<!-- Copyright (c) 2026 defconxt. All rights reserved. -->
<!-- Licensed under AGPL-3.0 — see LICENSE file for details. -->
---
name: performing-identity-security-architecture-review
description: >-
  Conduct comprehensive reviews of identity security architecture covering identity providers, authentication, authorization, and federation.
domain: cybersecurity
subdomain: identity-security
tags:
  - architecture-review
  - identity-architecture
  - authentication
  - authorization
  - security-assessment
version: "1.0"
author: defconxt
license: AGPL-3.0
metadata:
  mitre-attack: ["T1078"]
---

# Performing Identity Security Architecture Review

## Overview

Identity security architecture review evaluates the design, implementation,
and security posture of an organization's identity infrastructure. Reviews
assess identity provider configuration, authentication strength, authorization
models, federation trust, and identity data flows.

## Prerequisites

| Requirement | Install |
|---|---|
| Architecture documentation | Current identity architecture diagrams |
| Identity provider admin | Configuration review access |
| Network diagrams | Identity traffic flow understanding |
| Python 3.10+ | For agent tooling |

## Key Concepts

### Review Domains

| Domain | Focus Areas |
|---|---|
| Identity Providers | Configuration, redundancy, patch level |
| Authentication | MFA coverage, password policy, passwordless |
| Authorization | RBAC/ABAC model, least privilege, SOD |
| Federation | Trust relationships, protocol security |
| Directory | AD/LDAP security, replication, backup |
| Privileged Access | PAM deployment, just-in-time access |

### Assessment Framework

For each domain, evaluate:
- **Design** — Is the architecture sound in principle?
- **Implementation** — Does the deployment match the design?
- **Configuration** — Are settings aligned with best practices?
- **Monitoring** — Are security events detected and alerted?
- **Resilience** — Can the system survive component failure?

### Common Findings

- MFA not enforced for all users or critical applications
- Legacy authentication protocols still enabled
- Overly broad federation trust relationships
- No privileged access management (PAM) solution
- Insufficient monitoring of identity infrastructure

## Workflow

1. **Define review scope** — identify identity systems and boundaries
2. **Gather documentation** — collect architecture diagrams and configurations
3. **Assess identity providers** — evaluate configuration and security posture
4. **Review authentication** — analyze MFA coverage and password policies
5. **Evaluate authorization** — assess RBAC/ABAC models and least privilege
6. **Inspect federation** — review trust relationships and protocol security
7. **Report findings** — document gaps with severity and remediation guidance


## Detection

```yaml
title: Detect Identity Architecture Gap — MFA Not Required for Admin Role
id: a9b0c1d2-e3f4-5678-abcd-789012345678
status: experimental
description: Detects admin role activations without MFA challenge, indicating conditional access policy gap.
logsource:
  product: azure
  service: signinlogs
detection:
  selection:
    ResultType: '0'
    AuthenticationDetails.authenticationMethod: 'Password'
    UserType: 'Member'
  filter_mfa:
    AuthenticationRequirement: 'multiFactorAuthentication'
  condition: selection and not filter_mfa
falsepositives:
  - Legitimate administrative activity from authorized accounts
level: medium
tags:
  - attack.t1078.004
  - attack.credential_access
```

## Verification

| Check | Method |
|---|---|
| Scope defined | All identity systems in scope identified |
| Documentation gathered | Architecture diagrams and configs collected |
| Providers assessed | Identity provider security posture evaluated |
| Authentication reviewed | MFA coverage and policy gaps documented |
| Findings reported | Architecture review report with recommendations |

## References

- [NIST SP 800-63 — Digital Identity Guidelines](https://csrc.nist.gov/pubs/sp/800/63/4/ipd)
- [Microsoft — Identity Security Best Practices](https://learn.microsoft.com/en-us/entra/fundamentals/concept-secure-remote-workers)
- [CIS Controls — Identity Management](https://www.cisecurity.org/controls)
- [NIST SP 800-207 — Zero Trust Architecture](https://csrc.nist.gov/pubs/sp/800/207/final)
