Chapter 31 — Identity and access management: advanced cases

Lesson map

Lesson 31 published. Map, example, EX091.

flowchart TD
  N0["Learning outcomes"]
  N1["31.1 Contractors and volunteers"]
  N2["31.2 Service accounts"]
  N3["31.3 Tenant identities"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX091"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["31.1 Contractors and volunteers"]
  N2["31.2 Service accounts"]
  N3["31.3 Tenant identities"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX091"]

[Learning outcomes]
    |
    v
[31.1 Contractors and volunteers]
    |
    v
[31.2 Service accounts]
    |
    v
[31.3 Tenant identities]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX091]

Learning outcomes

You will (1) handle contractors and volunteers; (2) manage service accounts; (3) consider tenants' identities in online services.

31.1 Contractors and volunteers

Greenhill uses contractors for repairs and volunteers for community events. They need some access but are not in HR. Elena designs a sponsor model: each contractor or volunteer has a named Greenhill sponsor, an account with an end date and access only to what their work needs. Sponsors confirm continued need every three months. Accounts expire automatically on the end date. This keeps people outside HR inside the lifecycle, rather than creating accounts that nobody remembers to remove. The sponsor list is reviewed every quarter.

31.2 Service accounts

The finance system's two service accounts send payment files and receive bank statements. They have passwords that never change and broad permissions. Elena recommends documenting each service account's owner, purpose and permissions; reducing permissions to what the task needs; storing credentials in a protected vault rather than a file; and rotating them on a schedule agreed with the supplier. Service accounts are often forgotten in reviews, yet their access can be as powerful as any administrator's. Each change is agreed with the finance supplier in advance.

31.3 Tenant identities

Greenhill plans an online portal where tenants can report repairs and pay rent. Tenants are a very different population: some are elderly, some have no smartphone, and many share devices with family. Elena notes that tenant identity needs separate thinking from staff identity: simple sign-in options, accessible recovery and protection against someone else in the household acting for a tenant without consent. She records this as future work, outside her current scope, so it is not forgotten. The note is shared with the portal project team.

Worked example

Twelve contractors and volunteers move to sponsored, expiring accounts; two finance service accounts are documented, reduced and moved to a vault.

Synthetic case. People, accounts and plans are synthetic.

Errors and limits

Creating contractor accounts outside any lifecycle leaves access long after work ends.

Exercises

• EX091 — Sponsor role. What does a contractor's sponsor do?
  Show marking criteria

  Rubric: 3 = confirms need every three months;; 2 = confirms need;; 1 = pays;; 0 = none.
• EX092 — Service account steps. Name two service account improvements.
  Show marking criteria

  Rubric: 3 = document owner, reduce permissions, vault storage, rotation (two);; 2 = one;; 1 = vague;; 0 = none.
• EX093 — Tenant concern. Name one tenant identity concern.
  Show marking criteria

  Rubric: 3 = no smartphone, shared devices, accessible recovery, household consent (one);; 2 = one;; 1 = vague;; 0 = none.

Synthesis

Sponsors, managed service accounts and separate thinking for tenants extend IAM beyond employees.

Continue studying — chapter 31 of 40

← Chapter 30 (draft) · Course chapter index · Chapter 32 (draft) →