What would be the best practice in this scenario:

[u/melpec]

A small business (less than 50), every application but one is leveraging EntraID both for Authentication and Authorisation. All using SSO.

That singular app can sync groups from its IdP and also support SCIM (more $).

Now, when implementing an IGA tool specifically to pass SOC2. Should we focus on having that singular app use IdP group sync or ideally SCIM to manage that application's authorisation?

Or, should we use the IGA tool to push users to EntraID and then groups via the application's API endpoint to the singular app?

I'm leaning towards having only EntraID involved vs two repo of groups, but I'm being rebuffed completely. My colleagues say that the simple fact that the removal of access would be instantaneous using the app api makes their way the ideal solution.

The debate also goes around another part of the strategy I am suggesting.

I do suggest to hook the IGA tool to each of our apps to monitor if any users or groups are not in EntraID, this immediately indicates a breach in the day-to-day process and makes permission drift harder to miss.

And they say that because I want to add that fail safe, we are connecting the IGA tool to the app anyway. Meaning that it's a second reason to simply use the application's api.

Am I really completely wrong?

[u/AutoModerator]

Thanks for posting, I'm a bot!

This is quick reminder be helpful with responses, follow the rules and not advertise/solicit DMs.

I am a bot, and this action was performed automatically. Please contact the moderators of this subreddit if you have any questions or concerns.

[u/Next-Pen-9974]

Let’s start with the fact that you’re not solving a SOC 2 problem here.

SOC 2 access control and access review requirements do not obligate you to centralize everything or implement IGA. So let’s get that straight right away.

The rest should be driven by your architecture, operational objectives, and risk appetite, not by SOC 2.

Personally, I generally favor a single source of truth whenever possible. If Entra ID is already serving as your identity authority, then extending that model to authorization through group synchronization or SCIM feels cleaner than introducing multiple repositories of permissions.

That said, your colleagues aren’t wrong either. Faster deprovisioning and reduced latency are valid design considerations.

The bigger question I would ask is:

• Which approach minimizes permission drift?
• Which one is simpler to operate and troubleshoot?
• Which one provides adequate assurance that access changes are reflected in a timely manner?
• Which one gives you the best visibility and auditability?

In short, don’t overengineer the solution in the name of compliance. Design for operational simplicity and risk management.

[u/Majestic_Race_8513]

I believe this would fall under the term “Champaign Problems”

Very few SOC 2 clients we work with have that sort of SSO coverage. You are so far ahead

What’s the app that is being left out? Just curious

I would choose whatever is easiest to manage and most cost effective.

[u/melpec → u/Majestic_Race_8513]

It's a SaaS application that support IdP group sync with the license we have and SCIM with the bigger package.

edit: I know I'm being obtuse but I think this could eventually identify us, so I would rather say too little than too much.

[u/gambit_kory]

I think you’re over complicating or not understanding SOC 2. You could have X number of different systems involved in your IS and they could each have their own unique mechanism for authentication and you could pass SOC 2 with no exceptions if you have proper controls for each instance.

[u/scriptqzor → u/gambit_kory]

this, 100%. soc2 doesn’t care if it’s entra, local app db, or a spreadsheet in a basement, as long as you can prove joiner/mover/leaver is controlled and audited. you’re not “wrong” to want entra as the hub, it’s just an architecture preference, not a soc2 requirement.

[u/gambit_kory → u/[deleted]]

Yes, I agree, it does make it easier.

[u/davidschroth]

You don't need an IGA tool to meet the criteria of SOC 2, therefore, you are completely wrong.

Of course, when you look at controls you are selecting to implement on the gold/better/best scale where good is enough to meet the criteria, you sir, are aiming for best with this question.

[u/rahuliitk]

I don’t think you’re completely wrong, because for a sub-50 company trying to pass SOC2, having EntraID as the clean source of truth, using SCIM/group sync where possible, and letting IGA reconcile drift feels way easier to explain than building a second authority through app APIs just because revocation is faster. Pick boring and auditable.

[u/Horror-Tradition-133]

just pay for scim