— C·01Advisory

Identity Architecture Review.

A design assurance review comparing your identity architecture against best-practice reference architecture for SaaS-first enterprises adopting Zero Trust and AI. Independent. Vendor-neutral. Architecture-level.

— I · Ideal client

For organisations that…

  • 01Use Microsoft 365 or Okta
  • 02Run more than 20 SaaS applications
  • 03Are adopting cloud-first strategy
  • 04Are implementing Zero Trust
  • 05Are adopting AI tools
  • 06Have a hybrid identity environment
— II · Scope of assessment

7 domains. Architecture-level.

01Identity Provider Architecture

Entra ID / Okta tenant structure, AD integration, SSO configuration, conditional access structure. Identifies duplicate identity sources, weak authentication requirements, inconsistent policies.

02SaaS Integration Model

How SaaS apps connect to the identity provider — SSO usage, local authentication, provisioning, lifecycle. Identifies apps bypassing SSO, manual provisioning, uncontrolled SaaS onboarding.

03Privileged Access Governance

Admin role allocation, global admin usage, JIT model, separation of duties. Identifies excessive privileged users, lack of just-in-time access, standing privileged access.

04Identity Lifecycle Management

Joiner / mover / leaver. Identifies delayed deprovisioning, inconsistent role assignment, manual processes.

05MFA & Conditional Access

Enforcement consistency, conditional access policies, device trust requirements. Identifies inconsistent MFA enforcement and policy gaps.

06SaaS Governance Model

Onboarding standards, approval processes, governance ownership. Identifies shadow IT and uncontrolled OAuth integrations.

07Zero Trust Alignment

Least privilege enforcement, authentication strength, access segmentation. Surfaces architectural gaps versus a Zero Trust target state.

— III · Engagement cadence

Week by week.

Week 1

Kickoff session. Information gathering. Identify SaaS apps and identity provider landscape.

Week 2

Identity provider review. SaaS integration review.

Week 3

Privileged access review. Lifecycle review.

Week 4

Analysis. Report creation.

Week 5

Presentation of findings. Walk-through with the security and architecture teams.

— IV · Deliverables

What you receive.

  • 01Executive summary — overall maturity, key risk themes, priority actions
  • 02Identity architecture observations — strengths, weaknesses, structural challenges
  • 03Risk observation summary (e.g. inconsistent MFA, fragmented lifecycle, excessive privileged accounts)
  • 04Improvement roadmap — short, medium, long-term
  • 05Target-state identity architecture view
  • 06Reference diagrams (current and target state)
⊘ Out of scope
  • Penetration testing
  • Tool deployment
  • Configuration hardening
Tools used
WordPowerPointExcelVisio / draw.ioMiro
— The next step

Begin where every Flowuity engagement begins — discovery.

Forty-five minutes. No deck. No pitch. We ask better questions about your identity estate than you have been asked.

Book a meeting →