Skip to content

AccessOps v0.4.0 — Live Microsoft Entra containment

Latest
Latest

Choose a tag to compare

View all tags
@aman-agarwal6 aman-agarwal6 released this 05 Oct 22:04
v0.4.0
380e42c
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

AccessOps v0.4 adds live Microsoft Entra containment to the signed source. Everything in v0.3.0 is included.

  • Microsoft Entra, contained for real. An opt-in connector disables an enrolled Entra test user, removes its group membership and revokes its sign-in sessions through Microsoft Graph, then reads all three back before the case counts them. Measured in a free test tenant with synthetic users: 11/11 checks, with the Graph evidence on the case 19.8 s after the containment request.
  • The connector is its own scope boundary. Graph application permissions are tenant-wide on Entra ID Free, so it acts only on listed test users and groups, refuses configured protected accounts such as the tenant administrator and any user Graph lists as a direct, tenant-wide member of a directory role, will not run before admin consent is recorded, and never enables an account or adds a membership. It signs in with a certificate; the private key never leaves the lab's protected folder.
  • Local live results (5 October 2026): the live Entra suite passed 11/11, and the full lab suite passed on the same code (policy 32, protocols 18, sign-in 14, offboarding 11, departure cases 18, sessions 22, HR intake 10, leaver assurance 7, HTTPS 5). The published index holds 49 recorded runs, including 13 retained failed attempts.
  • CI for this commit: the signed run passed 401 of 401 backend and integration cases on PostgreSQL 17, and the frontend, policy and secret-scan jobs passed. Deployed-demo check: 17 of 17 checks passed against the deployed site.
  • Signed evidence: provenance and CycloneDX SBOM attestations over the frozen archive for 380e42c659ed2505d76fbc3947f9de969e1ababf. Expected repository aman-agarwal6/AccessOps; signer .github/workflows/release-evidence.yml; source ref refs/heads/main.

The signed archive covers its own CI report. recorded-local-checks.json and published-demo-checks.json have separate origins; local hashes are not signatures. See the verification ledger and verification instructions.

Limits: synthetic data only. Microsoft Entra was tested only in a free test tenant; Microsoft 365 and GitHub appear as offline fixtures and owner statements. Entra sign-in logs need a paid plan, so access after departure is still watched in Keycloak only, and an access token an app already holds lasts until it expires. Samba results do not prove Microsoft AD interoperability. This is a reference system, not a certification or production deployment.

Assets 9
Loading