Docs

Appearance

DDE Privileged Access Review ​

Environment: Azure DDE (tenant ff1c5d68, ciriusdde.com) Scope: Privileged roles and service principals across all DDE subscriptions Purpose: Quarterly review to detect over-provisioned admin access in a HIPAA-relevant customer-facing environment Owner: Rory (architect) — all remediation approved by Rory before merge Remediation repo: azure-dde-infra (separate Terraform PR)

Why This Review Matters ​

DDE is customer-facing Medicare billing. Any permanent admin at subscription scope in DDE represents standing privilege that HIPAA and HITRUST expect to be just-in-time or narrowly scoped. Defender for Cloud surfaces service principals with permanent admin roles at subscription scope as findings that must be remediated or justified.

Identities in Scope ​

Human Identities ​

IdentityTenantExpected RolesExpected Scope
rory@ciriusdde.comDDEGlobal Administrator (PIM-eligible)Entra ID
cirius-breakglass@ciriusdde.comDDEGlobal Administrator (permanent, unsuppressible)Entra ID

Break-glass is permanent and unsuppressible by design. Any activity triggers CRITICAL alert — never add to known-good rules (hard API block in SecOps).

Service Principals ​

Service PrincipalPurposeExpected RoleExpected Scope
github-deploy-main (DDE)Terraform deploy via OIDC federated credentialContributor + User Access Administrator (split: Contributor for resources, UAA for RBAC assignments)Per-subscription, NOT tenant root
kobe-sp (DDE)Read-only inventory for Kobe agentReader + Security ReaderPer-subscription
Any automation SPs for agentsMinimum permission per functionScoped data-plane roles (Key Vault Secrets User, Storage Blob Data Reader, etc.)Resource-scope where possible

Federated credential rule: GitHub org must be Cirius-Group-Inc (exact). OIDC breaks on any other casing.

What Over-Provisioned Access Looks Like ​

Findings to flag during the review:

  1. Owner at subscription scope held by a service principal — almost never justified. Contributor + User Access Administrator provides the same working surface with clearer intent and audit trail.
  2. Contributor at subscription scope on human accounts — should be PIM-eligible or scoped to resource groups.
  3. Permanent (non-PIM) assignments of Global Administrator, Privileged Role Administrator, User Administrator on humans — must be PIM-eligible with activation justification.
  4. Any assignment on the tenant root management group that isn't explicitly required — prefer subscription scope.
  5. Legacy or decommissioned service principals still holding active role assignments — remove the SP entirely, don't just unassign.
  6. Classic administrator assignments (Co-Administrator, Account Administrator) — must be zero across DDE subscriptions.
  7. github-deploy-main scoped to tenant root instead of individual subscriptions.
  8. Guest users with any elevated role — guests must not hold admin.

Review Process ​

Frequency: Quarterly, plus on-demand whenever Defender for Cloud surfaces a privileged-identity finding in DDE.

  1. Inventory — run the DDE lpriv audit workflow (same pattern as pim-audit.yml for PROD, ported to DDE tenant) to snapshot all subscription- and management-group- scoped role assignments and all federated credentials on service principals.
  2. Compare — diff snapshot against the expected baseline above. Anything in the snapshot that isn't in the baseline is a finding.
  3. Classify each finding:
    • Remediate — access is not justified, plan removal.
    • Justify — access is legitimate, update this baseline with date and reason.
    • Investigate — access is unexpected and the owner is unclear.
  4. File SecOps story — one story per remediation under the DDEENV project prefix, status BACKLOG until Rory reviews.
  5. Rory reviews — each remediation requires Rory's approval before any Terraform change lands.
  6. Remediate in azure-dde-infra — Terraform changes only, no portal clicks:
    • Remove the assignment via azurerm_role_assignment deletion or by narrowing the scope attribute.
    • For SPs that are fully decommissioned, delete the app registration via azuread_application resource removal.
    • For github-deploy-main over-scope, split into one assignment per subscription rather than a single tenant-root assignment.
  7. PR workflow — branch, PR, Checkov + terraform plan in CI, Rory review, merge triggers apply via OIDC. Never apply locally.
  8. Verify — re-run the audit after apply, confirm finding cleared, close the SecOps story with evidence link.

Relationship to Azure Policy ​

DDE subscriptions carry HIPAA/HITRUST and ISO 27001 policy assignments. The built-in control "A maximum of 3 owners should be designated for your subscription" is the Azure Policy backstop — this review is the deeper continuous check.

Out of Scope ​

  • PROD tenant privileged access — covered by lpriv-baseline.md.
  • AWS IAM privileged access — covered by AWS least-privilege workstream.
  • Data-plane suppression rules — covered by lpriv-secops.md.
  • security/lpriv-baseline.md — PROD tenant equivalent
  • security/lpriv-ops-automation.md — ops-automation identities
  • security/lpriv-secops.md — SecOps platform identities
  • SecOps project DDEENV — DDE HIPAA Compliance Wave epic

Internal use only — Cirius Group