3.5. Reflection Checkpoint

Key Takeaways

• Answer every "which role?" with the least-privileged built-in role, scope it with administrative units where geography/department demands, protect VIPs with restricted management AUs, and audit tenant defaults (user/group/device settings, domains, branding) as the policy surface they are.
• Design groups as access primitives: security vs M365, assigned vs dynamic (asynchronous!), role-assignable set at creation; let attributes drive membership and group-based licensing (usageLocation first), and treat owners as quiet administrators.
• External identities stay home: B2B redemption ladders through the guest's own IdP down to email OTP; collaboration settings gate who invites whom; cross-tenant access settings set per-partner trust (accept their MFA/device claims); cross-tenant sync auto-provisions multitenant orgs; direct connect skips guest objects for shared channels.
• Hybrid = one-way river with opt-in writebacks: pick the sync engine by feature gaps (Cloud Sync = light/HA/multi-forest; Connect Sync = writebacks/Exchange/custom rules), pick authentication by requirement (PHS = resilience default; PTA = immediate on-prem validation; AD FS = only hard requirements, and migrate off via staged rollout), and watch it all with Connect Health.

Connecting Forward

Phase 4 gives the same rigorous treatment to non-human identities: the service principals quietly created behind every enterprise app you just assigned users to, managed identities that eliminate credentials for Azure workloads, the consent framework governing what apps may do, and Defender for Cloud Apps watching the SaaS estate you've been federating into.

Self-Check Questions

• The Paris helpdesk must reset passwords and re-register MFA for Paris users only; the CISO's account must be untouchable by them. Name every construct in your design (roles, AU types, memberships) and why each is required.
• A partner's 200 engineers need your project portal with their own Okta credentials and no double MFA; their access must auto-expire quarterly. Which three features combine, and which phase owns the third?
• Contrast what breaks at cloud sign-in time when (a) the PTA agents' server farm loses power, (b) the Connect Sync server dies for a day in a PHS tenant, (c) the AD FS signing certificate expires. Which failure is invisible to users, and why?