An Architectural Taxonomy & Service Coverage Map for Enterprise Identity Engineering
Authored by Steven Tuschman | Identity Security Engineer
This repository establishes a comprehensive control plane capability matrix across the Microsoft Entra ID ecosystem. Derived from the Microsoft SC-300 engineering surface area, this index categorizes 35 core identity services and administrative engines into seven functional security domains.
Rather than treating identity tools as isolated portal features, this taxonomy maps each capability to its core mechanical function and its specific Non-Human Identity & Pipeline Intersect, serving as a design blueprint for Zero Trust access enforcement, identity governance, and workload hardening.
The core rules and fences that control how the directory operates and who is allowed to change it.
-
Tenant Configuration & Global Settings
- Control Plane Scope: Tenant properties, user/group global configurations, and corporate branding.
- Non-Human Identity Impact: Stops random developers from registering new applications or service accounts without oversight, acting as the first line of defense against unauthorized automation.
-
Built-In & Custom Roles (RBAC)
- Control Plane Scope: Directory role definitions, administrative permissions, and scope boundaries.
- Non-Human Identity Impact: Ensures an automation script or pipeline only gets the exact, limited permissions it needs to do its job, rather than accidentally inheriting broad administrative rights.
-
Administrative Units (AUs)
- Control Plane Scope: Scoped management boundaries, including restricted management behavior.
- Non-Human Identity Impact: Locks down service accounts to a specific project or department environment. If an automation script is compromised, it is trapped inside its fenced area and cannot touch the rest of the tenant.
-
Directory Objects
- Control Plane Scope: User, group, and service principal object lifecycle configurations.
- Non-Human Identity Impact: Tracks the lifecycle of a machine account. It makes sure every headless account has a human owner and guarantees it gets disabled or deleted when a project ends so you don't have forgotten, active credentials floating around.
-
Custom Security Attributes (CSAs)
- Control Plane Scope: Key-value pairs for metadata-driven Attribute-Based Access Control (ABAC).
- Non-Human Identity Impact: Lets you tag a machine account with a label like "Production-Pipeline." You can then build a hard rule that says only accounts wearing that specific tag are allowed to request access to your most sensitive environments.
-
Device Management
- Control Plane Scope: Device join, registration, and global device policy settings.
- Non-Human Identity Impact: Forces the physical or virtual machine running your automation scripts to prove it is secure, fully patched, and company-owned before the machine identity is allowed to authenticate.
The real-time decision engines that inspect every connection attempt and enforce your security boundaries before granting access.
-
Conditional Access (CA) Engine
- Control Plane Scope: Central context-based access evaluation and policy enforcement.
- Non-Human Identity Impact: Forces automated processes and service principals to prove they are connecting from approved, trusted network locations, instantly blocking any machine logins attempting to fire from unexpected or unauthorized IP addresses.
-
CA Authentication Context
- Control Plane Scope: Step-up security triggers for granular high-value application targets.
- Non-Human Identity Impact: Requires automation pipelines to satisfy much stricter requirements (like proving the API call is originating from a highly compliant, managed jump box) before they are allowed to touch top-tier secrets or critical production environments.
-
Protected Actions
- Control Plane Scope: CA policy gates protecting high-privilege directory permissions.
- Non-Human Identity Impact: Stops a compromised machine account from making deep, structural changes to the directory. It guarantees that only explicitly verified human admins (and tightly controlled automation) can alter your core configurations.
-
Microsoft Entra ID Protection
- Control Plane Scope: User, sign-in, and workload identity risk evaluation engines.
- Non-Human Identity Impact: Actively monitors workload identities (machine accounts) for suspicious behavior, automatically blocking a service principal if its credentials suddenly start executing from a known malicious IP address or acting erratically.
-
Global Secure Access (GSA / SSE)
- Control Plane Scope: Internet Access, Private Access, and M365 traffic client profiles.
- Non-Human Identity Impact: Ensures that API calls and automated traffic originating from your pipelines are routed safely through secure, inspected channels rather than traversing the open internet to reach your internal resources.
The systems that prove exactly who or what is logging in, designed to eliminate reliance on easily stolen passwords and static secrets.
-
Authentication Methods (FIDO2, Passkeys, Authenticator app, TAP, CBA)
- Control Plane Scope: FIDO2, Passkeys, Authenticator app, TAP, and CBA.
