Real-Time Analytics Platform  ·  View 21 of 21  ·  Assurance

Identity and Access Flow

Who proves what, to whom, in what order — for a machine producer publishing events and a human analyst running a query.

Editable source SVG draw.io All views
Producer Service
Producer Service
Microsoft Entra ID
Microsoft Entra ID
API Management
API Management
Event Collector
Event Collector
Azure Event Hubs
Azure Event Hubs
Azure Data Explorer
Azure Data Explorer
Analyst
Analyst
1. client credentials + certificate
1. client credentials + certificate
2. token · scope events.write
2. token · scope events.write
3. POST /v1/events + bearer
3. POST /v1/events + bearer
4. validate JWT, pin tenant_id
4. validate JWT, pin tenant_id
5. forward with pinned claim
5. forward with pinned claim
6. publish via managed identity
6. publish via managed identity
7. 403 on tenant mismatch
7. 403 on tenant mismatch
8. sign in + MFA
8. sign in + MFA
9. id and access token
9. id and access token
10. KQL with on-behalf-of token
10. KQL with on-behalf-of token
11. row-level security by tenant
11. row-level security by tenant
12. rows in scope only
12. rows in scope only
Identity and Access — Producer and Consumer
Identity and Access — Producer and Consumer
Producer tokens live 60 minutes and are certificate-bound; analyst access is group-based and reviewed quarterly.
Producer tokens live 60 minutes and are certificate-bound; analyst access is group-based and reviewed quarterly.
v 1.0 · owner Security Architecture · date 2026-08
v 1.0 · owner Security Architecture · date 2026-08Text is not SVG - cannot display

Producer authorisation

  • Client credentials with a certificate, scoped to events.write for one tenant
  • The tenant claim is pinned at API Management and cannot be overridden by the payload
  • Tokens live 60 minutes; a mismatch returns 403 and is recorded as a security event

Consumer authorisation

  • Analysts sign in with MFA and query on an on-behalf-of token, never a service principal
  • Row-level security filters on the tenant claim inside that token
  • Group membership is reviewed quarterly with access certification evidence retained

Gap to close

  • Certificate rotation for producers is manual today and should be automated before scale-out
  • Break-glass access to the leader cluster exists and needs a time-bound approval workflow
  • Service-principal use by legacy partners is a documented exception with a sunset date
◀  Security Architecture — Trust Zones All views
Solution Architecture v1.0 · Azure · Data & AI Architecture · 2026-0821-identity-and-access-flow