Enterprise identity & Active Directory

Updated 2026-10-06. Development release 0.004. This describes implemented code, not a production deployment or live Microsoft/Windows certification.

Implementation stages

Stage	Implemented	Required before rollout
Configuration	Immutable tenant revisions, encrypted write-only credentials, rekey/revoke, fresh local or mapped Microsoft admin proof, immutable external assignments, audit	Operator encryption keys and recovery admin
Entra / OBO	MSAL PKCE/state/nonce, strict API assertion checks, encrypted server sessions, membership/group rechecks, per-call OBO, consent/claims interaction	Consented registrations and live user tests
Microsoft resources	Unpooled SQL tokens, Fabric/Power BI REST GET, readonly SQL, project/category filters, post-read revocation	Exact source/revision/connection certification
Windows KCD	Signed one-use connector/SPN/subject/operation jobs, local AD mapping, native S4U helper, SQL SID/KERBEROS validation	Domain-joined connector and AD-approved delegation
Workloads / outputs	Named MI/certificate principal, leased scheduled jobs, encrypted input/output, explicit recipients, revoke/audit	Least-privilege provider grants and scheduler

Saved drafts, active Microsoft login and active source execution are separate. For interactive access activate the same immutable revision for login and execution. Changing login revision invalidates prior sessions.

Enable from the app

1. Deploy matching backend and UI, new Python dependencies and the built MSAL auth-redirect.html entry; apply appended registry schema. Select the intended workspace.
2. Open Settings & Monitoring → Settings → Identity & Access (/settings?tab=identity).
3. Enter directory UUID, SPA client UUID, API client UUID and Microsoft cloud. Register the UI origin's /auth-redirect.html as an SPA redirect URI. API registration must issue v2 access tokens (requestedAccessTokenVersion: 2), expose the configured scope (default access_as_user) and authorize the named SPA. Approve downstream delegated scopes/consent.
4. Add existing tenant-owned source bindings in the advanced editor, selecting exactly one mode: delegated_oauth (exact audience/scopes), kerberos (existing connector ID/exact SPNs), or workload (separately declared principal). Save draft creates an immutable revision; it does not activate access.
5. Under Encrypted credential bindings, verify your local admin password or use Verify with Microsoft, then save a named write-only certificate JSON. References in drafts contain only this name. Replacement/rekey/revoke require recent proof and current credential revision. Do not paste credentials into draft JSON.
6. Under Microsoft account assignments, link directory/object UUIDs to existing workspace user IDs and maximum viewer/editor/admin role. Email never links accounts. Assignment cannot create membership or elevate its role. Configured group mappings intersect roles; group overage denies.
7. Assign the current admin's Microsoft identity to that same app admin; Test Microsoft sign-in and enable requires both recent admin proof and that mapped Microsoft admin assertion. Existing login remains available for recovery. Users enter workspace slug on the login page and choose Sign in with Microsoft.
8. Complete operator source certification below. Then Enable certified pilot with fresh admin proof. The default certification list is empty.
9. Open Conversation → Query, complete Microsoft authentication, and run readonly SQL or an approved API relative path. Results are fresh, caller-local and excluded from shared history/caches/indexes.
10. For background jobs configure MI/certificate identity and workload bindings. Enter explicit recipient app user IDs, operation and optional repeat interval. Share the returned job ID; recipients use Read published result. Empty recipients publish to nobody, including admins. Revoke erases input/results and cancels publication/schedules.

Sensitive changes now support fresh local-password or mapped Microsoft admin authentication on the review branch. Microsoft step-up creates a single-use tenant/user/policy-bound server nonce, requests interactive authentication, and independently validates the signed ID-token nonce/authentication time plus the same-account API assertion. Cached/stale tokens, another account and replay deny. Configure the browser registration to return the auth_time ID-token optional claim. A first Microsoft assignment still requires an existing authorized recovery administrator; email never links accounts. Google-only admins need that recovery administrator or an explicitly assigned Microsoft identity. SSO-only enforcement is not enabled. See Microsoft ID-token claims.

Operator configuration

Secrets remain environment-only:

• IDENTITY_ENCRYPTION_KEYS: JSON map of key IDs to Fernet keys; IDENTITY_ACTIVE_KEY: current write key. No demo fallback. Retain old keys through credential rekeying and session/job expiry or revocation.
• IDENTITY_KCD_SIGNING_KEY: RSA private PEM; IDENTITY_KCD_KEY_ID: pinned key ID; IDENTITY_KCD_ISSUER: exact issuer shared with the customer connector. Never commit private keys.
• IDENTITY_MANAGED_IDENTITY_ENABLED=true only on an Azure host with the explicitly named MI. No developer/user fallback.
• IDENTITY_CERTIFIED_BINDINGS: operator-owned JSON array of records with integer tenant_id, revision, source_id, capability (sql, fabric_rest, powerbi_rest, kerberos_sql) and connection_digest. Calculate via identity.runtime.fingerprint on the owned source record. It binds source type/encrypted connection reference. Changed policy/connection needs recertification; app admins cannot create these records through the UI.

Non-secret limits, authority clouds, audiences/API bases and exact SQL approved hosts live under enterprise_identity in config.yaml. SQL host approval defaults empty. Install Microsoft ODBC Driver 18 and unixODBC where needed. SQL uses a credential-free mssql+pyodbc URL with verified TLS; explicit username/password, implicit trusted authentication, custom ODBC strings and pooling are rejected.

Certificate reference JSON has private_key, thumbprint, optionally public_certificate; workload certificate use requires public PEM too. principal_id means application client ID, including user-assigned MI, not service-principal object ID. MI requires an Azure host with that identity.

