Microsoft Entra ID

Overview

We design Entra ID groups, app registrations, and Azure RBAC for the data platform. People receive access through groups tied to a role, and applications use an app registration or managed identity with only the permissions that role needs.

We document privileged roles, including who can assign them, and we align conditional access with what your identity team already enforces. Service principals created for a single project are listed so they are not forgotten.

What we deliver

• Group and RBAC model for engineers, analysts, and operators
• App registrations with the minimum API permissions required
• A list of privileged roles and who may assign them
• Conditional access notes agreed with the identity team

Business benefits

• Access is granted to a group, so leavers lose it when the group membership changes
• Applications do not run as a named person
• Privileged roles are few enough to review