Initial stage of bootstrap feature

[soulemike]

This PR stages a new feature to support bootstrapping groups in alignment with EAM and registering corresponding Access Packages and PIM. The groups can be further assigned to specific authorizations and monitored through the core EntraOps feature set.

• Add cmdlets to module export
• Create a Service Role object template for Azure Landing Zone architecture
• Peer review that groups align with EAM
• Add attribute to flag in reports
• Documentation of EntraOps ServiceRoles

Overview of EntraOps ServiceRoles Object Structure

The EntraOps ServiceRoles are an array of objects each with three properties.

Properties

• Name - The Name property for a service role defines the type of members the corresponding group object will contain. There are three currently supported Name values.
  • Members - The intent of the Members Name is to provide a default authorization that identifies individuals who are monitor or manage the deliver of a service. This could be individual contributors of a specific project team, individuals of a specific job role, family, or department, or any other combination of members that would be involved with the service.
  • Users - The Users Name identifies authorizations providing non-privileged access to the application interfaces, either user or programmatic. These authorizations could be the primary means for authorizing any user access to the service or be a specific group for the team delivering the service to use for validation independent of the primary user authorization mechanism.
  • Admins - The Admins Name identifies authorizations providing privileged access to control, management, and workload planes of the service and infrastructure.
• Type - The Type property for a service role defines the access plane the group should interface with. There are currently four supported values.
  • "" - An unset Type identifies that there are no implicit authorizations for this role. Commonly this is exclusive to the Members role, and multiple service roles could be used for different forms of information distribution or communication management regarding the service.
  • Workload - The Workload Type signifies authorizations to the workload, or data, plane of the service. The access can be through the application itself, such as for an access override, or through privileged intermediaries or interfaces, such as the Azure Portal.
  • Management - The Management Type signifies privileged authorizations to the management plane of the service. Typically this will be through privileged intermediaries or interfaces, such as the Azure Portal.
  • Entitlement - The Entitlement Type signifies privileged authorizations to the control plane of the service with the specific scope or entitlement or authorization administration.
• GroupType - The GroupType property for a service role defines the Entra group object type to create. There are two currently support GroupType values.
  • Unified - The Unified GroupType identifies that an Entra Unified Group object should be used for authorization management of the role.
  • "" - An unset GroupType identifies that an Entra Security Group object should be used for authorization management of the role.

Example ServiceRoles

The following is the default ServiceRoles object structure used by the bootstrap feature. The following are created from this:

• 7 Entra Groups
  • Members - A Unified Group containing all ServiceMembers.
  • SG--Members-Management - A Security Group containing all ServiceMembers.
  • SG--Users-Workload - A Security Group to allow for user access to the workload, or data, plane of the service.
  • SG--Admins-Entitlement - A Security Group for administration of PIM and Entitlement Management control plane objects.
  • SG--Admins-Management - A Security Group for administration of service management plane objects.
  • SG--Admins-Workload - A Security Group for administrator access to the workload, or data, place objects.
  • SG-PIM--Admins-Management - A Security Group for an eligible PIM elevation for administration of service management plane objects.
• 1 Entra ID Governance Entitlement Management Catalog for all service authorizations.
  • Including the Resource registrations for each of the 7 groups.
  • Including the Resource Role registrations for the owner and member roles of group objects.
• 5 Entra ID Governance Entitlement Management Access Packages for each of the groups, with the members groups being in one Access Package, and the PIM group being excluded from the Access Packages.
  • Including Resource registrations for the owner and member roles for each of the corresponding groups.
• 2 Entra ID Governance Entitlement Management Access Package Policies. Initial members policy allowing for self-service to join the Members Access Package with manager and existing member approvals. Baseline policy for privileged access requiring peer approval.
  • Including assignment of the corresponding policy to the Access Packages.
  • Including assignment of the Access Packages to the ServiceMembers.
• 1 Entra ID Privileged Identity Management Policy to require MFA.
  • Including assignment of the policy to the corresponding PIM group.
  • Including eligibility assignment to the groups for ServiceMembers.
• 1 Azure Resource Group.
  • Including setting the Azure RBAC permissions with the corresponding groups.

name	type	groupType
Members		Unified
Members	Management
Users	Workload
Admins	Workload
Admins	Entitlement
Admins	Management

[jadedcaveman-01]

Nice job Mike!