleged-identity-management" }, { "id": "ca", "label": "Conditional Access", "kind": "security", "icon": "azure_conditional-access" }, { "id": "appr", "label": "Approver", "kind": "actor" }, { "id": "rbac", "label": "Azure RBAC", "kind": "platform", "icon": "azure_entra-identity-roles-and-administrators" }, { "id": "res", "label": "Production resource", "kind": "app" }, { "id": "sent", "label": "Sentinel", "kind": "security", "icon": "azure_sentinel" } ], "messages": [ { "from": "adm", "to": "pim", "label": "activate Contributor, 4 h, ticket INC-4471", "kind": "call" }, { "from": "pim", "to": "ca", "label": "evaluate activation policy", "kind": "call" }, { "from": "ca", "to": "pim", "label": "phishing-resistant MFA + PAW met", "kind": "return" }, { "from": "pim", "to": "appr", "label": "approval request to 2 eligible approvers", "kind": "call" }, { "from": "appr", "to": "pim", "label": "approved with justification", "kind": "return" }, { "from": "pim", "to": "rbac", "label": "create time-bound assignment", "kind": "call" }, { "from": "rbac", "to": "pim", "label": "active until 14:32 UTC", "kind": "return" }, { "from": "pim", "to": "adm", "label": "elevated", "kind": "return" }, { "from": "adm", "to": "res", "label": "perform the change", "kind": "call" }, { "from": "res", "to": "rbac", "label": "authorize at scope", "kind": "call" }, { "from": "rbac", "to": "res", "label": "allow", "kind": "return" }, { "from": "pim", "to": "rbac", "label": "expiry: remove assignment", "kind": "async" }, { "from": "pim", "to": "sent", "label": "request, approval, expiry events", "kind": "async" }, { "from": "sent", "to": "sent", "label": "alert: no ticket reference", "kind": "self" }, { "from": "appr", "to": "pim", "label": "denied — request closed, no access", "kind": "error" } ], "note": "Nobody holds the role between activations, so the compromise of an administrator account yields eligibility rather than privilege. Median activation is 3.2 per day and the approval path is the only path — PIM cannot be bypassed because the standing assignment does not exist to fall back on.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "17-joiner-mover-leaver", "title": "Joiner, Mover, Leaver — the identity lifecycle", "layout": "swimlane", "canvas": { "width": 1790 }, "laneHeaderWidth": 190, "stages": [ "Trigger", "Identity action", "Entitlement action", "Access effect", "Evidence" ], "lanes": [ { "title": "Joiner", "cells": [ [ { "label": "Workday hire event", "sub": "with effective date", "kind": "external" } ], [ { "label": "Account created day -7", "sub": "disabled until start", "kind": "platform" } ], [ { "label": "Birthright package", "sub": "by job family", "kind": "platform" } ], [ { "label": "SSO + baseline apps", "sub": "live 08:00 day 1", "kind": "app" } ], [ { "label": "Provisioning log", "sub": "+ manager notification", "kind": "store" } ] ] }, { "title": "Mover", "cells": [ [ { "label": "Transfer or manager change", "kind": "external" } ], [ { "label": "Attributes updated", "sub": "converges in ~4 min", "kind": "platform" } ], [ { "label": "Entitlements recalculated", "sub": "dynamic groups + review", "kind": "platform" } ], [ { "label": "Old access removed 24 h", "sub": "new access granted", "kind": "app" } ], [ { "label": "Mover exception report", "sub": "weekly to line manager", "kind": "store" } ] ] }, { "title": "Leaver", "cells": [ [ { "label": "Termination event", "kind": "external" } ], [ { "label": "Disable + revoke sessions", "sub": "immediate", "kind": "security" } ], [ { "label": "Packages expired", "sub": "group memberships stripped", "kind": "platform" } ], [ { "label": "CAE revocation under 1 min", "sub": "licences released day 7", "kind": "security" } ], [ { "label": "30-day hold + evidence pack", "kind": "store" } ] ] }, { "title": "Contractor expiry — no HR event exists", "cells": [ [ { "label": "Package end date", "sub": "set at grant, mandatory", "kind": "decision" } ], [ { "label": "Sponsor attests or lapses", "sub": "14-day warning", "kind": "actor" } ], [ { "label": "Auto-expire, no grace", "kind": "platform" } ], [ { "label": "Access ends 00:00", "sub": "account disabled day 30", "kind": "risk" } ], [ { "label": "Sponsor attestation record", "kind": "store" } ] ] } ], "note": "The fourth lane exists because contractors have no leaver event in HR. Expiry is therefore a property of the grant rather than of a downstream process, which is the only version of this that survives a sponsor who leaves first.