Azure security architecture — Entra-only identity on cloud
On Azure, CAN uses Microsoft Entra ID as the sole application IdP (SSO, Conditional Access, app roles). The same split as OCI: Keycloak is local-only.
What the architecture doc covers
- Environment profiles (dev → prod) and compartment-style resource organization on Azure
- Front Door / APIM / WAF edge patterns
- Workload identity for AKS → Key Vault and Storage (Path N now in Terraform)
- Crypto and key flows aligned with the participant lifecycle (DEK/MEK, signing, CAN escrow)
Companion references
| Doc | Role |
|---|---|
| AZURE_SECURITY_ARCHITECTURE.md | Topology + runbook |
| AZURE_IAM_AND_EDGE_CONFIG.md | Entra groups, APIM, WAF |
| AZURE_FEATURES_AND_CONFIGURATION.md | Feature maturity + env vars |
| AZURE_SPIFFE_SPIRE_WIF.md · blog | SPIFFE + AKS WI / Entra federation |
| Azure Terraform README | Pilot IaC: AKS, Entra apps, KV, Blob, WI |
| AZURE_READINESS.md | Gap analysis |
App roles on the API registration: TDC, TDP, CCRP, AppAdmin — mirrored in Identity Domain groups on OCI.