URL Shortener & Link Management Service  ·  View 23 of 23  ·  Assurance

Identity and Access

Who proves what, and the deliberate absence of an identity on the path that carries 99.9% of the traffic.

Editable source SVG draw.io All views
Clicker Customer developer Front Door Link API Entra ID Key Vault Link table 1. GET /{code} — no credential, by design 2. 302; every field treated as hostile 3. console sign-in, MFA 4. token with one tenant claim 5. POST /links with tenant-scoped API key 6. resolve key hash and scopes 7. scopes: links:write on 2 domains 8. reject if key spans more than one tenant 9. workload identity for data access 10. managed identity token 11. write, partitioned by code hash 12. committed, audit entry appended 13. 201 — actor recorded on the link Identity — Who Proves What, and Where Nobody Has To The clicker has no identity and must never need one. Every other actor is scoped to exactly one tenant, and the resolver appears nowhere in this diagram because it holds no credential at all. v 1.0 · owner Platform Architecture · date 2026-09

Two different worlds

  • The clicker presents nothing and must never need to. Every field of their request is therefore treated as hostile input.
  • Every other actor is bound to exactly one tenant: an API key that spans two tenants is rejected as malformed, not merely unauthorised.
  • The resolver appears nowhere in this diagram because it holds no credential — the strongest statement the identity model makes.

How access is granted

  • Console: Entra ID with MFA, one tenant claim per token.
  • API: tenant-scoped keys with explicit scopes, hashed at rest in Key Vault, revocable without redeployment.
  • Service-to-data: workload identity only. No connection string exists in any application configuration.

Accountability

  • Every link write records the actor and appends an immutable audit entry visible to the owning tenant.
  • A destination edit is the highest-privilege operation in the product — it redirects traffic somebody else already distributed — and is audited as such.
◀  Security Trust Zones All views
Solution Architecture v1.0 · Microsoft Azure · Platform Architecture · 2026-09 · 23 views · 16 architecture decision records23-identity-and-access