OWASP Building Identity Governance & Lifecycle — Azure Focused
When to Use
- When automating the onboarding and offboarding of users in an Azure tenant.
- When configuring Entra ID Governance features like access reviews and entitlement management.
- When establishing a "birthright" access model for new employees based on job code.
- When auditing orphaned accounts belonging to terminated users.
Key Concepts
| Term | Definition |
|---|---|
| JML | Joiner-Mover-Leaver, the core lifecycle of an employee identity |
| Birthright Access | Permissions automatically granted to every user in a specific group or department |
| Access Review | Periodic process where managers certify that their employees still need specific permissions |
| Orphaned Account | A valid account in a system that no longer corresponds to an active employee |
OpenShield Identity Rules
| Rule | Description | Severity |
|---|---|---|
| AZ-IDN-007 | Active User with No MFA Registered in Entra ID | HIGH |
| AZ-IDN-003 | Unrestricted Guest Invitations Allowed in Entra ID | MEDIUM |
| AZ-IDN-006 | Service Principal Secrets Not Rotated Recently | MEDIUM |
Lifecycle Workflow
Step 1: Define Joiner Process
Automate account creation via HR feed integration (e.g., Workday to Entra ID).
Step 2: Implement Access Reviews
Configure quarterly reviews for high-privilege roles like Global Administrator.
Step 3: Offboarding (Leaver)
Ensure accounts are disabled immediately upon HR status change.
Remediation Reference
- Use PIM: Implement Privileged Identity Management for just-in-time elevation.
- Automate Termination: Use Entra ID Lifecycle Workflows to trigger access revocation.
- Audit Guests: Regularly review and remove guest users who haven't signed in for 90+ days.