Access Management in Azure: Design and Implementation
| Informer | Sumeet Shekhar User e8ff2 |
|---|---|
| Contributors | User 9d8f0 Naveen Varma Roda |
| Senior Arch / Reviewer / Approver | Rahul Singh Ramesh Varma Kutcherlapati |
| QA | Sudhir Kumar Kunchakuri User 4e2ec |
| DevOps | User 7f21c |
| Objective | Comprehensive overview of access management within Azure, detailing the design principles, best practices, and implementation strategies. It will feature design diagrams that illustrate various access management models, including role-based access control (RBAC), identity management, and security best practices. The content will serve as a guide for architects and administrators to effectively manage user permissions, enhance security, and ensure compliance within Azure environments. |
| Github links | https://github.com/Maersk-Global/ops%5Ffacility%5Fui |
| Reference links |
High Level Architecture Diagram
For your reference, I have provided the design layer necessary for the high-level architecture diagram. Please use this information to develop the design.
Vue.Js layer
Application layer
Business layer
Database layer
High-Level User Schema
To design a comprehensive schema that effectively maps user roles and permissions
After phase 2 deployment (11th Dec 2024) all Maersk users will have read access to the facility portal by default.
Core roles, Azure groups, and their descriptions
| Role | Azure Group | Description |
|---|---|---|
| ops_facility_readonly | OPS MDM Facility Read | Facility Read Access role |
| ops_facility_admin | OPS MDM Facility Admin | Ops, LnS, and Comm Records Editor role |
| ops_facility_bbu | OPS MDM Facility BBU | Facility Bulk Upload role |
Users must have the ops_facility_admin role to edit and create LnS records.
LnS Facility-Specific Roles
Naming conventions behind roles.
Regional Approvers and Requestors
lns-regional-{ User Type }-{ Region Name }-{ Facility Type }
- User Type: Can be either “requestor“ or “approver“.
- Region Name: Region name of the facility.
- Facilities are located in countries, countries are grouped based on the regions, to get the country-region mapping GEO v1 API “/country-bda” end-point can be used.
- E.g. India country is present in the IMEA region.
- Facility Type: Facility Type of the facility. (Reference data present in our Facility Master Data) or it can be “ALL”
- If the value of Facility Type is “ALL“, then it specifies that the role applies to all the Facility types present in the system.
Facility Approvers and Requestors
lns-facility-{ User Type }-ALL-{ Facility Type }
- User Type: Can be either “requestor“ or “approver“.
- ALL: “ALL” specifies that the role applies to all the regions present in Geo master data.
- Facility Type: Facility Type of the facility. (Reference data present in our Facility Master Data)
Global Approvers and Requestors
lns-global-{ User Type }-ALL-ALL
- User Type: Can be either “requestor“ or “approver“.
- This role is for the global approver or global requestor. Which covers all the regions and all the facility types.
List of Data Steward and Approver Rolers
| Role | Azure Group | Description |
|---|---|---|
| lns-facility-data-steward | OPS MDM Facility LnS Data Steward | LnS Facility Data Steward role |
| lns-regional-approver-IMEA-AIR | OPS MDM Facility LnS Approver IMEA Air | LnS Regional Data Approver role for IMEA Air |
| lns-regional-approver-IMEA-COLD_STORE | OPS MDM Facility LnS Approver IMEA Cold Storage | LnS Regional Data Approver role for IMEA Cold Storage |
| lns-regional-approver-IMEA-DEP | OPS MDM Facility LnS Approver IMEA Depot | LnS Regional Data Approver role for IMEA Depot |
| lns-regional-approver-IMEA-TRANSPORTATION | OPS MDM Facility LnS Approver IMEA Transportation | LnS Regional Data Approver role for IMEA Transportation |
| lns-regional-approver-IMEA-WAREHOUSE | OPS MDM Facility LnS Approver IMEA Warehouse | LnS Regional Data Approver role for IMEA Warehouse |
| lns-regional-approver-IMEA-ALL | OPS MDM Facility LnS Approver IMEA All | LnS Regional Data Approver role for IMEA ALL |
| lns-regional-approver-NAM-AIR | OPS MDM Facility LnS Approver NAM Air | LnS Regional Data Approver role for NAM Air |
| lns-regional-approver-NAM-COLD_STORE | OPS MDM Facility LnS Approver NAM Cold Storage | LnS Regional Data Approver role for NAM Cold Storage |
