Architecture · Identity Architecture
Identity Architecture
The design of directories, identity providers, authentication flows, privilege tiers and lifecycle processes that govern all access.
AdvancedUpdated 2026-09-01
Overview
Identity architecture decides where identities originate, which system is authoritative, how authentication reaches every application, how privilege is separated, and how joiners, movers and leavers are processed automatically.
In a hybrid estate the crucial decisions are the synchronisation scope, the authentication method, and the boundary between on premises and cloud privilege. Getting those wrong links two Tier 0 environments together permanently.
Sequence
- 1User
- 2Device
- 3Identity provider
- 4Primary authentication
- 5MFA
- 6Conditional Access evaluation
- 7Authorization
- 8Application
Layer model
Sources of authority
HR system for peopleAsset system for devicesContract records for third partiesCMDB for workloads
Directories & providers
Active DirectoryMicrosoft Entra ID or equivalent IdPApplication local directories to be retiredCertificate authority
Access control
Conditional Access / policy engineRole model and entitlementsPrivileged access tiers with JITGuest and partner access model
Assurance
Sign in and audit loggingAccess reviewsIdentity threat detectionBreak glass procedures
Design considerations
- Define one authoritative source per identity type and automate provisioning from it.
- Keep cloud and on premises privileged accounts strictly separate; never synchronise Tier 0 accounts.
- Standardise on SSO for every application and record exceptions with a retirement plan.
- Design break glass access, accounts, storage of credentials, monitoring and testing schedule.
Security considerations
- Require phishing resistant MFA for administrators and privileged workflows.
- Eliminate standing privilege with just in time activation and approval.
- Monitor identity specific signals: MFA registration changes, consent grants, federation trust changes, directory role changes.
Common misconfigurations
- Password hash synchronisation and federation both partially configured, producing inconsistent authentication behaviour.
- Guests granted default member level directory permissions.
- Service accounts holding permanent privileged roles.
Failure points
- Identity provider outage with no offline or cached authentication path for critical systems.
- Single synchronisation server with no rebuild documentation.
- Expired federation or token signing certificates.
