Who may do what at Nordlicht Reisen GmbH, a fictional travel agency? Operations manages the Azure resources of the portal, sales reads reports, partners see only their documents, and employees working from home reach an internal booking application that stays in the data center in Hamburg. This lesson recommends solutions for access to Azure resources and for access to on-premises resources. How someone signs in was lesson 1.2; here it is about what they may do afterward.
Prior knowledge. You read and set roles, scopes and assignments in "AZ-104, lesson 1.3"; identity and access are explained in "AZ-900 compact, lesson 2.6". Managed identities are shown in "K3, lesson 3.3.1", least privilege in "K3, lesson 3.3.5" and "K4, lesson 4.8.5". None of that is repeated here.
The requirement
Requirements sheet according to lesson 0.2, starting point G-01 to G-10. All numbers are assumptions of the task.
| No. | Requirement | Type | Measure | Weight | Source |
|---|---|---|---|---|---|
| 1.3-01 | Operations manages the resources of the portal with the least privileges needed. | Q | 8 people, three groups of duties; assumption | Must | Security |
| 1.3-02 | Administrator rights for production apply only on request and with a justification. | Q | activation for at most 8 hours; assumption | Should | Audit |
| 1.3-03 | Sales reads tables of the log workspace (lesson 1.1), changes nothing. | F | one group, 12 people; assumption | Must | Sales |
| 1.3-04 | Applications access database and storage without stored secrets. | F | all applications of the portal; assumption | Must | Security |
| 1.3-05 | Partner staff read only documents of their own company in the file store. | Q | 400 users in about 60 companies; assumption | Must | Data protection |
| 1.3-06 | Employees working from home reach the internal booking application (web application, G-02) without access to the whole network. | F | about 80 people; assumption | Must | Operations |
| 1.3-07 | The same people reach the old file store in the data center over SMB (G-06). | F | one share; assumption | Should | Sales |
| 1.3-08 | No inbound firewall opening to the data center is created. | R | no inbound ports; assumption | Must | Security |
Cost frame. Cost comes before convenience, not before security. Cost drivers: license tier per user (Entra ID P1, P2), license for Entra Private Access, servers for connectors. Amounts: pricing pages of Microsoft Entra.