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "18-secret-and-certificate-lifecycle", "title": "Secret & Certificate Lifecycle", "layout": "cycle", "canvas": { "width": 1580 }, "centre": { "label": "Azure Key Vault", "sub": "18 vaults", "icon": "azure_key-vaults" }, "rx": 430, "ry": 215, "nodes": [ { "id": "issue", "label": "Issue", "sub": "enterprise CA or Key Vault CA", "kind": "security", "icon": "azure_app-service-certificates" }, { "id": "store", "label": "Store", "sub": "RBAC data plane, purge protection", "kind": "security", "icon": "azure_key-vaults" }, { "id": "consume", "label": "Consume", "sub": "managed identity reference", "kind": "app", "icon": "azure_entra-managed-identities" }, { "id": "watch", "label": "Monitor", "sub": "expiry + access anomaly", "kind": "platform", "icon": "azure_monitor" }, { "id": "rotate", "label": "Rotate", "sub": "dual version, 60 days before expiry", "kind": "integration", "icon": "azure_automation-accounts" }, { "id": "revoke", "label": "Revoke", "sub": "old version disabled, then purged", "kind": "risk" } ], "ringLabels": [ "stored with rotation policy", "referenced, never copied", "every read is logged", "Event Grid rotation trigger", "new version live, no restart", "back to issuance" ], "note": "The loop must close without a deployment. Applications resolve the current version at runtime, so rotation is an operation on the vault rather than a release, which is what makes a 60-day cadence realistic.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "19-external-identity-flow", "title": "External Identity — customer sign-in and partner federation", "layout": "sequence", "canvas": { "width": 1790 }, "lifelines": [ { "id": "cust", "label": "Customer", "kind": "actor" }, { "id": "part", "label": "Partner employee", "kind": "actor" }, { "id": "capp", "label": "Customer application", "kind": "app" }, { "id": "extid", "label": "Entra External ID", "kind": "security", "icon": "azure_azure-ad-b2c" }, { "id": "entra", "label": "Corporate Entra ID", "kind": "security", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "home", "label": "Partner home tenant", "kind": "external", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "api", "label": "Tenant-scoped API", "kind": "integration" } ], "messages": [ { "from": "cust", "to": "capp", "label": "sign up or sign in", "kind": "call" }, { "from": "capp", "to": "extid", "label": "OIDC user flow + PKCE", "kind": "call" }, { "from": "extid", "to": "extid", "label": "local account or Google / Apple", "kind": "self" }, { "from": "extid", "to": "extid", "label": "step-up: email OTP or authenticator", "kind": "self" }, { "from": "extid", "to": "capp", "label": "tokens, tid = CIAM tenant", "kind": "return" }, { "from": "capp", "to": "api", "label": "call with customer token", "kind": "call" }, { "from": "api", "to": "api", "label": "subject to customer_id, load org scope", "kind": "self" }, { "from": "api", "to": "capp", "label": "that customer's data only", "kind": "return" }, { "from": "part", "to": "entra", "label": "access a contoso resource", "kind": "call" }, { "from": "entra", "to": "home", "label": "cross-tenant: was MFA satisfied?", "kind": "call" }, { "from": "home", "to": "entra", "label": "MFA + device claims, trusted", "kind": "return" }, { "from": "entra", "to": "entra", "label": "guest object + collaboration settings", "kind": "self" }, { "from": "entra", "to": "api", "label": "token: guest, restricted app role", "kind": "return" }, { "from": "api", "to": "api", "label": "guest predicate: no export, no admin scope", "kind": "self" }, { "from": "api", "to": "part", "label": "restricted view", "kind": "return" }, { "from": "extid", "to": "entra", "label": "no trust in this direction, by design", "kind": "error" } ], "note": "Two journeys, one rule: the tenant a subject came from is a claim the API reads, never a parameter the caller supplies. The red line is the point of the view — the CIAM tenant can obtain nothing in the corporate tenant, so a customer-facing compromise has no path to an administrative role.