🔐 Enterprise Zero Trust Architecture — Microsoft Entra ID & Multi-Cloud IAM
Architect: Kehinde (Kenny) Samson Ogunlowo | Principal AI Infrastructure & Security Architect
Clearance: Active Secret Clearance | Citadel Cloud Management
Enterprise Zero Trust architecture implementation using Microsoft Entra ID, AWS IAM, and Google Cloud IAM — with real-world patterns from Cigna (85% reduction in unauthorized access), Lockheed Martin (FedRAMP High + CMMC L2), and Ceretax (federal-grade tax compliance). Implements NIST SP 800-207 Zero Trust Architecture across hybrid multi-cloud environments.
Zero Trust Principles Implemented
"Never trust, always verify" — across every user, device, workload, and network path
| Principle | Implementation |
|---|---|
| Verify explicitly | MFA, device compliance, risk-based Conditional Access |
| Use least privilege | JIT/JEA, PIM, attribute-based access control (ABAC) |
| Assume breach | Network segmentation, lateral movement prevention, full audit |
| Continuous validation | Real-time risk scoring, session re-evaluation, anomaly detection |
Architecture
┌──────────────────────────────────────────────────────────────────────┐
│ IDENTITY PLANE │
│ Microsoft Entra ID | AWS IAM Identity Center | Google Cloud IAM│
│ ─────────────────────────────────────────────────────────────────── │
│ Conditional Access | Permission Sets | IAM Conditions │
│ PIM / JIT Access | SCPs / Permission Bdry | Org Policies │
│ FIDO2 Passwordless | IAM Roles for SA | Workload Identity│
├──────────────────────────────────────────────────────────────────────┤
│ DEVICE PLANE │
│ Intune MDM/MAM | CrowdStrike Falcon | Entra Joined Devices │
│ Device compliance policies | TPM attestation | ZTNA │
├──────────────────────────────────────────────────────────────────────┤
│ NETWORK PLANE │
│ Azure Private Endpoints | AWS PrivateLink | GCP Private SC │
│ VPC Service Controls | Network Policies | Istio mTLS │
│ Azure Firewall Premium | AWS Network FW | Cloud Armor │
├──────────────────────────────────────────────────────────────────────┤
│ APPLICATION & DATA PLANE │
│ Azure AD App Proxy | IAP (GCP/Azure) | BeyondCorp Enterprise │
│ FIPS 140-2 KMS | HSM-backed keys | Azure Confidential VM │
├──────────────────────────────────────────────────────────────────────┤
│ VISIBILITY & ANALYTICS │
│ Microsoft Sentinel | Chronicle SIEM | AWS Security Hub │
│ Entra ID Protection | Defender XDR | Security Command Center │
└──────────────────────────────────────────────────────────────────────┘
Core Components
Microsoft Entra ID (Azure AD)
- Conditional Access Policies — Location, device compliance, risk-based MFA
- Privileged Identity Management (PIM) — JIT elevation with approval workflows
- Entra ID Protection — Risk-based sign-in and user risk policies
- External Identities (B2B/B2C) — Federated identity for partners and customers
- Workload Identity Federation — Keyless authentication for GitHub Actions, Kubernetes
- FIDO2 Passwordless — Hardware security key enforcement for privileged accounts
AWS IAM (GovCloud patterns)
- IAM Identity Center (SSO) — Centralized access to multi-account AWS org
- Permission Boundaries — Developer guardrails with delegated admin
- Service Control Policies — Preventive controls across AWS Organization
- IAM Roles Anywhere — Short-lived credentials for on-prem workloads
- AWS CloudTrail + Security Hub — Compliance audit trail and findings aggregation
Google Cloud IAM
- Workload Identity Federation — Federated identity for CI/CD (GitHub Actions, GitLab)
- Organization Policy Service — Hierarchical constraints across projects
- BeyondCorp Enterprise — Context-aware access for internal applications
- VPC Service Controls — Data exfiltration prevention perimeters
- Binary Authorization — Cryptographic supply chain security for containers
Compliance Coverage
| Standard | Controls Implemented |
|---|---|
| NIST SP 800-207 | Full ZTA implementation: identity, device, network, application pillars |
| CMMC Level 2 | Access control (AC), Audit & Accountability (AU), ID & Authentication (IA) |
| FedRAMP High | AC, AU, IA, SC, SI controls — implemented at Lockheed Martin |
| HIPAA Security Rule | PHI access controls, audit logging, transmission encryption (Cigna) |
| NIST 800-53 Rev5 | AC-2, AC-6, IA-2, IA-5, SC-7, SC-28, AU-2, AU-6 |
Repository Structure
entra-iam-zero-trust/
├── terraform/
│ ├── azure/
│ │ ├── conditional-access/ # Entra CA policies
│ │ ├── pim/ # PIM role assignments
│ │ ├── entra-id-protection/ # Risk policies
│ │ └── private-endpoints/ # Network Zero Trust
│ ├── aws/
│ │ ├── iam-identity-center/ # SSO configuration
│ │ ├── permission-boundaries/ # IAM guardrails
│ │ ├── scps/ # Org Service Control Policies
│ │ └── privatelink/ # Network isolation
│ └── gcp/
│ ├── workload-identity/ # WIF federation config
│ ├── org-policies/ # Hierarchy controls
│ ├── vpc-service-controls/ # Data perimeters
│ └── beyondcorp/ # Context-aware access
├── policies/
│ ├── conditional-access/ # CA policy JSON templates
│ ├── scp-examples/ # AWS SCP examples
│ └── org-policy-constraints/ # GCP org constraints
├── monitoring/
│ ├── sentinel-analytics/ # Sentinel KQL queries
│ ├── chronicle-rules/ # Chronicle YARA-L rules
│ └── security-hub-findings/ # AWS findings aggregation
└── docs/
├── architecture-diagrams/
├── runbooks/ # Incident response procedures
└── compliance-mappings/ # Control to framework mappings
Production Impact
- 85% reduction in unauthorized access incidents at Cigna via Zero Trust + BeyondCorp
- 10,000+ monthly malicious requests blocked via Cloud Armor + VPC Service Controls (Ceretax)
- FedRAMP High + CMMC L2 compliance achieved at Lockheed Martin for defense workloads
- Zero data exfiltration incidents after Zero Trust implementation at Ceretax
Author
Kehinde (Kenny) Ogunlowo — citadelcloudmanagement.com | kogunlowo@gmail.com | LinkedIn