Implementation plan
Phase 6: Entra identity and security policy
Deliverables and exit criteria for Entra identity and security policy.
Status: planned; completion evidence not yet recorded in this documentation.
Implement:
- Per-organization OIDC provider model
- Organization Entra integration
- JIT provisioning
- App roles/group mapping
- Group-overage behavior
- Host-specific app sessions
- Runtime identity assertions
- SCIM Users/Groups
- Session/grant revocation
- Named IP lists
- Access profiles
- Mandatory organization policies
- WAF-lite selectors/actions
- Rate limits
- Trusted client-IP handling
- Security-policy approval/versioning
Exit criteria:
- Assigned pilot user can sign in.
- Unassigned user is denied.
- Disabled SCIM user loses access and sessions.
- App cannot receive a raw Entra token.
- Spoofed identity headers fail.
- IP list names/descriptions/CIDRs work.
- App owner cannot weaken mandatory organization policy.
Evidence to record
Record implementation revisions, test reports, relevant ADRs, unresolved findings, the accepting owner, and acceptance date. Leave this phase planned until its exit criteria are demonstrated.