Existing scheduler calls identity.jobs.run_next once per tick. Run the dedicated scheduler with registry access and the same identity environment. Leases/retries are bounded; publication checks lease ownership and current policy. Repeating jobs clear prior results before the next execution.

Customer-side Windows installation

1. AD administrators approve domain service account/gMSA, protocol transition/constrained delegation, exact SQL SPNs and readonly user SQL logins. Protected/nondelegable accounts must deny.
2. Register a Windows connector; download Python bundle 1.3.0. It contains signed-envelope/readonly validators and Windows bridge. The native helper is a separate source build, not a bundled executable.
3. With .NET 10 SDK, restore using the committed lock file and publish public/connectors/windows-kcd/AgentData.Kcd.csproj for the approved Windows runtime. Protect executable/config from untrusted writes.
4. Set local KCD_CONFIG_PATH and KCD_HELPER_PATH; run connector under the approved domain service identity.
5. Configure trusted RSA public keys, exact tenant/connector/revision, immutable directory/object → AD UPN/SID mappings, approved local SQL targets, and private durable replay storage. Keep replay markers at least through the accepted job lifetime; automatic ledger pruning is not shipped.
6. KCD SQL parameters use @name; modern SQLAlchemy reads use :name. Pass values separately in JSON. Helper opens a new TLS-verified unpooled SQL connection inside impersonation and requires the expected SID and KERBEROS before execution. NTLM/wrong principal/shared credentials deny.

Local configuration example; all values are placeholders:

{
  "tenant_id": 123,
  "connector_id": "registered-connector-id",
  "issuer": "configured-exact-issuer",
  "policy_revision": 1,
  "public_keys": {"configured-key-id": "RSA PUBLIC PEM"},
  "max_lifetime_seconds": 60,
  "max_rows": 5000,
  "query_timeout_seconds": 30,
  "helper_timeout_seconds": 40,
  "replay_dir": "customer-approved-private-directory",
  "mappings": {
    "directory-uuid:object-uuid": {"enabled": true, "upn": "approved-upn", "sid": "approved-ad-sid"}
  },
  "targets": {
    "456": {"spn": "MSSQLSvc/exact-host:port", "connection": "Server=exact-host;Database=approved-db;Integrated Security=true;Encrypt=true;TrustServerCertificate=false"}
  }
}

This uses customer-side protocol transition; OAuth is never treated as a Kerberos ticket. AD passwords/tickets never enter the cloud.

Security boundary and remaining requirements

Pilot cutover quarantines legacy data channels: shared query/chat/retrieval indexes, exports, Documents Automation, old flows/profilers, legacy MCP/Data API and connector jobs deny. Identity/authentication, project membership and user/settings administration remain accessible. Query becomes the enterprise reader. Delegated authorization is not yet implemented across all legacy product features; they remain blocked.

Pausing retains quarantine and never restores shared credentials/caches. Full rollback requires an operator-reviewed migration/recovery procedure. Workload publication uses deliberate app grants over service-principal data, not each recipient's downstream database ACL. Membership, source/project/category, active revision and recipient grants are checked on read. There is no admin override.

Provider tokens are transient, absent from connection URLs/logs/responses. Assertions are encrypted server-side and erased on logout/reconfiguration. Membership/mapping is rechecked on session use. Wrong issuer/audience/client/scope, app/ID tokens, expiry and cross-tenant access deny. No fallback between user/Kerberos/workload modes.

Configured clouds do not certify sovereign Fabric or arbitrary APIs/drivers. BI publication, folder ACL delegation and full legacy product integration are not shipped. Session renewal requires Microsoft interaction. Live Windows execution has not been tested here; only helper compilation and cryptographic protocol tests passed.

Live certification

Record evidence privately before adding operator certification:

• Two Entra users with distinct grants: allowed/denied reads, effective SQL principal, wrong directory/audience/client, ID/app tokens, revoked membership.
• Fabric REST and SQL independently: correct scopes/consent/audience, exact host/TLS, token expiry, MFA/consent challenge, no redirects/resource substitution or cross-user pool leakage.
• Windows: domain identity, SPNs, immutable SID mapping, SQL KERBEROS; nondelegable user, NTLM, wrong mapping/SPN, signature, replay, expiry, restart/storage failure.
• Workload: named provider and least privilege; explicit recipients/no admin override; removed membership/project/source access; pause/revoke/policy/lease changes cannot publish.
• Preexisting history/index/export/MCP/Data API/flow paths deny after cutover and remain denied after pause. Verify recovery login and rollout plan.

No live customer Entra/Fabric or domain-joined Windows evidence was supplied in this run; certified execution remains disabled by default.

Verification and tracking

Final affected regression suite: 192 passed, 3 skipped (195 cases), covering identity contracts/credentials/assertions/providers/KCD/runtime, tenant/RBAC/category/project isolation, Data API cache security, document/enterprise connectors and scheduler. The skipped cases require live external connector configuration. Python static/import checks, TypeScript/Vite build and native Windows helper compilation passed (zero native warnings/errors).

Synthetic Chrome checks passed for draft save, tenant reset, viewer gate, fresh enterprise reads, explicit job-result reads and light/dark/mobile screenshots. Reproduce with scripts/identity-ui-check.cjs, providing PUPPETEER_MODULE, CHROME_PATH, REVIEW_URL and REVIEW_OUTPUT environment variables. These fixtures and SDK tests do not certify Microsoft/AD.

US10035 stays in progress pending customer topology approval, live certification, rollout and remaining full-product authorization work. See approved design.

References: Microsoft OBO, MSAL browser, ODBC Entra, WindowsIdentity.