Type: decision
Each landing zone has a single managed identity that serves all its capabilities — GitHub workflows, automation jobs, and Entra ID queries.
Without a single identity, each capability needs its own RBAC and OIDC config — the permission surface multiplies with every new capability and auditing becomes impractical.