---
name: identity-to-data-access-protocol
description: Use this skill when an identity lifecycle event (joiner, mover, leaver) or an access request must be evaluated end-to-end across Microsoft Entra identity, Conditional Access policy, and data access governance under a Zero Trust posture. Orchestrates m365-identity-zero-trust-agent as primary and m365-copilot-readiness-governance-agent for data-layer governance. Gates include access review sign-off and least-privilege validation before any access grant is recommended. Does not approve access; all recommendations require human owner confirmation. Never requests credentials, tenant IDs, or customer data.
allowed-tools: Read Grep Glob
metadata:
  author: "github: Raishin"
  version: "0.1.0"
  updated: "2026-06-16"
  category: security
  lifecycle: experimental
---

# Identity to Data Access Protocol

## Purpose
This skill defines how an identity claim — a new hire, a role change, an
external partner request, or a privileged-role activation — is evaluated
against Conditional Access policy and data access governance rules before any
access recommendation is produced. It enforces Zero Trust principles (verify
explicitly, use least privilege, assume breach) across the full access
lifecycle. It does not approve access; it produces a structured recommendation
that a human identity or security owner confirms.

## When to use
- A joiner, mover, or leaver event requires access provisioning or de-provisioning.
- An access request must be assessed against Conditional Access policy and
  least-privilege rules before approval.
- A periodic access review is due for a group, application, or privileged role.
- A Privileged Identity Management (PIM) activation request needs risk context
  before the approver decides.
- Data access governance must be validated before sensitive content is exposed.

## When NOT to use
- The access decision is already made and you only need to execute provisioning
  — use your provisioning runbook, not this protocol.
- The matter is a security incident requiring incident response — route to your
  incident response protocol.
- The identity in question belongs to a non-Microsoft Entra directory — this
  protocol is scoped to Microsoft Entra ID and Microsoft 365.
- You need live tenant configuration changes — escalate to the identity owner;
  this protocol is recommendation-only.

## Participating agents
- `m365-identity-zero-trust-agent` (primary — Entra identity, Conditional Access, PIM)
- `m365-copilot-readiness-governance-agent` (secondary — data access governance, sensitivity label compliance)

## Inputs required
- Identity claim: UPN, identity type (employee, guest, service principal), lifecycle event
- Requested resource or role with business justification
- Applicable Conditional Access policies in scope
- Current group memberships, role assignments, and entitlement packages
- Data classification of the target resource (if data access is in scope)

## Evidence required
- Microsoft Entra tenant has Conditional Access policies configured
- Entitlement management access packages are defined for the relevant resource
- PIM is configured for any privileged roles in scope
- Access review schedule is active for the affected group or application
- Data classification labels (Microsoft Purview) are applied to target resources

## Workflow

1. **Identity verification** — Confirm identity type, lifecycle event, and
   authentication strength. Verify MFA registration and device compliance
   before proceeding.
2. **Conditional Access evaluation** — Map the requested access to applicable
   Conditional Access policies. Identify any policy gaps or exceptions.
3. **Least-privilege check** — Enumerate existing assignments. Identify
   over-privileged roles or group memberships. Flag any permissions not
   required for the stated business purpose.
4. **Gate 1 — Access review sign-off** — If the target resource or role is
   subject to an active access review, confirm the review is current and the
   identity has been attested. Do not recommend access if attestation is
   overdue.
5. **Data governance layer** — Invoke m365-copilot-readiness-governance-agent
   to assess data sensitivity and confirm that the identity's access scope
   does not expose over-shared or unlabelled sensitive content.
6. **Entitlement management** — If access is via an entitlement management
   package, confirm the package policy (approval workflow, expiry, separation
   of duties) is satisfied.
7. **PIM gate (privileged roles only)** — For any privileged role, confirm
   just-in-time activation is in use, the justification is documented, and the
   activation window is bounded.
8. **Gate 2 — Least-privilege validation** — Produce a least-privilege
   attestation: the recommended access grants only the permissions required,
   for only the duration required, with no standing privileged access.
9. **Recommendation** — Produce a structured access recommendation: approve,
   deny, or reduce-scope. Include the evidence basis, open questions, and
   do_not_do_list.
10. **Human confirmation** — Route to the identity owner or security team for
    final approval. This protocol never approves access autonomously.

## Decision gates

| Gate | Condition | Action |
|---|---|---|
| Access review | Review overdue or attestation not current | Block recommendation; flag for review owner |
| Least-privilege | Requested permissions exceed business justification | Recommend reduced scope; escalate to identity owner |
| MFA / device | MFA not registered or device non-compliant | Block recommendation; direct user to remediation |
| Data sensitivity | Target resource contains unlabelled or over-shared sensitive data | Invoke m365-copilot-readiness-governance-agent; hold access recommendation |
| PIM activation | Privileged role requested without JIT justification | Require JIT activation and documented justification |

## Refusal triggers
- Stop if the identity cannot be authenticated to the required assurance level
  — do not produce an access recommendation on an unverified identity.
- Stop if credentials, session tokens, tenant IDs, or customer PII are
  requested — refuse and escalate to the security team.
- Stop if the access request would grant standing Global Administrator or
  equivalent permissions without PIM — this is unconditionally blocked.
- Stop if separation of duties would be violated — escalate to the security owner.

## Handoff rules
- All handoffs carry: identity_id (anonymised), skill_id, skill_version,
  invoked_by, access_scope, evidence_quality, open_questions, do_not_do_list.
- Human escalations always include the least-privilege gap statement and the
  specific Conditional Access policy in scope.
- Data governance findings from m365-copilot-readiness-governance-agent are
  attached as a sub-report; they are never discarded.

## KPIs
- Access review completion rate (% on schedule)
- Least-privilege attestation pass rate
- Mean time to access decision (request to human confirmation)
- PIM just-in-time activation rate for privileged roles
- Over-privilege remediation rate (flagged vs. resolved)

## References
- https://learn.microsoft.com/entra/id-governance/scenarios/least-privileged
- https://learn.microsoft.com/entra/id-governance/access-reviews-overview
- https://learn.microsoft.com/entra/id-governance/deploy-access-reviews
- https://learn.microsoft.com/entra/id-governance/privileged-identity-management/pim-configure
- https://learn.microsoft.com/security/zero-trust/