- Non-Human Identity Impact: Paves the way to eliminate static API keys entirely. It allows automation and pipelines—such as a GitHub Actions runner securely accessing an Azure Key Vault—to authenticate using secure, mathematical certificates or short-lived tokens instead of a hardcoded text string.
-
MFA Settings & Registration Campaigns
- Control Plane Scope: Global MFA enforcement mechanisms and nudge campaigns.
- Non-Human Identity Impact: While primarily for human accounts, strictly enforced MFA on your directory admins prevents an attacker from hijacking a human session to secretly generate, steal, or modify the credentials of your critical machine identities.
-
Self-Service Password Reset (SSPR)
- Control Plane Scope: User-led credential remediation and writeback workflows.
- Non-Human Identity Impact: Draws a hard line between human and machine troubleshooting. If an automated service account is locked out, it cannot use self-service tools; it forces a deliberate, audited administrative intervention to restore pipeline access.
-
Entra Password Protection
- Control Plane Scope: Smart lockout and custom banned password dictionary evaluation.
- Non-Human Identity Impact: Acts as a critical safety net for any legacy service accounts or third-party vendor tools in your environment that are unfortunately still relying on static passwords, immediately shutting down automated guessing attacks against your backend infrastructure.
-
Windows Hello for Business (WHfB)
- Control Plane Scope: Device-bound cryptographic passwordless deployments.
- Non-Human Identity Impact: Hardens the actual developer workstations where your infrastructure-as-code and deployment scripts are written. It ensures that the engineer triggering a sensitive pipeline is physically sitting at a trusted, company-owned machine.
-
Microsoft Entra Kerberos
- Control Plane Scope: Cloud identity authentication to on-premises storage and resources.
- Non-Human Identity Impact: Allows your modern cloud-native automation scripts to securely reach back into legacy, on-premises data centers without forcing you to embed highly vulnerable, legacy passwords inside your clean cloud environments.
The rules for securely working with outside vendors, partners, and other company directories without giving away the keys to the castle.
-
External Collaboration Settings (B2B)
- Control Plane Scope: Guest invitation policies and user access restrictions.
- Non-Human Identity Impact: Prevents external guests or compromised vendor accounts from silently registering their own rogue applications, service accounts, or automation tools inside your environment.
-
Cross-Tenant Access Settings (XTAS)
- Control Plane Scope: Inbound/outbound multi-tenant trust and compliance controls.
- Non-Human Identity Impact: Strictly controls whether a multi-tenant application or an automated pipeline living in a vendor's environment is allowed to reach across the boundary and pull data from your systems.
-
Cross-Tenant Synchronization (CTS)
- Control Plane Scope: Automated cross-tenant identity provisioning engines.
- Non-Human Identity Impact: Eliminates the need to build custom, highly-privileged sync scripts. By using the built-in engine, you remove the massive security risk of home-brewed machine identities holding permanent "read/write everything" permissions across two different companies.
-
External IdP Federation
- Control Plane Scope: Direct SAML / WS-Fed federation configurations.
- Non-Human Identity Impact: Ensures that when your environment interacts with third-party systems, your automation and CI/CD pipelines can rely on standardized, secure token exchanges rather than forcing you to hardcode and juggle static API keys for outside platforms.
The central command for all non-human accounts, dictating exactly how software, scripts, and outside applications are allowed to operate within your environment.
-
App Registrations & Service Principals
- Control Plane Scope: Application definitions, manifest tokens, and API permissions.
- Non-Human Identity Impact: This is the absolute core of your machine identity framework. It dictates the exact API permissions your automation pipelines hold and determines whether they are forced to authenticate with vulnerable, static secrets or secure cryptographic certificates.
-
Managed Identities for Azure Resources
- Control Plane Scope: System-assigned and user-assigned secretless machine credentials.
- Non-Human Identity Impact: The gold standard for cloud-native automation. It allows your compute workloads to securely talk to databases and key vaults without you ever having to write, store, or manage a single API key or password in your code.
-
Enterprise Applications Management
- Control Plane Scope: Tenant-level application settings, user assignments, and consent gates.
- Non-Human Identity Impact: Acts as the firewall for external machine identities. It allows you to strictly enforce "admin consent," meaning a random third-party app cannot start quietly pulling directory data or reading emails until a top-level security administrator explicitly approves the connection.
-
Microsoft Entra Application Proxy
- Control Plane Scope: On-premises web application publishing architecture.
