Identity should be automatic, secure, auditable, and nearly invisible to the end user.
This project designs a complete identity operating model for a fictional global law firm:
- 10,000 employees across 50 offices
- Partners, associates, paralegals, HR, finance, IT, contractors, and vendors
- Microsoft 365, Entra ID, Active Directory, hybrid infrastructure
- Built on Zero Trust principles
The goal is not to manage users. The goal is to redesign how identity works — so that the right people have exactly the access they need, access adjusts automatically as people move, and the entire system is governable, auditable, and nearly invisible to the people who use it.
If the identity system is working as designed:
- New hires start with what they need on day one
- Promotions automatically adjust access
- Contractors lose access when engagements end
- Managers complete access reviews in minutes
- Security teams have clear, real-time visibility
- Auditors can verify controls without chasing spreadsheets
The full set of guiding principles is captured in The Identity Manifesto.
Automated provisioning, recalculation, and deprovisioning driven by HR as the source of truth.
- Joiner Workflow — zero-touch role-based onboarding
- Mover Workflow — automatic access recalculation (eliminates privilege creep)
- Leaver Workflow — complete, immediate deprovisioning
Standardized role packages — assign a role, not 20 individual permissions.
Access governed by declarative rules, not person-by-person decisions. Predictable, scalable, self-documenting.
Every access decision answers: who approved it, why, when it expires, and whether it's still needed. See Audit & Certification and Access Request & Approval.
Strategic identity posture visibility for security leadership — privileged accounts, dormant identities, pending reviews, risky sign-ins, and overdue certifications at a glance.
| Section | Description |
|---|---|
manifesto/ |
The Identity Manifesto — guiding principles |
docs/ |
Problem statement, architecture, JML workflows, roadmap |
policy-as-code/ |
Declarative access policy model |
rbac-library/ |
Standardized role packages |
dashboard/ |
Executive identity posture dashboard |
diagrams/ |
Architecture and workflow flow diagrams |
scripts/ |
PowerShell reference implementations (Graph API) |
role-definitions/ |
RBAC role-to-access matrix |
| Problem | Solution |
|---|---|
| Slow, manual onboarding | Zero-touch role-based provisioning (Joiner) |
| Access that doesn't match role | RBAC Library + Policy-as-Code |
| Privilege creep on role changes | Automatic access recalculation (Mover) |
| Painful, manual auditing | Continuous governance + Executive Dashboard |
Microsoft Entra ID · Active Directory Domain Services · Microsoft Graph API / Graph PowerShell · PowerShell · Conditional Access · Privileged Identity Management (PIM) · SSO / SCIM · Zero Trust Architecture
This is a design and demonstration project — a complete identity operating model with architecture, governance processes, policy model, role library, executive reporting, and PowerShell reference implementations. It demonstrates identity architecture thinking at enterprise scale: secure by default, automated, auditable, and built to improve both security and user experience.
Designed and documented by Renard Priester — Identity & Access Management Engineer