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "20-deployment-architecture", "title": "Deployment & Network Architecture", "layout": "nested", "canvas": { "width": 1760 }, "boxes": [ { "title": "Microsoft-operated identity plane — global, outside every customer network", "kind": "cloud", "dir": "row", "children": [ { "title": "Microsoft Entra ID", "kind": "boundary", "nodes": [ { "id": "sts", "label": "STS endpoints", "sub": "99.99% SLA", "kind": "security", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "graph", "label": "Microsoft Graph", "kind": "integration" }, { "id": "repl", "label": "Directory replicas", "sub": "EU data boundary", "kind": "store", "icon": "azure_AzureActiveDirectory (Identity)" } ] }, { "title": "Entra External ID", "kind": "boundary", "nodes": [ { "id": "cists", "label": "CIAM STS", "kind": "security", "icon": "azure_azure-ad-b2c" }, { "id": "flows", "label": "User flows", "sub": "sign-up, reset, MFA", "kind": "platform", "icon": "azure_azure-ad-b2c" } ] } ] }, { "title": "Azure — West Europe (primary)", "kind": "cloud", "dir": "row", "children": [ { "title": "Hub VNet — platform team", "kind": "trust", "nodes": [ { "id": "fw", "label": "Azure Firewall", "sub": "egress FQDN allowlist", "kind": "security", "icon": "azure_firewalls" }, { "id": "bas", "label": "Azure Bastion", "sub": "no public RDP or SSH", "kind": "security", "icon": "azure_bastions" }, { "id": "dns", "label": "Private DNS resolver", "kind": "platform", "icon": "azure_dns-private-resolver" } ] }, { "title": "Platform spoke", "kind": "boundary", "nodes": [ { "id": "afd", "label": "Front Door + WAF", "sub": "global anycast", "kind": "integration", "icon": "azure_front-door-and-cdn-profiles" }, { "id": "apim", "label": "API Management", "sub": "internal VNet mode", "kind": "integration", "icon": "azure_api-management-services" }, { "id": "kv", "label": "Key Vault", "sub": "private endpoint only", "kind": "security", "icon": "azure_key-vaults" }, { "id": "law", "label": "Log Analytics", "kind": "store", "icon": "azure_log-analytics-workspaces" } ] }, { "title": "Application spoke", "kind": "boundary", "nodes": [ { "id": "aks", "label": "AKS private cluster", "sub": "workload identity on", "kind": "app", "icon": "azure_aks" }, { "id": "app", "label": "App Service", "sub": "VNet integrated", "kind": "app", "icon": "azure_app-services" }, { "id": "sql", "label": "Azure SQL", "sub": "private endpoint, Entra auth", "kind": "store", "icon": "azure_sql-database" } ] } ] }, { "title": "Azure — North Europe (secondary)", "kind": "cloud", "dir": "row", "children": [ { "title": "Warm standby — RTO 4 h", "kind": "boundary", "nodes": [ { "id": "apim2", "label": "APIM secondary unit", "sub": "same gateway config", "kind": "integration", "icon": "azure_api-management-services" }, { "id": "aks2", "label": "AKS standby", "sub": "scaled to zero", "kind": "app", "icon": "azure_aks" }, { "id": "kv2", "label": "Key Vault", "sub": "backup + restore runbook", "kind": "security", "icon": "azure_key-vaults" } ] }, { "title": "Evidence", "kind": "boundary", "nodes": [ { "id": "arch", "label": "Immutable archive", "sub": "GRS, WORM", "kind": "store", "icon": "azure_storage-accounts" } ] } ] } ], "outside": [ { "id": "cli", "label": "Internet clients", "kind": "external" }, { "id": "paw", "label": "Administrators on PAW", "kind": "actor" }, { "id": "agent", "label": "On-premises sync agents", "sub": "outbound 443 only", "kind": "external", "icon": "azure_entra-connect-sync" } ], "edges": [ { "from": "cli", "to": "afd", "label": "HTTPS 443", "kind": "sync" }, { "from": "afd", "to": "apim", "kind": "sync" }, { "from": "apim", "to": "sts", "label": "OIDC metadata + JWKS", "kind": "sync" }, { "from": "aks", "to": "kv", "label": "managed identity, private", "kind": "sync" }, { "from": "paw", "to": "bas", "label": "PIM-gated session", "kind": "sync" }, { "from": "agent", "to": "graph", "label": "Cloud Sync, outbound only", "kind": "sync" }, { "from": "law", "to": "arch", "label": "geo-replicated export", "kind": "batch" } ], "note": "The identity plane is not a failure domain we own. A West Europe outage stops our APIs and leaves authentication working, which is why the recovery runbook in view 26 restores gateways and workloads rather than identity.