Warning
Work in Progress: This page is currently under construction. Content may be incomplete or subject to change. To contribute, see the contribution guide.
Identity & Access Management (IAM)
All identity at Patria Investments is managed through Microsoft Entra ID (formerly Azure Active Directory). This page describes how access is granted, reviewed, and revoked.
Identity provider
| Component | Details |
|---|---|
| Provider | Microsoft Entra ID (Azure AD) |
| Authentication | SSO with MFA enforced for all accounts |
| Directory groups | Used to control access to systems, replacing individual role assignments |
| Service accounts | Managed identities preferred; static service principals stored in Key Vault |
Access lifecycle
flowchart LR Request[Access Request\nServiceNow] --> Approve[Owner Approval] Approve --> Provision[Provisioned via\nEntra ID group] Provision --> Review[Periodic Review\n90 days] Review --> Revoke[Revoked if\nno longer needed]
Requesting access
- Open a ticket in ServiceNow — category Access Management
- Specify the system, role or Entra ID group, and business justification
- Approval required from the resource owner
- The Infra / Security team provisions access within 1 business day
Access review
- All non-standard access is reviewed every 90 days
- Managers confirm whether each user still requires access
- Unused access is revoked automatically after the review deadline
Access revocation
- Initiated automatically on offboarding (HR triggers ServiceNow workflow)
- Emergency revocation: contact the Security team directly — see Contacts
Groups & roles
| Group | Purpose | Systems |
|---|---|---|
g_tech_docs | Access to the Tech Docs portal | patria-tech-docs |
g_infra_admins | Administrative access to cloud subscriptions | Azure, GCP |
g_data_engineers | Data engineering access (BigQuery, Airflow) | GCP, BigQuery |
g_app_developers | Standard developer access | GitHub, Azure dev |
MFA policy
- MFA is mandatory for all accounts with no exceptions
- Supported factors: Microsoft Authenticator app (preferred), FIDO2 hardware key
- SMS/voice OTP is not permitted as a standalone factor
Privileged access
- Privileged roles (Global Admin, Subscription Owner) are assigned Just-in-Time (JIT) via Entra ID PIM
- All privileged sessions are logged and auditable
- Standing privileged access is not permitted