Solution
Identity and access management
Integration of directories, single sign-on (SSO), application roles and service identities. Authentication and authorisation for users, applications and automated jobs on-premises or in the cloud.
Architecture and implementation
Directories and federation
Directory structure design and identity federation between services.
Authentication and authorisation
Sign-in mechanisms and access rules for applications and resources.
Workload identities
Service accounts, roles and integrations for software and deployment pipelines.
Design decisions
Design of authentication and authorisation flows for people, applications and service accounts. Identity establishes who acts; authorisation defines permitted operations on each resource.
Illustrative implementation
An application can use a service identity restricted to an API and data scope, with access renewal independent of personal accounts.
Engineering outputsRole model, identity integrations, access policies and account lifecycle
Related projects
This architecture connects school administration, Microsoft 365 and learning applications through a shared Entra ID identity. One example is a school portal linked to enrolment records, online courses and collaboration spaces, with accounts and groups reused across the platforms.
Azure App Service
.NET
Microsoft Entra ID
GitHub
Microsoft Graph
Microsoft Intune
Microsoft 365
n8n
PostgreSQL
Power BI
Components and flows
- Data exchange from the school information system to applications and Microsoft Graph services
- Entra ID authentication for Microsoft 365, the learning platform and the application portal
- Intune device management, PostgreSQL application data and Power BI models
A web and mobile application uses .NET services hosted on Azure, connected to PostgreSQL, Business Central and Microsoft 365. One example is a custom business portal for following quotations and orders, with access to related documents and records from the business management system.
- Azure App Service
Azure Database for PostgreSQL
Business Central- .NET
- Microsoft Entra ID
- GitHub
- Microsoft Graph
JavaScript
Kotlin- Microsoft 365
- n8n
- Power BI
Terraform
Components and flows
- Web and mobile access to .NET application services, with Entra ID authentication
- n8n integrations with Business Central and Microsoft 365 through their APIs
- Azure App Service and PostgreSQL deployment, with private data access and Power BI publishing
A private platform connects a research agent to a document index and a local Llama model, with retrieval filtered by access permissions. For example, it can support review of a contract file by locating relevant passages in the firm’s documents and reference texts, then preparing an answer with source references.
Docker- .NET
- Microsoft Entra ID
Infomaniak
LangChain
Linux
Llama (Meta)
Model Context Protocol- Microsoft 365
- PostgreSQL
Python
Components and flows
- Extraction of Microsoft 365 documents and reference collections, followed by text and vector indexing in PostgreSQL
- LangChain agent using a Llama model and read-only MCP search tools, with permission filtering and bounded tool calls
- Available context checked before generation, with references presented in a .NET application
Development and integration
- Active Directory, Entra ID and identity services
- Single sign-on and federation
- Application roles and cloud permissions
- Service identities and secrets management
Systems involved
- Web and mobile applications
- Directories and cloud platforms
- APIs, systems and deployment pipelines
Service lineServers and hosting →
To go deeper
Four decisions for cloud access across Google Cloud, Azure, AWS and Infomaniak
Permission scope, temporary privileges, workload identities and traceability let a team compare platforms against the same requirements.
Five attack scenarios and the controls that limit their consequences
Exposed services, accounts, payments, suppliers and recovery need different protections. Priority follows the activities the organisation must preserve.
Discuss your project
A discussion of your project’s design, development and production deployment.