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "21-identity-as-code-pipeline", "title": "Identity as Code — how an access change reaches production", "layout": "flow", "canvas": { "width": 1780 }, "chain": true, "align": "top", "stages": [ { "title": "Author", "nodes": [ { "id": "repo", "label": "IaC repository", "sub": "Bicep + Terraform azuread", "kind": "platform", "icon": "terraform" }, { "id": "poldef", "label": "Policy definitions", "sub": "deny, audit, DINE", "kind": "platform", "icon": "azure_policy" }, { "id": "cajson", "label": "CA policies as JSON", "sub": "38 policies", "kind": "platform" } ] }, { "title": "Validate", "nodes": [ { "id": "lint", "label": "PR checks", "sub": "format, lint, PSRule", "kind": "decision" }, { "id": "whatif", "label": "What-if / plan", "sub": "no silent role deletes", "kind": "decision" }, { "id": "cod", "label": "IAM code owners", "sub": "two-person rule", "kind": "decision" } ] }, { "title": "Non-production", "nodes": [ { "id": "dev", "label": "Deploy DEV", "sub": "federated credential", "kind": "integration" }, { "id": "test", "label": "Deploy TEST", "sub": "integration suite", "kind": "integration" }, { "id": "ro", "label": "Report-only CA", "sub": "14 days of signal", "kind": "platform" } ] }, { "title": "Gate to production", "nodes": [ { "id": "pimd", "label": "PIM-activated deployer", "sub": "60-minute window", "kind": "security", "icon": "azure_entra-privleged-identity-management" }, { "id": "cab", "label": "Change approval", "sub": "standard or emergency", "kind": "decision" }, { "id": "comp", "label": "Compliance scan", "sub": "Azure Policy, blocking", "kind": "decision", "icon": "azure_policy" } ] }, { "title": "Production & drift", "nodes": [ { "id": "prod", "label": "Deploy PROD", "sub": "5 subscriptions", "kind": "integration" }, { "id": "drift", "label": "Drift detector", "sub": "daily what-if", "kind": "platform" }, { "id": "roll", "label": "Rollback", "sub": "revert commit, re-apply", "kind": "risk" } ] } ], "edges": [ { "from": "whatif", "to": "roll", "label": "destructive plan blocked", "kind": "error", "route": "gutter" }, { "from": "comp", "to": "roll", "label": "non-compliant", "kind": "error" }, { "from": "drift", "to": "repo", "label": "raises a PR for manual change", "kind": "async", "route": "gutter" } ], "note": "The deploy identity itself holds no standing role: the pipeline federates, activates through PIM, deploys, and expires. Portal changes are not blocked outright — they are detected within 24 hours and reconciled back into the repository, because a control that stops an incident response gets switched off.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "22-identity-observability", "title": "Identity Observability & Detection", "layout": "grid", "canvas": { "width": 1790 }, "laneHeaderWidth": 175, "columns": [ "Emit", "Collect", "Store", "Detect", "Act" ], "lanes": [ { "title": "Authentication", "cells": [ [ { "label": "Sign-in logs", "sub": "2.6M/day", "kind": "store" } ], [ { "label": "Diagnostic setting", "kind": "integration" } ], [ { "label": "Log Analytics 90 d", "kind": "store", "icon": "azure_log-analytics-workspaces" } ], [ { "label": "Impossible travel, MFA fatigue", "kind": "security" } ], [ { "label": "Sentinel incident to SOC", "kind": "security" } ] ] }, { "title": "Directory change", "cells": [ [ { "label": "Audit logs", "sub": "every write", "kind": "store" } ], [ { "label": "Diagnostic setting", "kind": "integration" } ], [ { "label": "LAW + 7-year archive", "kind": "store", "icon": "azure_log-analytics-workspaces" } ], [ { "label": "Role assigned outside IaC", "kind": "risk" } ], [ { "label": "Auto-revert, page IAM", "kind": "security" } ] ] }, { "title": "Privileged access", "cells": [ [ { "label": "PIM activation events", "kind": "store" } ], [ { "label": "Diagnostic setting", "kind": "integration" } ], [ { "label": "Evidence archive", "kind": "store", "icon": "azure_storage-accounts" } ], [ { "label": "Activation without ticket", "kind": "risk" } ], [ { "label": "Weekly approver review", "kind": "platform" } ] ] }, { "title": "Workload identity", "cells": [ [ { "label": "SP sign-ins, MI usage", "kind": "store" } ], [ { "label": "Diagnostic setting", "kind": "integration" } ], [ { "label": "Log Analytics", "kind": "store", "icon": "azure_log-analytics-workspaces" } ], [ { "label": "New IP or ASN for an SP", "kind": "risk" } ], [ { "label": "CA block, rotate credential", "kind": "security" } ] ] }, { "title": "Secrets", "cells": [ [ { "label": "Key Vault data-plane log", "kind": "store" } ], [ { "label": "Diagnostic setting", "kind": "integration" } ], [ { "label": "LAW + archive", "kind": "store", "icon": "azure_log-analytics-workspaces" } ], [ { "label": "Bulk read, unusual principal", "kind": "risk" } ], [ { "label": "Disable version, rotate", "kind": "security" } ] ] }, { "title": "Entitlement", "cells": [ [ { "label": "Provisioning + review logs", "kind": "store" } ], [ { "label": "Graph scheduled export", "kind": "integration" } ], [ { "label": "Governance store", "kind": "store" } ], [ { "label": "Dormant 60 days, orphaned", "kind": "risk" } ], [ { "label": "Auto-remove, notify owner", "kind": "platform" } ] ] }, { "title": "Posture", "cells": [ [ { "label": "Defender for Cloud, CIEM", "kind": "security", "icon": "azure_defender" } ], [ { "label": "Continuous assessment", "kind": "integration" } ], [ { "label": "Defender workspace", "kind": "store", "icon": "azure_defender" } ], [ { "label": "Permission creep score", "kind": "risk" } ], [ { "label": "Right-size in next sprint", "kind": "platform" } ] ] } ], "note": "The matrix exists to make gaps visible. Every row must reach the Act column: a signal that is collected and stored but never acted on is cost without control, and three of these rows were exactly that before this design.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "23-access-review-campaign", "title": "Access Review & Recertification Campaign", "layout": "flow", "canvas": { "width": 1780 }, "chain": true, "align": "top", "stages": [ { "title": "Scope", "nodes": [ { "id": "scope", "label": "Review scope", "sub": "packages, groups, roles, guests", "kind": "platform" }, { "id": "tier", "label": "Risk tier", "sub": "privileged every 30 days", "kind": "decision" }, { "id": "cad", "label": "Cadence", "sub": "apps 90 d, guests 90 d", "kind": "platform" } ] }, { "title": "Assign reviewers", "nodes": [ { "id": "own", "label": "Resource owner", "sub": "named, not a queue", "kind": "actor" }, { "id": "mgr", "label": "Line manager", "sub": "for people-based access", "kind": "actor" }, { "id": "self", "label": "Self-attestation", "sub": "low risk only", "kind": "risk" } ] }, { "title": "Decide", "nodes": [ { "id": "rec", "label": "System recommendation", "sub": "30-day inactivity signal", "kind": "platform" }, { "id": "dec", "label": "Decision", "sub": "approve · deny · no response", "kind": "decision" }, { "id": "esc", "label": "Escalation", "sub": "no response to owner's manager", "kind": "decision" } ] }, { "title": "Apply", "nodes": [ { "id": "rem", "label": "Remove access", "sub": "automatic on deny", "kind": "integration" }, { "id": "nores", "label": "No-response default", "sub": "remove — deny by default", "kind": "security" }, { "id": "exc", "label": "Documented exception", "sub": "14 days, owner accountable", "kind": "risk" } ] }, { "title": "Evidence", "nodes": [ { "id": "pack", "label": "Evidence pack", "sub": "7-year retention", "kind": "store" }, { "id": "cov", "label": "Coverage metric", "sub": "100% privileged, 98% apps", "kind": "platform" }, { "id": "exp", "label": "Auditor export", "sub": "read-only, on request", "kind": "store" } ] } ], "edges": [ { "from": "esc", "to": "nores", "label": "still no response", "kind": "error" }, { "from": "exc", "to": "scope", "label": "re-reviewed next cycle", "kind": "async", "route": "gutter" }, { "from": "rem", "to": "pack", "label": "revocation evidence", "kind": "sync" } ], "note": "The default on silence is removal. A campaign whose no-response path is approval measures reviewer engagement and nothing else, and the exception route is deliberately visible rather than tidy: 14 days, a named owner, re-reviewed next cycle.