| lns-regional-approver-NAM-DEP | OPS MDM Facility LnS Approver NAM Depot | LnS Regional Data Approver role for NAM Depot |
| lns-regional-approver-NAM-TRANSPORTATION | OPS MDM Facility LnS Approver NAM Transportation | LnS Regional Data Approver role for NAM Transportation |
| lns-regional-approver-NAM-WAREHOUSE | OPS MDM Facility LnS Approver NAM Warehouse | LnS Regional Data Approver role for NAM Warehouse |
| lns-regional-approver-NAM-ALL | OPS MDM Facility LnS Approver NAM All | LnS Regional Data Approver role for NAM ALL |
| lns-regional-approver-APA-AIR | OPS MDM Facility LnS Approver APA Air | LnS Regional Data Approver role for APA Air |
| lns-regional-approver-APA-COLD_STORE | OPS MDM Facility LnS Approver APA Cold Storage | LnS Regional Data Approver role for APA Cold Storage |
| lns-regional-approver-APA-DEP | OPS MDM Facility LnS Approver APA Depot | LnS Regional Data Approver role for APA Depot |
| lns-regional-approver-APA-TRANSPORTATION | OPS MDM Facility LnS Approver APA Transportation | LnS Regional Data Approver role for APA Transportation |
| lns-regional-approver-APA-WAREHOUSE | OPS MDM Facility LnS Approver APA Warehouse | LnS Regional Data Approver role for APA Warehouse |
| lns-regional-approver-APA-ALL | OPS MDM Facility LnS Approver APA All | LnS Regional Data Approver role for APA ALL |
| lns-regional-approver-LAM-AIR | OPS MDM Facility LnS Approver LAM Air | LnS Regional Data Approver role for LAM Air |
| lns-regional-approver-LAM-COLD_STORE | OPS MDM Facility LnS Approver Cold Storage | LnS Regional Data Approver role for LAM Cold Storage |
| lns-regional-approver-LAM-DEP | OPS MDM Facility LnS Approver LAM Depot | LnS Regional Data Approver role for LAM Depot |
| lns-regional-approver-LAM-TRANSPORTATION | OPS MDM Facility LnS Approver LAM Transportation | LnS Regional Data Approver role for LAM Transportation |
| lns-regional-approver-LAM-WAREHOUSE | OPS MDM Facility LnS Approver LAM Warehouse | LnS Regional Data Approver role for LAM Warehouse |
| lns-regional-approver-LAM-ALL | OPS MDM Facility LnS Approver LAM All | LnS Regional Data Approver role for LAM ALL |
| lns-regional-approver-EUR-AIR | OPS MDM Facility LnS Approver EUR Air | LnS Regional Data Approver role for EUR Air |
| lns-regional-approver-EUR-COLD_STORE | OPS MDM Facility LnS Approver EUR Cold Storage | LnS Regional Data Approver role for EUR Cold Storage |
| lns-regional-approver-EUR-DEP | OPS MDM Facility LnS Approver EUR Depot | LnS Regional Data Approver role for EUR Depot |
| lns-regional-approver-EUR-TRANSPORTATION | OPS MDM Facility LnS Approver EUR Transportation | LnS Regional Data Approver role for EUR Transportation |
| lns-regional-approver-EUR-WAREHOUSE | OPS MDM Facility LnS Approver EUR Warehouse | LnS Regional Data Approver role for EUR Warehouse |
| lns-regional-approver-EUR-ALL | OPS MDM Facility LnS Approver EUR All | LnS Regional Data Approver role for EUR ALL |
| lns-global-approver-ALL-ALL | OPS MDM Facility LnS Global Approver All All | LnS Global Data Approver role |
| lns-facility-approver-ALL-AIR | OPS MDM Facility LnS Approver All Air | LnS Facility Data Approver role for ALL Air |
| lns-facility-approver-ALL-COLD_STORE | OPS MDM Facility LnS Approver All Cold Storage | LnS Facility Data Approver role for ALL Cold Storage |
| lns-facility-approver-ALL-DEP | OPS MDM Facility LnS Approver All Depot | LnS Facility Data Approver role for ALL Depot |
| lns-facility-approver-ALL-TRANSPORTATION | OPS MDM Facility LnS Approver All Transportation | LnS Facility Data Approver role for ALL Transportation |
| lns-facility-approver-ALL-WAREHOUSE | OPS MDM Facility LnS Approver All Warehouse | LnS Facility Data Approver role for ALL Warehouse |
List of Data Requestor Roles
| Role | Azure Group | Description |
|---|---|---|
| lns-regional-requestor-IMEA-AIR | OPS MDM Facility LnS Requestor IMEA Air | LnS Regional Data Requestor role for IMEA Air |
| lns-regional-requestor-IMEA-COLD_STORE | OPS MDM Facility LnS Requestor IMEA Cold Storage | LnS Regional Data Requestor role for IMEA Cold Storage |
| lns-regional-requestor-IMEA-DEP | OPS MDM Facility LnS Requestor IMEA Depot | LnS Regional Data Requestor role for IMEA Depot |
| lns-regional-requestor-IMEA-TRANSPORTATION | OPS MDM Facility LnS Requestor IMEA Transportation | LnS Regional Data Requestor role for IMEA Transportation |
