Stage 02 · Day 0 federation · IDENTITY

OCI IAM and Microsoft Entra ID Federation

Entra ID – OCI IAM Federation Recommendations (v1.0)

Source architecture document: identity planes, domain topology, SCIM, OIC OAuth2, ATP access, Vault and the build sequence. Use as the Day 0 working template.

DOCX · 786 KB

Download template

Use this Day 0 workstream to federate Microsoft Entra ID with OCI IAM Identity Domains for human access to Fusion, OIC, OAC, OCI Console and ATP administration, while keeping integration and database service identities independent of Entra.

Core decision.Human sign-in and machine-to-machine authentication are separate identity planes. Entra is in the human SSO path; OIC-to-Fusion OAuth2 and OIC-to-ATP mTLS must continue when Entra is unavailable.

Two identity planes

Aspect	Human plane	Machine plane
Users	Employees, partners and administrators	OIC integrations, batch jobs and service accounts
Protocol	SAML 2.0 or OIDC through Entra ID	OAuth2 client credentials or JWT; mTLS for ATP
Credential source	Entra ID, provisioned to OCI domains with SCIM	Environment-local confidential apps, wallets and credentials in OCI Vault
Targets	Fusion UI, OIC/OAC consoles, OCI Console and ATP administration	Fusion REST/SOAP APIs and ATP data services
Failure behaviour	Federated sign-in pauses if Entra is unavailable; break-glass remains available	Integrations continue without an Entra runtime dependency

One trust boundary per environment

Create or confirm one OCI IAM Identity Domain for each Fusion environment and pair it with exactly one Entra enterprise application. Dev1, Dev2, Dev3, Dev4, Test and Production retain independent SAML certificates, Conditional Access policies, OAuth applications, ATP wallets and audit trails.

Keep the Default domain outside workforce federation and reserve it for two vaulted, MFA-protected and alarmed break-glass administrators.

Use one Entra identity provider per domain. If the issuer already exists, update the provider rather than adding a duplicate.

Use environment-specific names such as DOM-<ENV>, CB-OCI-<ENV>, OCI-<ENV>-<ROLE> and svc-oic-<env>-fusion.

Human bridge — SAML, SCIM and authorization

Import the environment enterprise app metadata into its OCI domain, require signed SHA-256 requests and assertions, and use userPrincipalName in email format as NameID.

Provision only assigned users and groups through SCIM. Disable JIT. For workers, retain HCM → Entra → SCIM → OCI domain as the authoritative lifecycle.

Require MFA everywhere. Apply baseline Conditional Access in non-production and strict compliant-device, legacy-auth blocking and PIM-approved administration in Production and platform domains.

Bind each Fusion pod and OIC/OAC console to its environment domain, but keep Fusion job, duty, data roles and segregation of duties under the Fusion security owner.

Machine bridge — OIC, Fusion and ATP

Register a confidential OAuth2 application in each environment domain for OIC-to-Fusion. Use client credentials for system calls and JWT user assertion only when a named-user context is required.

Grant only the Fusion REST or SOAP scopes required by each integration. Do not use a person’s federated identity or basic authentication where OAuth is available.

Use IAM database authentication and short-lived tokens for human ATP access. Use a private endpoint, mTLS wallet and least-privileged database account for OIC and application access.

ATP guardrail.Use ATP for integration staging, cross-reference and approved custom persistence—not as a Fusion backing store, and do not replicate Fusion transactions outside the governed FDI path.

Secrets, monitoring and assurance

Keep OAuth secrets, signing keys, ATP wallets, database credentials and TLS certificates in OCI Vault with customer-managed keys. Read them at runtime through resource principals or dynamic groups and rotate every 90 days.

Track certificate expiries and rotate per environment on a staggered schedule. Stream domain sign-in and Cloud Guard events to the SOC/SIEM.

Certify access quarterly across both planes: OCI/domain groups plus Fusion roles and segregation-of-duties assignments. Time-box and re-attest partner access.

Stage 02 build sequence

Order	Day 0 action	Completion evidence
1	Prove two local break-glass administrators	Successful MFA sign-in, vaulted credentials and tested login alert
2	Create or confirm per-environment domains and Entra apps	Approved mapping, SAML metadata, SCIM and group-to-role evidence
3	Apply MFA, Conditional Access and PIM	Positive and negative access tests for non-production and Production
4	Bind Fusion and configure OIC OAuth2	Fusion/OIC SSO and scoped API invocation without personal credentials
5	Configure ATP IAM and mTLS access	Human token login and private service connection from approved subnets
6	Enable Vault rotation, audit and certification	Rotation schedule, SIEM events and access-review calendar

Pathfinder.Prove the complete pattern on Dev1, including a deliberate fallback to the previous identity provider. Roll out to Dev2–Dev4 and Test before Production, which must use a controlled change window.

Source baseline

Entra, OCI, Fusion, OIC and ATP Federation Recommendations

v1.0 advisory draft

Validate scopes, group names and Fusion pod-to-domain binding against the current tenancy and Oracle guidance before implementation.

Entra_OCI_Fusion_OIC_ATP_Federation_Recommendations_v1.0_1.docx

OCI IAM with Microsoft Entra ID Tutorials

Step-by-step Word guide for SSO, identity lifecycle management, SCIM and just-in-time provisioning between OCI IAM and Microsoft Entra ID.

DOCX · 3104 KB

Download template

OCI IAM with ADFS Tutorials

Step-by-step Word guide for SAML single sign-on and just-in-time provisioning between OCI IAM and Microsoft ADFS.

DOCX · 2732 KB

Download template

Entra ID – OCI, Fusion, OIC and ATP Federation Recommendations (v1.0)

Architecture recommendations covering human and machine identity planes, per-environment federation, SCIM, OAuth2, ATP access, Vault and delivery sequencing.

DOCX · 716 KB

Download template

Entra SSO and SCIM — Production Fusion Domain (v1.0)

Production implementation procedure for Microsoft Entra single sign-on and SCIM provisioning into a Fusion identity domain.

DOCX · 35 KB

Download template

OCI IAM with Okta Tutorials

Step-by-step Word guide for SSO, SCIM identity lifecycle management and just-in-time provisioning between OCI IAM and Okta.

DOCX · 2019 KB

Download template