Practice 02 / Identity & access
Identity, Access & Zero Trust Architecture
Know who can get in. Prove you can remove them.
The operational risk
Know who can get in. Prove you can remove them.
A former contractor’s account, a broad application permission or an unmanaged service identity can outlive the business reason it was created.
“You have multifactor authentication, so access is covered.”
Make the responsibility visible.
A human login check does not define what a service account, application token or privileged vendor connection can do after access is granted.
The B3 deliverable
What you receive
- An inventory of privileged people, service accounts, application grants and vendor access paths.
- A joiner, mover and leaver workflow with evidence requirements and exception owners.
- A least-privilege and token-boundary review, including tenant and environment separation.
- An Azure Arc governance review where it is in scope: ownership, policy, role assignments and managed identity boundaries.
- A revocation exercise plan, findings register and prioritized implementation roadmap.
Who this is for
IT directors overseeing Microsoft environments, multi-site organizations and outsourced administration.
Evidence needed to begin
- Read-only identity and role exports
- Application and vendor access inventory
- Offboarding procedures
- Architecture and tenant diagrams
Acceptance criteria
A result you can inspect.
Privileged identities have accountable owners, defined scope and a documented method to revoke access; exceptions have explicit approval.
Show us every vendor and application identity with privileged access, its owner, and the last successful test of revoking it.Scope this engagement →
Roles and boundaries
Production changes are performed by your authorized implementation team under an agreed change plan.
Read the buyer guide: AI Vendor Security Checklist for Procurement Teams ↗
Before the next signature
Make the decision with someone on your side.
Start with the decision, the deadline and the evidence you need. We will define a practical scope from there.
Schedule a 20-minute scoping call →