Skip to main content

Access Management in Azure: Design and Implementation

InformerSumeet Shekhar User e8ff2
ContributorsUser 9d8f0 Naveen Varma Roda
Senior Arch / Reviewer / ApproverRahul Singh Ramesh Varma Kutcherlapati
QASudhir Kumar Kunchakuri User 4e2ec
DevOpsUser 7f21c
ObjectiveComprehensive overview of access management within Azure, detailing the design principles, best practices, and implementation strategies. It will feature design diagrams that illustrate various access management models, including role-based access control (RBAC), identity management, and security best practices. The content will serve as a guide for architects and administrators to effectively manage user permissions, enhance security, and ensure compliance within Azure environments.
Github linkshttps://github.com/Maersk-Global/ops%5Ffacility%5Fui
Reference links

High Level Architecture Diagram

For your reference, I have provided the design layer necessary for the high-level architecture diagram. Please use this information to develop the design.

Vue.Js layer

Application layer

Business layer

Database layer

High-Level User Schema

To design a comprehensive schema that effectively maps user roles and permissions

After phase 2 deployment (11th Dec 2024) all Maersk users will have read access to the facility portal by default.

Core roles, Azure groups, and their descriptions

RoleAzure GroupDescription
ops_facility_readonlyOPS MDM Facility ReadFacility Read Access role
ops_facility_adminOPS MDM Facility AdminOps, LnS, and Comm Records Editor role
ops_facility_bbuOPS MDM Facility BBUFacility Bulk Upload role

Users must have the ops_facility_admin role to edit and create LnS records.

LnS Facility-Specific Roles

Naming conventions behind roles.

Regional Approvers and Requestors

lns-regional-{ User Type }-{ Region Name }-{ Facility Type }

  1. User Type: Can be either “requestor“ or “approver“.
  2. Region Name: Region name of the facility.
    • Facilities are located in countries, countries are grouped based on the regions, to get the country-region mapping GEO v1 API “/country-bda” end-point can be used.
    • E.g. India country is present in the IMEA region.
  3. Facility Type: Facility Type of the facility. (Reference data present in our Facility Master Data) or it can be “ALL”
    • If the value of Facility Type is “ALL“, then it specifies that the role applies to all the Facility types present in the system.

Facility Approvers and Requestors

lns-facility-{ User Type }-ALL-{ Facility Type }

  1. User Type: Can be either “requestor“ or “approver“.
  2. ALL: “ALL” specifies that the role applies to all the regions present in Geo master data.
  3. Facility Type: Facility Type of the facility. (Reference data present in our Facility Master Data)

Global Approvers and Requestors

lns-global-{ User Type }-ALL-ALL

  1. User Type: Can be either “requestor“ or “approver“.
  2. This role is for the global approver or global requestor. Which covers all the regions and all the facility types.

