Case file 02
Access that follows the person
Architecture · Attribute to access
- Identity recordDepartment, company, employee type
- Dynamic groupCFG Finance Employees, rule-evaluated
- App assignmentCFG Finance Portal, group-inherited
Implementation
Joiner: Jonathan Jones
Created a Finance employee (Department Finance, Company CFG, Employee). Entra placed him in CFG Finance Employees and he inherited the CFG Finance Portal assignment.
Mover: Sarah Mitchell
Changed Finance to Marketing. Dynamic membership moved her to Marketing and the group-derived Finance Portal assignment disappeared.
Leaver: David Coleman
A contractor, excluded from the employee-only Finance group. Disabled the account, revoked Entra sign-in sessions, and verified AccountEnabled true to false and the StsRefreshTokensValidFrom update in the audit log.
Security principles applied
| Attribute-based access | Membership computed from identity data |
|---|---|
| Least privilege | Contractor excluded from employee-only access |
| Privilege-creep prevention | Mover loses inherited Finance access |
| Containment | Disable plus session revocation |
| Auditability | Modified properties reviewed in audit logs |
Results
- Joiner inherited the right application through group membership, with no per-user assignment.
- Mover's stale Finance assignment was removed by rule evaluation.
- Leaver's account was disabled and sessions revoked, both visible in audit records.
Lessons learned
- A dynamic rule is only as good as the attribute it reads.
- Group-derived assignment, app provisioning and active sessions are separate concerns.
- Department-wide groups should not carry individual exceptions.
What this does not prove
- No HR-driven provisioning, SCIM, or downstream app-account deletion is claimed.
- Session revocation does not end every independent application session.
- David had no prior entitlements, so entitlement removal was not demonstrated for him.