EXECUTIVE BRIEF
Identity risk is a business-control problem, not just an account problem.
The scenario begins with a fictional bank facing excessive privilege, weak authentication, stale access, unmanaged guests, direct role assignments, credential risk, poor logging and absent ownership. The objective is to consolidate evidence, determine which weaknesses create the greatest exposure and propose a practical target state.
CURRENT-STATE ASSESSMENT
Start with what exists, who owns it and what cannot yet be proven.
The repository contains a risk-led assessment model covering identity inventory, authentication, privileged access, guest identities, workload identities, ownership, reviews and evidence gaps.
Users, privileged roles, guests, groups, service principals and workload identities.
MFA coverage, Conditional Access, exceptions and risky authentication paths.
Standing privilege, direct assignments, role scope and just-in-time opportunities.
Access lifecycle, attestations, guest reviews, logging and evidence accountability.
EVIDENCE AUTOMATION
Collect governance evidence without silently changing the tenant.
Six read-oriented PowerShell collectors support identity inventory, stale-user analysis, guest review, directory-role assignments, direct Azure RBAC assignment detection and workload-identity review.
- Export-IdentityInventory.ps1: builds a governance-ready Entra user inventory.
- Find-StaleUsers.ps1: identifies enabled identities requiring lifecycle review.
- Export-GuestUsers.ps1: supports external identity ownership and activity review.
- Export-DirectoryRoleAssignments.ps1: inventories privileged Entra role access.
- Find-DirectAzureRoleAssignments.ps1: finds human assignments outside governed group patterns.
- Export-WorkloadIdentities.ps1: supports service principal and managed identity governance.
GitHub Actions enforces the fictional-project disclosure, rejects sensitive export files and common tenant-mutating cmdlets, validates PowerShell syntax and runs PSScriptAnalyzer.
TARGET DESIGN
Move from permanent access to governed, contextual access.
The target state uses group-based RBAC, stronger authentication, Conditional Access, Privileged Identity Management, recurring access reviews, governed workload identities and clear evidence ownership.
Reduce direct role assignment and make entitlement management more reviewable.
Protect sign-ins with policy based on user, application, authentication strength and risk.
Replace unnecessary standing administrative access with eligible, time-bound activation.
Require accountable owners to confirm whether access remains justified.
VALIDATION PROGRAMME
Move from documented governance to controlled tenant evidence.
The open validation backlog covers inventory reconciliation, stale access, direct Azure RBAC remediation, Conditional Access, PIM activation, access reviews, guest governance and workload identity review. The repository records these controls as implemented or documented until tenant evidence proves the expected behaviour.
ETHICAL PORTFOLIO PRESENTATION
Demonstrate capability without inventing employment history.
Every artefact and interview explanation connected to this project should retain the fictional-project disclosure. The value is in showing how the assessment was structured, which automation was produced, how risks were prioritised and how controls will be validated.