List of Data Steward and Approver Rolers

RoleAzure GroupDescription
lns-facility-data-stewardOPS MDM Facility LnS Data StewardLnS Facility Data Steward role
lns-regional-approver-IMEA-AIROPS MDM Facility LnS Approver IMEA AirLnS Regional Data Approver role for IMEA Air
lns-regional-approver-IMEA-COLD_STOREOPS MDM Facility LnS Approver IMEA Cold StorageLnS Regional Data Approver role for IMEA Cold Storage
lns-regional-approver-IMEA-DEPOPS MDM Facility LnS Approver IMEA DepotLnS Regional Data Approver role for IMEA Depot
lns-regional-approver-IMEA-TRANSPORTATIONOPS MDM Facility LnS Approver IMEA TransportationLnS Regional Data Approver role for IMEA Transportation
lns-regional-approver-IMEA-WAREHOUSEOPS MDM Facility LnS Approver IMEA WarehouseLnS Regional Data Approver role for IMEA Warehouse
lns-regional-approver-IMEA-ALLOPS MDM Facility LnS Approver IMEA AllLnS Regional Data Approver role for IMEA ALL
lns-regional-approver-NAM-AIROPS MDM Facility LnS Approver NAM AirLnS Regional Data Approver role for NAM Air
lns-regional-approver-NAM-COLD_STOREOPS MDM Facility LnS Approver NAM Cold StorageLnS Regional Data Approver role for NAM Cold Storage
lns-regional-approver-NAM-DEPOPS MDM Facility LnS Approver NAM DepotLnS Regional Data Approver role for NAM Depot
lns-regional-approver-NAM-TRANSPORTATIONOPS MDM Facility LnS Approver NAM TransportationLnS Regional Data Approver role for NAM Transportation
lns-regional-approver-NAM-WAREHOUSEOPS MDM Facility LnS Approver NAM WarehouseLnS Regional Data Approver role for NAM Warehouse
lns-regional-approver-NAM-ALLOPS MDM Facility LnS Approver NAM AllLnS Regional Data Approver role for NAM ALL
lns-regional-approver-APA-AIROPS MDM Facility LnS Approver APA AirLnS Regional Data Approver role for APA Air
lns-regional-approver-APA-COLD_STOREOPS MDM Facility LnS Approver APA Cold StorageLnS Regional Data Approver role for APA Cold Storage
lns-regional-approver-APA-DEPOPS MDM Facility LnS Approver APA DepotLnS Regional Data Approver role for APA Depot
lns-regional-approver-APA-TRANSPORTATIONOPS MDM Facility LnS Approver APA TransportationLnS Regional Data Approver role for APA Transportation
lns-regional-approver-APA-WAREHOUSEOPS MDM Facility LnS Approver APA WarehouseLnS Regional Data Approver role for APA Warehouse
lns-regional-approver-APA-ALLOPS MDM Facility LnS Approver APA AllLnS Regional Data Approver role for APA ALL
lns-regional-approver-LAM-AIROPS MDM Facility LnS Approver LAM AirLnS Regional Data Approver role for LAM Air
lns-regional-approver-LAM-COLD_STOREOPS MDM Facility LnS Approver Cold StorageLnS Regional Data Approver role for LAM Cold Storage
lns-regional-approver-LAM-DEPOPS MDM Facility LnS Approver LAM DepotLnS Regional Data Approver role for LAM Depot
lns-regional-approver-LAM-TRANSPORTATIONOPS MDM Facility LnS Approver LAM TransportationLnS Regional Data Approver role for LAM Transportation
lns-regional-approver-LAM-WAREHOUSEOPS MDM Facility LnS Approver LAM WarehouseLnS Regional Data Approver role for LAM Warehouse
lns-regional-approver-LAM-ALLOPS MDM Facility LnS Approver LAM AllLnS Regional Data Approver role for LAM ALL
lns-regional-approver-EUR-AIROPS MDM Facility LnS Approver EUR AirLnS Regional Data Approver role for EUR Air
lns-regional-approver-EUR-COLD_STOREOPS MDM Facility LnS Approver EUR Cold StorageLnS Regional Data Approver role for EUR Cold Storage
lns-regional-approver-EUR-DEPOPS MDM Facility LnS Approver EUR DepotLnS Regional Data Approver role for EUR Depot
lns-regional-approver-EUR-TRANSPORTATIONOPS MDM Facility LnS Approver EUR TransportationLnS Regional Data Approver role for EUR Transportation
lns-regional-approver-EUR-WAREHOUSEOPS MDM Facility LnS Approver EUR WarehouseLnS Regional Data Approver role for EUR Warehouse
lns-regional-approver-EUR-ALLOPS MDM Facility LnS Approver EUR AllLnS Regional Data Approver role for EUR ALL
lns-global-approver-ALL-ALLOPS MDM Facility LnS Global Approver All AllLnS Global Data Approver role
lns-facility-approver-ALL-AIROPS MDM Facility LnS Approver All AirLnS Facility Data Approver role for ALL Air
lns-facility-approver-ALL-COLD_STOREOPS MDM Facility LnS Approver All Cold StorageLnS Facility Data Approver role for ALL Cold Storage
lns-facility-approver-ALL-DEPOPS MDM Facility LnS Approver All DepotLnS Facility Data Approver role for ALL Depot
lns-facility-approver-ALL-TRANSPORTATIONOPS MDM Facility LnS Approver All TransportationLnS Facility Data Approver role for ALL Transportation
lns-facility-approver-ALL-WAREHOUSEOPS MDM Facility LnS Approver All WarehouseLnS Facility Data Approver role for ALL Warehouse