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "24-zero-trust-zones", "title": "Zero-Trust Zones & Enforcement Points", "layout": "zones", "canvas": { "width": 1780 }, "zones": [ { "title": "Untrusted", "kind": "trust", "nodes": [ { "id": "atk", "label": "Stolen password", "sub": "spray or replay", "kind": "risk" }, { "id": "phish", "label": "Consent phishing", "sub": "OAuth lure", "kind": "risk" }, { "id": "unman", "label": "Unmanaged device", "kind": "external" }, { "id": "user", "label": "Legitimate user", "kind": "actor" } ] }, { "title": "Identity perimeter", "kind": "trust", "nodes": [ { "id": "afd", "label": "Front Door + WAF", "kind": "integration", "icon": "azure_front-door-and-cdn-profiles" }, { "id": "sts", "label": "Entra STS", "sub": "smart lockout", "kind": "security", "icon": "azure_AzureActiveDirectory (Identity)" }, { "id": "ca", "label": "Conditional Access", "sub": "policy decision point", "kind": "security", "icon": "azure_conditional-access" }, { "id": "idp", "label": "ID Protection", "sub": "risk evaluation", "kind": "security", "icon": "azure_entra-id-protection" } ] }, { "title": "Application", "kind": "trust", "nodes": [ { "id": "apim", "label": "API Management", "sub": "validate-jwt", "kind": "integration", "icon": "azure_api-management-services" }, { "id": "apps", "label": "Application workloads", "sub": "managed identity", "kind": "app" }, { "id": "roles", "label": "App roles & scopes", "kind": "platform", "icon": "azure_app-registrations" } ] }, { "title": "Privileged", "kind": "trust", "nodes": [ { "id": "pim", "label": "Entra PIM", "sub": "no standing role", "kind": "security", "icon": "azure_entra-privleged-identity-management" }, { "id": "paw", "label": "Privileged workstation", "kind": "platform" }, { "id": "bas", "label": "Azure Bastion", "sub": "no public management port", "kind": "security", "icon": "azure_bastions" }, { "id": "bg", "label": "Break-glass", "sub": "2 accounts, alerted", "kind": "risk", "icon": "fa5_fire_extinguisher" } ] }, { "title": "Data", "kind": "trust", "nodes": [ { "id": "sql", "label": "Azure SQL & Cosmos", "sub": "Entra auth, RLS", "kind": "store", "icon": "azure_sql-database" }, { "id": "kv", "label": "Key Vault", "sub": "RBAC data plane", "kind": "security", "icon": "azure_key-vaults" }, { "id": "stor", "label": "Storage", "sub": "private endpoint", "kind": "store", "icon": "azure_storage-accounts" }, { "id": "arch", "label": "Evidence archive", "sub": "immutable", "kind": "store", "icon": "azure_storage-accounts" } ] } ], "edges": [ { "from": "atk", "to": "sts", "label": "blocked: lockout + MFA", "kind": "error" }, { "from": "phish", "to": "ca", "label": "blocked: consent workflow", "kind": "error" }, { "from": "unman", "to": "ca", "label": "blocked: not compliant", "kind": "error" }, { "from": "user", "to": "afd", "label": "HTTPS 443", "kind": "sync" }, { "from": "afd", "to": "apim", "label": "bearer token required", "kind": "sync" }, { "from": "ca", "to": "apim", "label": "token issued, 1 h", "kind": "sync" }, { "from": "apim", "to": "apps", "label": "scope + tenant claim", "kind": "sync" }, { "from": "apps", "to": "sql", "label": "managed identity, private", "kind": "sync" }, { "from": "pim", "to": "bas", "label": "activated session only", "kind": "sync" }, { "from": "bas", "to": "kv", "label": "no data-plane role", "kind": "error" }, { "from": "bg", "to": "stor", "label": "emergency reach, alerted", "kind": "error" } ], "note": "Every crossing is labelled with what authorises it or what stops it. The two red lines out of the privileged zone are deliberate: an administrator holds control-plane rights and no data-plane rights, so reading a secret is a separate, separately audited grant.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "25-multi-tenant-isolation", "title": "Multi-Tenant Isolation — identity, authorization, data", "layout": "nested", "canvas": { "width": 1760 }, "boxes": [ { "title": "Identity layer — separate directories, no shared principal", "kind": "trust", "dir": "row", "children": [ { "title": "Tenant A", "kind": "boundary", "nodes": [ { "id": "ausr", "label": "Users", "kind": "actor" }, { "id": "awl", "label": "Workload identities", "kind": "security" } ] }, { "title": "Tenant B", "kind": "boundary", "nodes": [ { "id": "busr", "label": "Users", "kind": "actor" }, { "id": "bwl", "label": "Workload identities", "kind": "security" } ] }, { "title": "Platform tenant", "kind": "boundary", "nodes": [ { "id": "ops", "label": "Platform operators", "sub": "PIM + customer approval", "kind": "actor" }, { "id": "pwl", "label": "Platform workload identity", "sub": "no tenant data role", "kind": "security" } ] } ] }, { "title": "Authorization layer — tid is a mandatory predicate, never an optional filter", "kind": "cloud", "dir": "row", "children": [ { "title": "Claims in the token", "kind": "boundary", "nodes": [ { "id": "tid", "label": "tid", "sub": "issuing