Skip to content
IT Atlas

Architecture · Identity Architecture

Identity Architecture

The design of directories, identity providers, authentication flows, privilege tiers and lifecycle processes that govern all access.

AdvancedUpdated 2026-09-01

Overview

Identity architecture decides where identities originate, which system is authoritative, how authentication reaches every application, how privilege is separated, and how joiners, movers and leavers are processed automatically.

In a hybrid estate the crucial decisions are the synchronisation scope, the authentication method, and the boundary between on premises and cloud privilege. Getting those wrong links two Tier 0 environments together permanently.

Sequence

Modern authentication flow
  1. 1User
  2. 2Device
  3. 3Identity provider
  4. 4Primary authentication
  5. 5MFA
  6. 6Conditional Access evaluation
  7. 7Authorization
  8. 8Application

Layer model

Sources of authority
HR system for peopleAsset system for devicesContract records for third partiesCMDB for workloads
Directories & providers
Active DirectoryMicrosoft Entra ID or equivalent IdPApplication local directories to be retiredCertificate authority
Access control
Conditional Access / policy engineRole model and entitlementsPrivileged access tiers with JITGuest and partner access model
Assurance
Sign in and audit loggingAccess reviewsIdentity threat detectionBreak glass procedures

Design considerations

  • Define one authoritative source per identity type and automate provisioning from it.
  • Keep cloud and on premises privileged accounts strictly separate; never synchronise Tier 0 accounts.
  • Standardise on SSO for every application and record exceptions with a retirement plan.
  • Design break glass access, accounts, storage of credentials, monitoring and testing schedule.

Security considerations

  • Require phishing resistant MFA for administrators and privileged workflows.
  • Eliminate standing privilege with just in time activation and approval.
  • Monitor identity specific signals: MFA registration changes, consent grants, federation trust changes, directory role changes.

Common misconfigurations

  • Password hash synchronisation and federation both partially configured, producing inconsistent authentication behaviour.
  • Guests granted default member level directory permissions.
  • Service accounts holding permanent privileged roles.

Failure points

  • Identity provider outage with no offline or cached authentication path for critical systems.
  • Single synchronisation server with no rebuild documentation.
  • Expired federation or token signing certificates.