List of Data Requestor Roles

RoleAzure GroupDescription
lns-regional-requestor-IMEA-AIROPS MDM Facility LnS Requestor IMEA AirLnS Regional Data Requestor role for IMEA Air
lns-regional-requestor-IMEA-COLD_STOREOPS MDM Facility LnS Requestor IMEA Cold StorageLnS Regional Data Requestor role for IMEA Cold Storage
lns-regional-requestor-IMEA-DEPOPS MDM Facility LnS Requestor IMEA DepotLnS Regional Data Requestor role for IMEA Depot
lns-regional-requestor-IMEA-TRANSPORTATIONOPS MDM Facility LnS Requestor IMEA TransportationLnS Regional Data Requestor role for IMEA Transportation
lns-regional-requestor-IMEA-WAREHOUSEOPS MDM Facility LnS Requestor IMEA WarehouseLnS Regional Data Requestor role for IMEA Warehouse
lns-regional-requestor-IMEA-ALLOPS MDM Facility LnS Requestor IMEA AllLnS Regional Data Requestor role for IMEA ALL
lns-regional-requestor-NAM-AIROPS MDM Facility LnS Requestor NAM AirLnS Regional Data Requestor role for NAM Air
lns-regional-requestor-NAM-COLD_STOREOPS MDM Facility LnS Requestor NAM Cold StorageLnS Regional Data Requestor role for NAM Cold Storage
lns-regional-requestor-NAM-DEPOPS MDM Facility LnS Requestor NAM DepotLnS Regional Data Requestor role for NAM Depot
lns-regional-requestor-NAM-TRANSPORTATIONOPS MDM Facility LnS Requestor NAM TransportationLnS Regional Data Requestor role for NAM Transportation
lns-regional-requestor-NAM-WAREHOUSEOPS MDM Facility LnS Requestor NAM WarehouseLnS Regional Data Requestor role for NAM Warehouse
lns-regional-requestor-NAM-ALLOPS MDM Facility LnS Requestor NAM AllLnS Regional Data Requestor role for NAM ALL
lns-regional-requestor-APA-AIROPS MDM Facility LnS Requestor APA AirLnS Regional Data Requestor role for APA Air
lns-regional-requestor-APA-COLD_STOREOPS MDM Facility LnS Requestor APA Cold StorageLnS Regional Data Requestor role for APA Cold Storage
lns-regional-requestor-APA-DEPOPS MDM Facility LnS Requestor APA Depotlns-regional-requestor-APA-DEP
lns-regional-requestor-APA-TRANSPORTATIONOPS MDM Facility LnS Requestor APA Transportationlns-regional-requestor-APA-TRANSPORTATION
lns-regional-requestor-APA-WAREHOUSEOPS MDM Facility LnS Requestor APA Warehouselns-regional-requestor-APA-WAREHOUSE
lns-regional-requestor-APA-ALLOPS MDM Facility LnS Requestor APA Alllns-regional-requestor-APA-ALL
lns-regional-requestor-LAM-AIROPS MDM Facility LnS Requestor LAM AirLnS Regional Data Requestor role for LAM Air
lns-regional-requestor-LAM-COLD_STOREOPS MDM Facility LnS Requestor LAM Cold StorageLnS Regional Data Requestor role for LAM Cold Storage
lns-regional-requestor-LAM-DEPOPS MDM Facility LnS Requestor LAM DepotLnS Regional Data Requestor role for LAM Depot
lns-regional-requestor-LAM-TRANSPORTATIONOPS MDM Facility LnS Requestor LAM TransportationLnS Regional Data Requestor role for LAM Transportation
lns-regional-requestor-LAM-WAREHOUSEOPS MDM Facility LnS Requestor LAM WarehouseLnS Regional Data Requestor role for LAM Warehouse
lns-regional-requestor-LAM-ALLOPS MDM Facility LnS Requestor LAM AllLnS Regional Data Requestor role for LAM ALL
lns-regional-requestor-EUR-AIROPS MDM Facility LnS Requestor EUR AirLnS Regional Data Requestor role for EUR Air
lns-regional-requestor-EUR-COLD_STOREOPS MDM Facility LnS Requestor EUR Cold StorageLnS Regional Data Requestor role for EUR Cold Storage
lns-regional-requestor-EUR-DEPOPS MDM Facility LnS Requestor EUR DepotLnS Regional Data Requestor role for EUR Depot
lns-regional-requestor-EUR-TRANSPORTATIONOPS MDM Facility LnS Requestor EUR TransportationLnS Regional Data Requestor role for EUR Transportation
lns-regional-requestor-EUR-WAREHOUSEOPS MDM Facility LnS Requestor EUR WarehouseLnS Regional Data Requestor role for EUR Warehouse
lns-regional-requestor-EUR-ALLOPS MDM Facility LnS Requestor EUR AllLnS Regional Data Requestor role for EUR ALL
lns-global-requestor-ALL-ALLOPS MDM Facility LnS Global Requestor ALL AllLnS Global Data Requestor role
lns-facility-requestor-ALL-AIROPS MDM Facility LnS Requestor All AirLnS Facility Data Requestor role for ALL Air
lns-facility-requestor-ALL-COLD_STOREOPS MDM Facility LnS Requestor All Cold StorageLnS Facility Data Requestor role for ALL Cold Storage
lns-facility-requestor-ALL-DEPOPS MDM Facility LnS Requestor All DepotLnS Facility Data Requestor role for ALL Depot
lns-facility-requestor-ALL-TRANSPORTATIONOPS MDM Facility LnS Requestor All TransportationLnS Facility Data Requestor role for ALL Transportation
lns-facility-requestor-ALL-WAREHOUSEOPS MDM Facility LnS Requestor All WarehouseLnS Facility Data Requestor role for ALL Warehouse
Was this page helpful?