IAM Architecture — Workday → Entra ID → AD with IGA

End-to-end Identity & Access Management reference architecture for a multi-tenant cloud + hybrid AD enterprise (fintech profile). Workday as the source of truth, Microsoft Entra ID as the identity plane, hybrid Active Directory for legacy workloads, and Saviynt/SailPoint orchestrating governance.

Delivered as four interlinked artifacts, all vanilla HTML/CSS/JS (CDN-loaded React, no build step).

What's inside

File	What it is
IAM Architecture.html	Interactive console — 11 views including HLD with animated data flow, LLD per integration, 8 lifecycle scenarios, attribute/schema mapping, connector matrix, sample API payloads, network/zone diagram, security controls, DR/HA, and a Saviynt vs SailPoint comparison
Runbooks.html	8 detailed operational runbooks (joiner, mover, leaver, contractor, PAM, certification, birthright, SoD) with triggers, preconditions, RACI, step-by-step procedure, failure paths, rollback, audit evidence, escalation, and test plan
IAM Architecture Deck.html	16-slide stakeholder deck (1920×1080), keyboard-navigable, prints to PDF one-page-per-slide
IAM Architecture Print.html	20-page printable architecture document (A4, light theme) for spec/handoff. Use the toolbar's Print button → Save as PDF

The main interactive console (IAM Architecture.html) cross-links to the other three from its sidebar.

How to view

No build step required. Open any .html file in a modern browser (Chrome, Edge, Safari, Firefox).

If you want to serve them via a local server (recommended to avoid any cross-file fetch issues):

# Python 3
python3 -m http.server 8080

# Or Node
npx serve .

Then visit http://localhost:8080/IAM Architecture.html.

Architecture at a glance

Four-layer model:

1. Source of truth — Workday HCM (authoritative HR data, every join/move/leave originates here)
2. Governance (IGA) — Saviynt or SailPoint (birthright resolution, SoD enforcement, certifications, audit)
3. Identity plane — Microsoft Entra ID (SSO, MFA, Conditional Access, PIM — the master identity store)
4. Legacy bridge — Active Directory (projected from Entra via Cloud Sync, never authoritative)

Design positions worth discussing:

• Cloud Sync over legacy AD Connect (cloud-master semantics, lighter agents, faster RPO)
• Zero standing privilege — every admin role eligible-only via Entra PIM, tiered TTLs
• SoD enforced at request time, not just detective scans
• Workday push for terminations, not the 15-min poll
• Cloud-only identities by default; AD projection only when an on-prem workload needs it

Lifecycle scenarios covered

Joiner · Mover · Leaver · Contractor lifecycle · Privileged access (PAM) · Access certification · Birthright provisioning · SoD violation

Reference materials included

• Attribute/schema mapping (Workday → Entra → AD, field-by-field with transforms)
• 16-connector matrix with protocol, cadence, owner, criticality
• Sample API payloads (Workday SOAP, SCIM POST/PATCH, leaver revoke, PIM eligible, SoD event, certification decision)
• Network & zone topology (3 Azure tenants, 2 AD forests, DMZ, on-prem, SIEM)
• 14-policy Conditional Access catalog
• DR/HA targets per component + break-glass spec
• SOX, GDPR, ISO 27001, NIST 800-63 control mapping

Stack

• HTML5 + CSS (custom design system, IBM Plex Sans/Mono)
• React 18 via CDN (Babel in-browser)
• SVG for all diagrams
• Web component (<deck-stage>) for the deck shell
• No package.json, no node_modules, no build pipeline

Project structure

.
├── IAM Architecture.html          # Main interactive console
├── Runbooks.html                  # 8 operational runbooks
├── IAM Architecture Deck.html     # Stakeholder slides
├── IAM Architecture Print.html    # Print/PDF document
├── styles.css                     # Shared design system
├── deck-styles.css                # Deck-specific styles
├── print-styles.css               # Print document styles
├── deck-stage.js                  # Slide deck web component
└── components/                    # React JSX for the main console
    ├── app.jsx
    ├── shared.jsx
    ├── view-*.jsx                 # One per console view
    ├── runbooks-app.jsx
    └── runbooks-data.jsx

Disclaimer

This is a reference architecture / portfolio piece, not a production specification for any specific organization. Numbers, vendor opinions, and specific design positions are illustrative. Any real implementation should be reviewed against your own security, compliance, and operational requirements.

License

MIT — see LICENSE. Use freely, attribution appreciated.