platform-identity-graph

Type: regulative

Decision

A landing zone identity must hold granular Microsoft Graph read permissions and no broad directory access.

Why

Without them, applications cannot resolve tenant identities, so user lookup and group-based authorization fail.

Violations

• Landing zone identity granted write permissions to Microsoft Graph.
• Landing zone identity granted Directory.Read.All instead of granular read permissions.

Anchor

no-platform-ops

Implements

• platform

Files

• landing-zones/bicep/entra.bicep
• landing-zones/bicep/modules/base/appRoleAssignedTo.bicep

Links

• landing-zone-identity (depends-on) — One shared identity per landing zone is what makes a single permission grant cover every workload in it.

← Back to knowledge graph