mirror of
https://github.com/SHOGGOTH-SECTOR/sica-fondt.git
synced 2026-08-01 16:40:24 +00:00
24f816b6a3
Place useful parts of the surrounding repos into sica-fondt by layer, per the
body model (Ada = membrane; brain/endocrine/capabilities/knowledge non-Ada):
- brain/ LLM reasoning + providers (dapr, hermes, MoMoA)
- capabilities/ REPRAG sidecars: hermes tools/skills, dapr tools, parallel
dispatch, A51 channels, and the OSINT cluster
- knowledge/ LORAG corpus: 754 cyber-skills, agency personas, secure-coding,
MITRE ATT&CK data
- reference/ defensive threat-reference (C3, shhbruh doc) + AdaYaml parser
License handling: AGPL sources (worldosint, advanced_evolution, mercury,
Reticulum) and GPL DeTTECT are SPEC-only clean-room/port descriptions — no
copyleft code copied. MIT/Apache/data parts copied as working trees.
Safety: shhbruh escape/persistence material and C3 covert-C2 kept as reference
only, not wired into the running organism. See CONSOLIDATION.md.
https://claude.ai/code/session_01UehUqEXXJJCsHoA4voCU5c
108 lines
3.8 KiB
Markdown
108 lines
3.8 KiB
Markdown
# Azure AD PIM - Workflows
|
|
|
|
## PIM Deployment Workflow
|
|
|
|
```
|
|
Phase 1: DISCOVERY
|
|
├── Export all permanent role assignments via Microsoft Graph
|
|
├── Identify users with multiple admin roles
|
|
├── Flag accounts without MFA enabled
|
|
└── Document break-glass account strategy
|
|
|
|
Phase 2: PLANNING
|
|
├── Define activation settings per role (duration, MFA, approval)
|
|
├── Identify approvers for each critical role
|
|
├── Create communication plan for affected admins
|
|
└── Schedule pilot group for initial rollout
|
|
|
|
Phase 3: CONFIGURATION
|
|
├── Configure PIM role settings (activation, assignment, notification)
|
|
├── Convert permanent assignments to eligible (except break-glass)
|
|
├── Configure conditional access policies for admin activation
|
|
└── Enable audit logging and SIEM integration
|
|
|
|
Phase 4: TESTING
|
|
├── Test role activation with pilot users
|
|
├── Test approval workflow end-to-end
|
|
├── Test MFA enforcement during activation
|
|
├── Test auto-deactivation after duration expires
|
|
└── Validate audit logs capture all PIM events
|
|
|
|
Phase 5: ROLLOUT
|
|
├── Convert remaining permanent assignments to eligible
|
|
├── Notify all affected users with activation instructions
|
|
├── Monitor for activation failures and help desk tickets
|
|
└── Configure access reviews on quarterly schedule
|
|
```
|
|
|
|
## Role Activation Workflow
|
|
|
|
```
|
|
Admin needs to perform privileged task
|
|
│
|
|
├── Navigate to PIM portal (Entra Admin Center > PIM > My Roles)
|
|
│
|
|
├── Click "Activate" on the needed role
|
|
│
|
|
├── Select activation duration (up to configured max)
|
|
│
|
|
├── Enter justification and optional ticket number
|
|
│
|
|
├── Complete MFA challenge
|
|
│
|
|
├── [If approval required]
|
|
│ ├── Request submitted to approvers
|
|
│ ├── Approvers receive email notification
|
|
│ ├── Approver reviews justification and approves/denies
|
|
│ └── Admin receives approval notification
|
|
│
|
|
├── Role becomes active
|
|
│
|
|
├── Admin performs required task
|
|
│
|
|
└── Role automatically deactivates when duration expires
|
|
(or admin manually deactivates early)
|
|
```
|
|
|
|
## Access Review Workflow
|
|
|
|
```
|
|
Quarterly Access Review Triggered
|
|
│
|
|
├── PIM sends review notifications to designated reviewers
|
|
│
|
|
├── For each eligible assignment:
|
|
│ ├── Reviewer checks: Is this role still needed?
|
|
│ ├── Reviewer checks: When was role last activated?
|
|
│ ├── Decision: Approve (maintain), Deny (remove), or Don't know
|
|
│ └── Provide justification for decision
|
|
│
|
|
├── Review period expires (14 days default)
|
|
│
|
|
├── Auto-apply results:
|
|
│ ├── Approved assignments maintained
|
|
│ ├── Denied assignments removed
|
|
│ └── No-response: configurable (remove or maintain)
|
|
│
|
|
└── Review summary report generated for compliance
|
|
```
|
|
|
|
## Break-Glass Account Workflow
|
|
|
|
```
|
|
Normal Operations:
|
|
└── Break-glass accounts exist as ACTIVE Global Admin
|
|
├── Stored in secure physical safe (password printout)
|
|
├── Excluded from conditional access policies
|
|
├── Monitored by Azure Monitor alert rule
|
|
└── Monthly verification: confirm no unauthorized sign-ins
|
|
|
|
Emergency Use:
|
|
├── Primary admin methods unavailable (MFA outage, PIM issue)
|
|
├── Retrieve break-glass credentials from safe
|
|
├── Sign in and resolve the emergency
|
|
├── Document all actions taken
|
|
├── Reset break-glass credentials after use
|
|
└── Review and document in incident log
|
|
```
|