| lns-regional-requestor-IMEA-WAREHOUSE | OPS MDM Facility LnS Requestor IMEA Warehouse | LnS Regional Data Requestor role for IMEA Warehouse |
| lns-regional-requestor-IMEA-ALL | OPS MDM Facility LnS Requestor IMEA All | LnS Regional Data Requestor role for IMEA ALL |
| lns-regional-requestor-NAM-AIR | OPS MDM Facility LnS Requestor NAM Air | LnS Regional Data Requestor role for NAM Air |
| lns-regional-requestor-NAM-COLD_STORE | OPS MDM Facility LnS Requestor NAM Cold Storage | LnS Regional Data Requestor role for NAM Cold Storage |
| lns-regional-requestor-NAM-DEP | OPS MDM Facility LnS Requestor NAM Depot | LnS Regional Data Requestor role for NAM Depot |
| lns-regional-requestor-NAM-TRANSPORTATION | OPS MDM Facility LnS Requestor NAM Transportation | LnS Regional Data Requestor role for NAM Transportation |
| lns-regional-requestor-NAM-WAREHOUSE | OPS MDM Facility LnS Requestor NAM Warehouse | LnS Regional Data Requestor role for NAM Warehouse |
| lns-regional-requestor-NAM-ALL | OPS MDM Facility LnS Requestor NAM All | LnS Regional Data Requestor role for NAM ALL |
| lns-regional-requestor-APA-AIR | OPS MDM Facility LnS Requestor APA Air | LnS Regional Data Requestor role for APA Air |
| lns-regional-requestor-APA-COLD_STORE | OPS MDM Facility LnS Requestor APA Cold Storage | LnS Regional Data Requestor role for APA Cold Storage |
| lns-regional-requestor-APA-DEP | OPS MDM Facility LnS Requestor APA Depot | lns-regional-requestor-APA-DEP |
| lns-regional-requestor-APA-TRANSPORTATION | OPS MDM Facility LnS Requestor APA Transportation | lns-regional-requestor-APA-TRANSPORTATION |
| lns-regional-requestor-APA-WAREHOUSE | OPS MDM Facility LnS Requestor APA Warehouse | lns-regional-requestor-APA-WAREHOUSE |
| lns-regional-requestor-APA-ALL | OPS MDM Facility LnS Requestor APA All | lns-regional-requestor-APA-ALL |
| lns-regional-requestor-LAM-AIR | OPS MDM Facility LnS Requestor LAM Air | LnS Regional Data Requestor role for LAM Air |
| lns-regional-requestor-LAM-COLD_STORE | OPS MDM Facility LnS Requestor LAM Cold Storage | LnS Regional Data Requestor role for LAM Cold Storage |
| lns-regional-requestor-LAM-DEP | OPS MDM Facility LnS Requestor LAM Depot | LnS Regional Data Requestor role for LAM Depot |
| lns-regional-requestor-LAM-TRANSPORTATION | OPS MDM Facility LnS Requestor LAM Transportation | LnS Regional Data Requestor role for LAM Transportation |
| lns-regional-requestor-LAM-WAREHOUSE | OPS MDM Facility LnS Requestor LAM Warehouse | LnS Regional Data Requestor role for LAM Warehouse |
| lns-regional-requestor-LAM-ALL | OPS MDM Facility LnS Requestor LAM All | LnS Regional Data Requestor role for LAM ALL |
| lns-regional-requestor-EUR-AIR | OPS MDM Facility LnS Requestor EUR Air | LnS Regional Data Requestor role for EUR Air |
| lns-regional-requestor-EUR-COLD_STORE | OPS MDM Facility LnS Requestor EUR Cold Storage | LnS Regional Data Requestor role for EUR Cold Storage |
| lns-regional-requestor-EUR-DEP | OPS MDM Facility LnS Requestor EUR Depot | LnS Regional Data Requestor role for EUR Depot |
| lns-regional-requestor-EUR-TRANSPORTATION | OPS MDM Facility LnS Requestor EUR Transportation | LnS Regional Data Requestor role for EUR Transportation |
| lns-regional-requestor-EUR-WAREHOUSE | OPS MDM Facility LnS Requestor EUR Warehouse | LnS Regional Data Requestor role for EUR Warehouse |
| lns-regional-requestor-EUR-ALL | OPS MDM Facility LnS Requestor EUR All | LnS Regional Data Requestor role for EUR ALL |
| lns-global-requestor-ALL-ALL | OPS MDM Facility LnS Global Requestor ALL All | LnS Global Data Requestor role |
| lns-facility-requestor-ALL-AIR | OPS MDM Facility LnS Requestor All Air | LnS Facility Data Requestor role for ALL Air |
| lns-facility-requestor-ALL-COLD_STORE | OPS MDM Facility LnS Requestor All Cold Storage | LnS Facility Data Requestor role for ALL Cold Storage |
| lns-facility-requestor-ALL-DEP | OPS MDM Facility LnS Requestor All Depot | LnS Facility Data Requestor role for ALL Depot |
| lns-facility-requestor-ALL-TRANSPORTATION | OPS MDM Facility LnS Requestor All Transportation | LnS Facility Data Requestor role for ALL Transportation |
| lns-facility-requestor-ALL-WAREHOUSE | OPS MDM Facility LnS Requestor All Warehouse | LnS Facility Data Requestor role for ALL Warehouse |
Was this page helpful?