Security · Zero Trust & Secure Architecture · 01
Identity and access architecture
Identity and access architecture designs how people, devices and services prove who they are and what they are allowed to do, across directories, cloud identity providers, applications and the privileged paths between them. It is needed when identity has grown by accretion, with several directories, inconsistent federation and accounts nobody owns; when a zero-trust program depends on identity as its control plane; when a merger brings a second identity estate; or when audits keep finding access that should not exist. The work produces a documented current identity architecture, a target design covering authentication, authorization, federation, lifecycle and privileged access, the policies that govern it, and a migration sequence that does not lock anyone out of the business while it is being built.
Scope
What the review covers.
- Directory and identity provider inventory, trust relationships and federation
- Authentication methods and policies by user population and risk
- Authorization model: roles, groups, entitlements and application integration
- Account lifecycle: joiner, mover, leaver and service accounts
- Privileged access paths and administrative tiering
- Target design and migration sequence
Deliverables
What you receive.
| Deliverable | Form |
|---|---|
| Current identity architecture | Diagrams, trusts, populations and known gaps |
| Target design | Authentication, authorization, federation, lifecycle and privilege |
| Policy set | Conditional access, authentication and account policies |
| Migration plan | Sequenced to avoid lockout and outage |
Prerequisites
What we need from you.
- Access to directories and identity providers, or sessions with their administrators
- The application inventory and how each authenticates
- Business constraints: legacy applications, partner access, regulated populations
Related
Where this sits.
By David Selakovic · Published 2026-10-16 · Revised 2026-10-16 · Reviewed every 180 days
Questions
Asked before engaging.
Is this a Microsoft or Okta engagement?
Neither. We design for the platforms you run. The target design is platform-specific only where it has to be.
How does this relate to privileged access management?
Privileged access is one layer of the architecture. See Privileged access management for that work on its own.
Will users notice?
Well-designed changes are introduced population by population with communication and fallback. The migration plan is built around not disrupting the business.