- Non-Human Identity Impact: Allows modern, cloud-based automation systems to securely push data down into legacy on-premises applications through a tightly controlled, outbound-only gateway—completely eliminating the need to poke dangerous inbound holes through your corporate network firewall.
-
Defender for Cloud Apps (MDCA) Proxy
- Control Plane Scope: Conditional Access App Control session and access policies.
- Non-Human Identity Impact: While heavily focused on human sessions, it provides a critical layer of oversight for how data moves in and out of third-party SaaS applications, ensuring that automated integrations aren't being used as a backdoor to quietly exfiltrate massive amounts of corporate data.
The oversight systems that automatically manage who gets access, ensure nobody holds onto permissions longer than they should, and tightly control administrative power.
-
Privileged Identity Management (PIM)
- Control Plane Scope: Just-In-Time elevation for Entra roles, Azure resources, and PIM for Groups.
- Non-Human Identity Impact: Crucial for the human engineers managing your pipelines. It guarantees that a developer cannot make changes to core machine identity configurations or data-plane rules unless they have actively checked out the required permissions and left a formal audit trail.
-
Entra Entitlement Management
- Control Plane Scope: Catalogs, Access Packages, and connected organization structures.
- Non-Human Identity Impact: Standardizes how human developers request access to specific pipeline environments. It ensures that the ability to trigger, view, or manage specific automated workloads is handled through formal, auditable approval flows rather than manual backdoor assignments.
-
Access Reviews
- Control Plane Scope: Attestation schedules for automated group and role verification.
- Non-Human Identity Impact: Solves the massive problem of orphaned machine accounts. By forcing a regular review of the owners and members tied to specific service principals, it guarantees that automated accounts for old, dead projects are identified and permanently deleted.
-
Lifecycle Workflows (LCW)
- Control Plane Scope: Automated Joiner-Mover-Leaver (JML) lifecycle task sequences.
- Non-Human Identity Impact: Directly impacts the human owners tied to your machine identities. If the lead engineer who created an automation pipeline leaves the company, Lifecycle Workflows instantly disables their access, ensuring they can't maliciously trigger that pipeline on their way out the door.
-
Terms of Use (ToU)
- Control Plane Scope: Enforceable legal and compliance acceptance gates.
- Non-Human Identity Impact: Guarantees that third-party vendors or external developers cannot interact with your internal systems or trigger automated tasks until they have formally, legally acknowledged your company's security and data-handling policies.
The bridge connecting old corporate networks to the modern cloud, and the surveillance cameras that record every single authentication and configuration change.
-
Hybrid Identity Engines
- Control Plane Scope: Connect Sync, Cloud Sync, Password Hash Sync, and PTA.
- Non-Human Identity Impact: Guarantees consistency across boundaries. If your automation relies on hybrid security groups, this ensures a compromised machine account or former engineer disabled on-premises doesn't accidentally remain active and dangerous in the cloud environment.
-
Seamless Single Sign-On (SSO)
- Control Plane Scope: Kerberos-backed hybrid desktop Single Sign-On.
- Non-Human Identity Impact: While designed for humans, understanding these desktop boundaries is critical for engineers. It ensures that when developers are testing pipeline authentication scripts from their local machines, they aren't accidentally bypassing Conditional Access rules by piggybacking on cached desktop credentials.
-
Microsoft Entra Connect Health
- Control Plane Scope: Hybrid identity infrastructure monitoring agents.
- Non-Human Identity Impact: Protects hybrid automation workflows. If a machine identity relies on data synced from an on-premises system, this monitor ensures the identity bridge hasn't quietly collapsed—preventing automated pipelines from failing mysteriously because of a severed connection.
-
Monitoring & Log Analytics
- Control Plane Scope: Diagnostic streams, KQL Log Analytics workspaces, and Sentinel integration.
- Non-Human Identity Impact: This is the absolute core of the framework's diagnostic and validation phases. It provides the raw telemetry you need to write KQL queries, trace complex passwordless token handshakes, and catch "Silent 403" data-plane drops when an automated pipeline fails to access its target.
Capabilities marked as Production Spec directly instantiate the security patterns established in the AI and Cloud Pipeline Hardening Framework (ACPHF).
While this index maps the breadth of the Microsoft Entra control plane, the ACPHF repository provides the deep-dive implementation spec for zero-trust passwordless federation, data-plane isolation, and non-human identity hardening.