Vendor and Contractor Access Management

Overview

External parties (vendors, contractors, consultants) occasionally need access to Cirius Group systems. This guide covers how to provision that access, what they can and cannot reach, and how to clean it up when the engagement ends.

All external access requires Rory approval before provisioning.
All access must be time-limited — set an expiration date at provisioning.

---

Access Tiers

Tier	For	Access Level	Mechanism
Vendor Read-Only	Auditors, assessors, compliance reviewers	Read access to specific systems only	Entra Guest account + Twingate ContractorAccess
Contractor Technical	IT contractors, implementation consultants	Technical access scoped to their work	Entra Guest account + Twingate ContractorAccess + scoped Azure/GitHub access
Break-Glass Only	Vendors with support escalation needs	Break-glass accounts (not standard access)	Pre-existing vendor accounts in Keeper

Do not give contractors Domain Admin, Subscription Owner, or GitHub Owner access. Scope to the minimum needed for the engagement.

---

Provisioning Vendor Read-Only Access

Step 1 — Create Entra Guest Account

Entra ID → Users → New user → Invite external user

• Email: their corporate email address
• Invitation message: include a brief explanation of what they'll access
• Groups: do not add to any groups yet

The guest receives an email invitation. They accept it with their own Microsoft account or corporate Entra account.

Step 2 — Add to Twingate ContractorAccess Group

Once the guest accepts the invite and has an Entra object:

$groupId = (Get-MgGroup -Filter "displayName eq 'ContractorAccess'").Id
$userId = (Get-MgUser -Filter "userPrincipalName eq 'vendor@theirdomain.com'").Id
New-MgGroupMember -GroupId $groupId -DirectoryObjectId $userId

This gives them Twingate access to the resources mapped to the ContractorAccess group. Verify what those resources are in the Twingate admin console before adding someone — ContractorAccess should expose only what contractors need, not everything AllStaff sees.

Step 3 — Scope Additional Access (If Needed)

If the vendor needs access beyond what ContractorAccess provides:

Azure (read-only):

az role assignment create \
  --assignee "vendor@theirdomain.com" \
  --role "Reader" \
  --scope /subscriptions/<specific-subscription-id>

GitHub (read-only):

gh api --method PUT /orgs/Cirius-Group-Inc/teams/<team>/memberships/<github-username> \
  --field role=member

Scope access to the specific subscription or repository needed — not the whole org or all subscriptions.

Step 4 — Document the Access

Add to the Access Register (see below):

• Vendor/contractor name and company
• What systems they can access
• Engagement purpose
• Start and end date
• Rory approval date

---

Contractor Technical Access

Technical contractors (implementation work, infrastructure projects) may need more than read-only. Common additions:

Need	Access Granted	Notes
Azure resource management	Contributor on specific resource group	Not the full subscription
GitHub commits	Developer role on specific repos	Not Owner, not admin
Keeper access	Specific records shared individually	Not full shared folder access
Database access	Read-only on specific PostgreSQL schema	Via Twingate + service account
Terraform state	Reader on state storage account	For reviewing infra, not applying

Never grant:

• GitHub Owner rights
• Azure Subscription Owner or User Access Administrator
• Access to break-glass credentials
• Keeper shared folder with break-glass accounts

---

Access Duration and Expiration

All external access must have an expiration date. Set it at provisioning time.

Entra Guest Access Expiration:

# Set the guest account to expire
Update-MgUser -UserId "vendor@theirdomain.com" -AccountEnabled $true
# Note: Entra guest expiration uses Access Reviews, not per-account expiry

Create an Access Review for guest accounts: Entra ID → Identity Governance → Access Reviews → New review

• Scope: Guest users
• Frequency: One-time (or monthly for ongoing contractors)
• Duration: set to match the engagement end date
• Reviewers: Rory

Access Reviews prompt you to confirm or revoke access at the review date. For short engagements (< 30 days), set a calendar reminder to manually revoke.

Azure Role Expiration:

# Set a role assignment with expiration via PIM-eligible assignment
# Or use a calendar reminder and remove manually

GitHub Access:

GitHub doesn't support native expiration. Use a calendar reminder to remove membership at engagement end.

---

Access Register

Track all active external access. Update this when adding or removing access.

Vendor / Contractor	Company	Systems	Start Date	End Date	Approved By	Status
(add when provisioned)					Rory	Active

Store the access register in Keeper → IT Operations → External Access Register or in a SharePoint compliance folder accessible to Rory.

Review the register monthly — any access past its end date should be revoked immediately regardless of whether the engagement formally closed.

---

Offboarding an External Party

When the engagement ends (or early if the relationship sours):

1 — Revoke Entra Guest Account

# Block sign-in immediately
Update-MgUser -UserId "vendor@theirdomain.com" -AccountEnabled $false

# Revoke active sessions
Invoke-MgInvalidateAllRefreshToken -UserId "vendor@theirdomain.com"

Or portal: Entra ID → Users → [guest] → Block sign-in → Revoke sessions

After 30 days (or immediately for adversarial departures): delete the guest account.

2 — Remove from Twingate

Removing the user from the ContractorAccess Entra group removes their Twingate access automatically. Verify in Twingate admin console that the user is no longer listed.

3 — Remove Azure Role Assignments

az role assignment list --assignee "vendor@theirdomain.com" --output table
# Remove each one:
az role assignment delete --assignee "vendor@theirdomain.com" --role "<role>" --scope "<scope>"

4 — Remove GitHub Access

gh api --method DELETE /orgs/Cirius-Group-Inc/members/<github-username>

Or portal: GitHub → Cirius-Group-Inc → People → [user] → Remove

5 — Rotate Any Shared Credentials

If the contractor had access to shared credentials (shared Keeper records, shared service account passwords), rotate them:

• Update the Keeper record with a new password
• Update any systems using that credential
• Log the rotation in the Key Rotation Schedule

6 — Update the Access Register

Mark the entry as Revoked with the revocation date.

---

BAA Requirement

Any vendor who may have access to Protected Health Information (PHI) must sign a Business Associate Agreement (BAA) before access is granted.

Adriana manages BAAs. Confirm a BAA is in place before provisioning access for:

• Any vendor who will access patient-related data
• Any vendor with broad read access to production systems (where PHI might be present)
• Any cloud service vendor (AWS, Azure, etc.) — standard BAAs already in place for these

BAAs are tracked in: SharePoint → Compliance → Vendor BAAs (Adriana manages this).

---

Related Documents

• Entra Identity Operations — creating and managing Entra accounts
• Twingate Operations — Twingate group management and connector details
• Employee Offboarding — full offboarding checklist (employees vs contractors)
• Keeper Credential Guide — shared credential structure
• Key Rotation Schedule — credential rotation after vendor departure

---

Document History

Date	Change	Author
May 2026	Initial draft — access tiers, guest account provisioning, Twingate ContractorAccess, access duration/expiration, access register, offboarding checklist, BAA requirement.	Rory