Define developer platform roles and access model
Implementation Effort: Medium – Designing a unified role model across GitHub, Azure DevOps, and Microsoft Entra ID takes several steps and coordination among platform, security, and identity teams. User Impact: Medium – Developers who held broad roles or shared accounts move to narrower, per-identity access, so the affected subset needs notice about their new permissions. Lifecycle Stage: Govern
Overview
Design a unified permissions and access model across GitHub, Azure DevOps, and Microsoft Entra ID so every human and workload identity has only the minimum access required. Without a deliberate model, organizations accumulate overly broad roles and shared service accounts that allow a single compromised credential to move laterally across repositories, pipelines, and cloud subscriptions.
In GitHub, use teams and repository roles for baseline access. Layer organization rulesets, branch protection, CODEOWNERS, and required pull-request reviews to prevent unreviewed merges. Configure environment protection rules with required reviewers and restrict bypass permissions.
In Azure DevOps, layer project-level security groups, branch-level permissions, and pipeline-scoped service connections. Separate approval workflows for release paths and use scoped credentials instead of shared accounts to prevent lateral movement.
Back both platforms with Microsoft Entra ID to govern sign-in, multifactor authentication, and access reviews. For GitHub organizations that rely on personal accounts plus SAML SSO, Conditional Access does not cover every Git operation or PAT use. Pair Entra controls with GitHub token policies, SSO enforcement, and IP allow lists to close those gaps.
Every pipeline, service connection, and token is a potential pivot point. An intentional permissions model ensures that reading code, merging changes, and deploying to production are distinct privilege boundaries — not capabilities bundled into a single identity. This model embodies Use least privilege access by granting each identity only the minimum it requires, and it reinforces Verify explicitly by backing every sign-in with Microsoft Entra authentication, multifactor authentication, and access reviews.