Start with identity and intent
The design treats every access request as untrusted until the user, role and context are established. Administrative paths receive stricter controls than ordinary user access.
Featured portfolio project · Phase 1 shipped
Azure Entra Zero Trust Landing Zone
A Terraform-driven reference implementation for building an identity-first Azure baseline with Conditional Access, emergency access, least privilege and documented design decisions.
Interactive walkthrough
How an access decision moves through the design
Select each stage to see the purpose of the control, not just the technology behind it.
User or adminidentity request
Entra IDauthentication
Conditional Accessrisk + context
Azure resourceauthorised session
identity → authentication → policy → resource
Emergency accesscontrolled exception
Policy setMFA · device · risk
RBAC + Policyleast privilege
Authenticate without creating a lockout trap
Strong authentication is paired with controlled emergency-access accounts. The exception exists for resilience, but is tightly separated, monitored and documented.
Evaluate context before granting access
Conditional Access applies requirements based on identity, device, risk and target resource. Policies are designed for staged rollout rather than an immediate tenant-wide switch.
Limit what an authorised session can do
Authentication is not the end of the control chain. Azure RBAC and policy guardrails reduce privilege and constrain how resources can be created or changed.
Design decisions
Controls shaped by failure modes
Emergency access is designed, not improvised
Break-glass accounts are separated from ordinary administration so recovery remains possible without weakening the standard path.
Policies need staged deployment
Conditional Access changes can lock out legitimate users. The design emphasises review, report-only evaluation, exclusions and rollback thinking.
Infrastructure code supports review
Terraform makes the intended configuration visible, repeatable and easier to compare over time than undocumented portal changes.
Why this matters
Identity failures can expose every connected cloud service. A secure baseline must reduce risk without creating fragile controls that operations teams cannot safely maintain.
What the repository contains
- Reusable Conditional Access configuration
- Emergency-access handling
- Threat model and architecture decisions
- Least-privilege and policy guardrail patterns
- Implementation documentation and phased roadmap