RBAC & ABAC, IT Atlas

Overview

Role based access control assigns permissions to roles and roles to identities, which is predictable and auditable but can proliferate into hundreds of near identical roles.

Attribute based access control evaluates attributes of subject, resource, action and environment at request time, allowing expressive policy such as 'finance staff may read documents tagged for their own region during business hours'. Most real estates blend the two.

Security considerations

Design roles from job functions, then verify with access reviews; do not derive roles from existing sprawl.
Prefer least privilege with scoped assignments over broad built in administrator roles.

Related topics

Identity Governance

The lifecycle and oversight side of identity: joiner mover leaver automation, entitlement management, access reviews and separation of duties.

Privileged Access Management

Controlling, brokering, recording and time limiting administrative access to the systems that can change everything else.

Microsoft Entra ID

Microsoft's cloud identity and access management service, the identity control plane for Microsoft 365, Azure and thousands of federated applications.

IT Governance

Establishing direction, decision rights, accountability and oversight so technology serves organisational objectives.

Identity Fundamentals

Authentication proves who you are; authorization decides what you may do; identity management maintains both over time.

CRM & ERP

Systems of record for customer relationships and for core business operations such as finance, supply chain and manufacturing.

Access Governance

Ensuring that access rights are justified, approved, reviewed and removed across every system.