Designing an IAM Strategy for your Engineering Platform
summary
Practical design for engineer access using Entra ID Access Packages and Privileged Identity Management: access packages map product+role to Entra groups, approvals and recurring access reviews, and eligible role activation for production. Implemented across three organizations, it yields product owners controlling approvals, auditable logs and fewer standing privileges, but requires P2 licensing, has delayed revocation, no app‑registration support, and reviewers cannot see each other’s actions; engineers get workable non‑prod and scoped prod access via Azure and Azure DevOps integrations.
AI-written summary · about
chapters (12)
- 0:00Introduction
- 1:10Talk overview
- 2:36Traditional org challenges
- 7:34IAM design requirements
- 10:30Access Packages intro
- 14:05Demo: Access Packages
- 18:44Design for product roles
- 24:29Scaling to all roles
- 30:06Engineer access pipeline
- 31:51Implementation results
- 36:25Tips for dev tenant
- 37:29Q&A
related talks
50mDesigning an IAM Strategy for your Engineering Platform
45mPlatform Engineering vs DevOps
29mIaC Next Steps in Platform Engineering
49mFrom DevSecOps to Platform Engineering
20mPlatform Engineering XXL
01h 25mEngineering Platforms for Engineers who Engineer Platforms
41mPlatform Engineering for Developers, Architects & the Rest of Us
26mCompliance-Aware Platform Engineering