Security & Governance

Principle: Access should be managed via security groups, not individual users. Each project and workspace should have dedicated groups for granular access control.

• Each project should have a default group (e.g., prj_mor_users).
• Each workspace should have a group for access control (e.g., ws_bi_project_delivery_users).
• Developers/admins should be in a central dev_admins group, which is added to all workspace groups for elevated access.
• Service principals should be managed via dedicated groups (e.g., svc_fabric_deploy).

Best Practices:

• Use Azure AD (or your IdP) to manage all security groups.
• Assign permissions at the group level, not to individuals.
• Review group membership regularly to ensure least privilege.
• Document group purposes and owners.
• For cross-project roles (e.g., platform admins), use a central group and add it to all relevant workspace/project groups.

Service Principals: Use service principal groups for automation, CI/CD, and integration scenarios. Assign only the minimum permissions required for each service principal.

• Service principals should never be used for interactive logins.
• Rotate credentials regularly and monitor usage.
• Document the purpose and owner of each service principal.

Data Governance: Ensure compliance, data quality, and auditability across all environments.

• Implement data classification and sensitivity labels.
• Maintain data lineage and documentation for all critical assets.
• Set up monitoring and alerting for access and data changes.
• Review access logs and audit trails regularly.