Identity, security & DevOps

Every client environment we've built this discipline into has run on Azure — the depth below reflects that real experience. The same identity, secrets, and delivery-pipeline patterns carry over directly to AWS (IAM, Secrets Manager, CodePipeline) or Google Cloud (Cloud IAM, Secret Manager, Cloud Build) when that's the platform in play.

Identity — Microsoft Entra ID

Microsoft Entra ID (formerly Azure Active Directory) is Azure's cloud identity and access management platform. On the workforce side, it's what most people interact with directly: single sign-on across an organization's applications, multifactor authentication, and conditional access policies that evaluate context — device, location, risk signals — before deciding whether to grant access, rather than treating every successful password as sufficient on its own. Identity governance layers on top with least-privilege access, just-in-time elevation, and periodic access reviews, so permissions granted for a specific need don't just accumulate indefinitely.

The half of identity that matters just as much for how a system is actually built is application and service identity. A managed identity can be assigned to a resource — an App Service instance, a Function, an AKS workload — and once assigned, that resource can be authorized to reach another resource, like a secrets vault or a database, without any password, connection string, or API key ever being stored anywhere. The platform issues, rotates, and manages the underlying token automatically. Workload identity federation extends the same no-secrets model beyond the cloud itself, letting workloads in CI/CD or on Kubernetes authenticate the same way — removing an entire category of risk: there's no long-lived credential sitting in a config file for someone to leak.

How CloudCompass AI uses it

Every cloud resource we stand up for a client authenticates through managed identity rather than an embedded credential — an App Service application or an AKS workload gets its own identity, granted access to exactly the secret or database it needs, and nothing beyond that. The same identity model gates who can sign in to the applications and admin tools we build, so authentication and authorization are one consistent system across a client's environment rather than a different login mechanism per application.

Secrets & keys — Azure Key Vault

Azure Key Vault solves three related problems: secrets management (passwords, connection strings, API keys, tokens), key management (the encryption keys used to protect data), and certificate management (provisioning, deploying, and auto-renewing TLS/SSL certificates). All three are backed by hardware security modules — every vault is encrypted at rest, and Key Vault is built so that Microsoft itself doesn't see or extract the data stored in it.

Access works on two layers: authentication, which establishes who or what is asking, happens through identity; authorization, which determines what that caller is actually allowed to do, happens through role-based access control or a vault access policy. Applications retrieve a secret by its URI rather than a developer copying a value into configuration — the value is never checked into source control, and can be versioned and rotated without touching application code. Every vault logs every access attempt, giving a full audit trail of who read what and when.

How CloudCompass AI uses it

Every client environment we build gets its own vault, and application code never contains a secret directly — no connection string, API key, or certificate is ever hardcoded or checked into a repository. Instead, the application authenticates using a managed identity and retrieves what it needs at runtime, which also means rotating a compromised or expiring credential is a vault operation, not a code change and redeploy.

Delivery pipeline — Azure DevOps

Azure DevOps is a set of development services rather than a single monolithic tool — organizations can adopt the whole suite or pick individual pieces that fit how they already work. Boards provide configurable Kanban-style work tracking. Repos are cloud-hosted private Git repositories with pull request review built in. Pipelines handle continuous integration and continuous delivery across essentially any language, platform, or cloud. Test Plans covers manual and exploratory testing, and Artifacts lets a team create, host, and share packages internally. Security is integrated rather than bolted on afterward — vulnerability and exposed-secret scanning run directly inside the development lifecycle.

How CloudCompass AI uses it

We build pipelines that are environment-aware — meaning the same pipeline definition behaves correctly whether it's deploying to a development, staging, or production environment, rather than maintaining separate, drifting copies for each one. Permissions follow the same principle: group-based permission models control who can approve or trigger deployments into which environment, so environment access is a deliberate configuration rather than something managed ad hoc per person.