tenant", "kind": "platform" }, { "id": "oid", "label": "oid / sub", "sub": "subject", "kind": "platform" }, { "id": "rl", "label": "roles / scp", "kind": "platform" } ] }, { "title": "Decisions made from them", "kind": "boundary", "nodes": [ { "id": "pred", "label": "Tenant predicate", "sub": "fails closed", "kind": "decision" }, { "id": "arole", "label": "App role check", "kind": "decision", "icon": "azure_app-registrations" }, { "id": "abac", "label": "ABAC condition on RBAC", "sub": "scope + attribute", "kind": "platform", "icon": "azure_entra-identity-roles-and-administrators" } ] } ] }, { "title": "Data layer — isolation proved by storage, not by code review", "kind": "cloud", "dir": "row", "children": [ { "title": "Shared services, partitioned", "kind": "boundary", "nodes": [ { "id": "cos", "label": "Cosmos DB", "sub": "partition key = tenant_id", "kind": "store", "icon": "azure_azure-cosmos-db" }, { "id": "sql", "label": "Azure SQL", "sub": "row-level security", "kind": "store", "icon": "azure_sql-database" }, { "id": "blob", "label": "Storage", "sub": "container per tenant", "kind": "store", "icon": "azure_storage-accounts" } ] }, { "title": "Dedicated, on request", "kind": "trust", "nodes": [ { "id": "ded", "label": "Dedicated database", "sub": "premium tier", "kind": "store" }, { "id": "cmk", "label": "Customer-managed key", "sub": "tenant holds revocation", "kind": "security" }, { "id": "pe", "label": "Private endpoint per tenant", "kind": "platform" } ] } ] } ], "outside": [ { "id": "rep", "label": "Cross-tenant reporting", "sub": "the one place tenants mix", "kind": "risk" }, { "id": "sup", "label": "Support engineer", "kind": "actor" } ], "edges": [ { "from": "tid", "to": "pred", "label": "read from token only", "kind": "sync" }, { "from": "pred", "to": "sql", "label": "session context per request", "kind": "sync" }, { "from": "cmk", "to": "ded", "label": "revoke key", "kind": "sync" }, { "from": "rep", "to": "cos", "label": "aggregate only, no row export", "kind": "batch" }, { "from": "sup", "to": "ops", "label": "elevation needs tenant approval", "kind": "error" } ], "note": "Three layers, because any one of them alone has a known bypass. The honest weak point is drawn: cross-tenant reporting is the single component with a legitimate reason to read every tenant, and it is therefore the component with the smallest surface and the tightest review.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "26-break-glass-and-recovery", "title": "Break-Glass & Identity Recovery", "layout": "flow", "canvas": { "width": 1780 }, "chain": true, "align": "top", "stages": [ { "title": "Detect", "nodes": [ { "id": "lock", "label": "Tenant lockout", "sub": "CA misconfiguration", "kind": "risk" }, { "id": "fed", "label": "Federation outage", "sub": "external IdP down", "kind": "risk" }, { "id": "comp", "label": "Admin compromise", "sub": "hostile sessions active", "kind": "risk" }, { "id": "sev", "label": "Severity call", "sub": "SecOps duty manager", "kind": "decision" } ] }, { "title": "Authorise use", "nodes": [ { "id": "two", "label": "Two-person rule", "sub": "holder + witness", "kind": "decision" }, { "id": "cred", "label": "Credential retrieval", "sub": "sealed, offline, split", "kind": "security" }, { "id": "alert", "label": "P1 alert fires", "sub": "on sign-in, no exception", "kind": "security" } ] }, { "title": "Recover", "nodes": [ { "id": "signin", "label": "Break-glass sign-in", "sub": "FIDO2 hardware key", "kind": "security", "icon": "fa5_fire_extinguisher" }, { "id": "restore", "label": "Re-apply configuration", "sub": "from the IaC repository", "kind": "integration" }, { "id": "revoke", "label": "Revoke hostile sessions", "sub": "and reset credentials", "kind": "security" }, { "id": "ms", "label": "Microsoft escalation", "sub": "if break-glass also fails", "kind": "risk" } ] }, { "title": "Verify", "nodes": [ { "id": "check", "label": "Normal access restored", "sub": "sample sign-in per persona", "kind": "decision" }, { "id": "rca", "label": "Root cause captured", "kind": "platform" }, { "id": "ev", "label": "Evidence pack", "sub": "every action, timestamped", "kind": "store" } ] }, { "title": "Reset", "nodes": [ { "id": "rot", "label": "Rotate credential", "sub": "within 24 hours", "kind": "integration" }, { "id": "seal", "label": "Re-seal