Identity and Access Management

Back to Home Lab Documentation Hub

Scope: user lifecycle, group-based authorization, delegated admin boundaries, and policy validation in AD.

Identity Lifecycle Process

• Provision: create user, assign baseline groups, enforce password policy.
• Modify: role transitions update group membership and access rights.
• Deprovision: disable account, remove privileged groups, archive metadata.

Access Control Model

• Group-based assignment preferred over direct user permissions.
• Privileged groups are separated from standard operational groups.
• Administrative tasks are delegated where possible for auditability.

Validation Checklist

• New user receives only expected resource access.
• Role change updates effective access within defined SLA window.
• Deprovisioned accounts cannot authenticate to domain resources.