Chapter 3 of 6
Confirm these prerequisites:
- The client, middle tier, and downstream API already exist in an approved nonproduction tenant.
- Microsoft Entra application registrations identify the client, middle tier, and downstream API.
- The middle tier exposes its own API audience and User
access_as_userscope. The downstream API exposes a different API audience and the narrow delegated read scope. - The client can sign in users and request a token for the middle-tier audience.
- The downstream API enforces resource authorization for each user.
- The middle-tier host can expose the exportable Key Vault certificate in the certificate binding as a protected PFX path through its approved certificate integration.
- The middle-tier host has the Python runtime dependencies needed to read and verify the mounted PFX.
- A named customer identity owner can approve the client-to-middle-tier and middle-tier-to-downstream delegated permissions and consent.
- The recorded authority decision is signed-in user OBO. Use this module only when the downstream API must authorize the signed-in user. Shared or background work requires an application-only managed identity and does not use this module.
- One permitted user and one user without downstream resource authority are available for the delivery checks.
- Diagnostics can retain correlation, operation, status, error, and duration fields while excluding authorization headers, assertions, tokens, and payloads.
- PowerShell verification requires PowerShell 7 or later.
Complete every __REQUIRED_*__ value under artifacts/. Keep organization-specific copies in the approved private repository or configuration store.
Implementation files#
| Type | File | Consumer |
|---|---|---|
| Record | artifacts/control-definition.json | The preflight and configuration scripts |
| Deployment | artifacts/identity/app-registrations.json | The preflight and configuration scripts |
| Deployment | artifacts/identity/key-vault-certificate-binding.json | The preflight scripts and Python middle tier |
| Record | artifacts/governance/authorization-matrix.md | The identity owner and delivery owner |
| Runtime | artifacts/governance/token-claim-contract.json | The Python middle tier and verification scripts |
| Record | artifacts/governance/threat-model.md | The application security owner and delivery owner |
| Runtime | artifacts/runtime/settings.json | The Python middle tier |
| Runtime | artifacts/runtime/obo_proxy.py | The approved middle-tier runtime |
| Runtime | artifacts/runtime/requirements.txt | The middle-tier build process |
Run preflight before any Microsoft Graph change:
PowerShell
.\scripts\preflight.ps1 -ArtifactRoot (Resolve-Path .\artifacts)Bash
./scripts/preflight.sh --artifact-root "$(realpath ./artifacts)"Preflight reads the current application and service-principal configuration, compares it with the implementation files, and prints the exact change plan. Microsoft Graph does not provide a what-if operation for these application-registration changes, so this read-only plan is the required preview.
The default pre-change phase runs on the operator workstation before the certificate is bound. It reports the certificate state rather than failing on it, because the protected PFX is mounted on the middle-tier host and not on your workstation.