and witness", "kind": "platform" }, { "id": "pir", "label": "Post-incident review", "sub": "outcome is a policy change", "kind": "platform" } ] } ], "edges": [ { "from": "signin", "to": "ms", "label": "authentication fails", "kind": "error" }, { "from": "check", "to": "restore", "label": "still broken, iterate", "kind": "error", "route": "gutter" }, { "from": "pir", "to": "lock", "label": "quarterly rehearsal", "kind": "async", "route": "gutter" } ], "note": "Break-glass is tested, not trusted. The quarterly rehearsal drives the loop back to the first stage on purpose: a credential nobody has signed in with for a year is an assumption, and RTO for tenant-level recovery is 4 hours only because it has been measured.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } }, { "id": "27-threats-and-failure-modes", "title": "Threats & Failure Modes", "layout": "grid", "canvas": { "width": 1790 }, "laneHeaderWidth": 195, "columns": [ "Cause", "First signal", "Containment", "Recovery", "Residual risk" ], "lanes": [ { "title": "Entra authentication outage", "cells": [ [ { "label": "Regional STS degradation", "kind": "risk" } ], [ { "label": "Token issuance errors", "kind": "store" } ], [ { "label": "Issued tokens valid to 1 h", "kind": "platform" } ], [ { "label": "Wait — no local IdP exists", "kind": "platform" } ], [ { "label": "Accepted, no alternative", "kind": "risk" } ] ] }, { "title": "Break-glass misuse", "cells": [ [ { "label": "Credential taken from vault", "kind": "risk" } ], [ { "label": "P1 on every sign-in", "kind": "security" } ], [ { "label": "Revoke sessions, isolate", "kind": "security" } ], [ { "label": "Rotate, re-seal, review", "kind": "platform" } ], [ { "label": "Two-person rule is procedural", "kind": "risk" } ] ] }, { "title": "Illicit consent grant", "cells": [ [ { "label": "OAuth lure to a user", "kind": "risk" } ], [ { "label": "New SP with Graph scopes", "kind": "security" } ], [ { "label": "Admin consent workflow blocks", "kind": "security" } ], [ { "label": "Revoke grant, delete SP", "kind": "platform" } ], [ { "label": "Low-risk user consent allowed", "kind": "risk" } ] ] }, { "title": "Service principal secret leak", "cells": [ [ { "label": "Secret in a repo or log", "kind": "risk" } ], [ { "label": "Sign-in from new ASN", "kind": "security" } ], [ { "label": "CA block, disable version", "kind": "security" } ], [ { "label": "Rotate, migrate to federation", "kind": "platform" } ], [ { "label": "170 principals still hold one", "kind": "risk" } ] ] }, { "title": "Guest over-entitlement", "cells": [ [ { "label": "Nested group inheritance", "kind": "risk" } ], [ { "label": "90-day guest review", "kind": "platform" } ], [ { "label": "Remove from nested group", "kind": "platform" } ], [ { "label": "Flatten the group model", "kind": "platform" } ], [ { "label": "Nesting still two deep", "kind": "risk" } ] ] }, { "title": "PIM approver compromise", "cells": [ [ { "label": "Approver account phished", "kind": "risk" } ], [ { "label": "Activation without a ticket", "kind": "security" } ], [ { "label": "Two approvers for tier 0", "kind": "security" } ], [ { "label": "Revoke, reset, re-review", "kind": "platform" } ], [ { "label": "Tier 1 needs one approver", "kind": "risk" } ] ] }, { "title": "HR feed failure", "cells": [ [ { "label": "Workday API down over 6 h", "kind": "risk" } ], [ { "label": "Provisioning job alert", "kind": "store" } ], [ { "label": "Freeze: no bulk disable on empty feed", "kind": "security" } ], [ { "label": "Backfill after restore", "kind": "platform" } ], [ { "label": "Leaver removal delayed", "kind": "risk" } ] ] }, { "title": "Dynamic group storm", "cells": [ [ { "label": "Reorg touches 40k users", "kind": "risk" } ], [ { "label": "Evaluation lag over 30 min", "kind": "store" } ], [ { "label": "One rule change per window", "kind": "platform" } ], [ { "label": "Wait for convergence", "kind": "platform" } ], [ { "label": "Access lag during reorgs", "kind": "risk" } ] ] } ], "note": "Every row ends in a residual risk, because a failure-mode table with an empty last column has not been finished. The first row is the honest one: this architecture cannot survive a total identity-provider outage, and no design on Azure can.", "meta": { "v": "1.0", "owner": "Data & AI Global Practice", "date": "2026-08" } } ]