Azure Tenant Isolation and Privileged Access for a Cloud Data Platform
Every cross-customer data path closed, and support engineers reach customer workspaces only through time-limited, approved access.
Client name withheld by agreement- Client
- Cloud data and analytics platform, 1,100 enterprise customers
- Region
- Columbus, Ohio
- Year
- 2026
- Duration
- 12 weeks
- Scope
- 1,100 customer workspaces · 6,800 managed identities · 3 Azure regions
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A cloud data and analytics platform runs isolated workspaces for 1,100 enterprise customers on Azure, each with its own storage, compute and pipelines. Customers in banking and healthcare had begun asking for proof that their data could not be reached from another customer’s workspace.
Growth had outpaced design. Shared managed identities served several workspaces, some storage was reached with long-lived shared access signatures, and support engineers held standing contributor rights across production.
What we did
The approach, step by step.
- 01
Isolation tested from the inside
We started inside one customer workspace and tried to reach others through managed identities, storage tokens, shared compute and the platform’s own control plane, documenting every path that worked.
- 02
Identities scoped per customer
6,800 managed identities were split so that each serves a single workspace, and shared access signatures were replaced with identity-based access and short expiry.
- 03
Network paths closed
Storage accounts and key vaults moved behind private endpoints with public access disabled, and workspace subnets were limited to the services they need.
- 04
Support access just in time
Standing contributor rights were removed. Engineers request time-bound access through Entra Privileged Identity Management, tied to a customer support case and recorded.
Outcomes
What changed, in numbers.
- 9
- cross-customer access paths closed
- 6,800
- managed identities scoped to one workspace
- 0
- standing production admin roles
- 100%
- of support access linked to a customer case
Our banking customers stopped asking for exceptions in their security reviews. The isolation answers were already in the packet.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Boston, Massachusetts · 16 weeks
AI, Cloud & Digital Trust · 2024SOC 2 Type II with Evidence Built into ServiceNow Change RecordsAn unqualified Type II report with zero exceptions, and change-management evidence that now collects itself.
-
New York, New York · 20 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Commercial Underwriting AI PlatformDoctored broker submissions no longer steer risk rankings, and an AI management system is on track for its certification audit.
-
Pittsburgh, Pennsylvania · 22 weeks
AI, Cloud & Digital Trust · 2025Multi-Cloud Security Guardrails for a Regional Health SystemClinical imaging and analytics in two clouds under one set of guardrails, with no change to how radiologists read studies.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.