Enterprise Architecture Explorer™
The capability domains that determine whether change stays predictable
Most modernization difficulty traces back to a small number of capability domains that were never established properly. Select a domain to see the business value it produces, the concepts it depends on, and where it constrains everything else.
Enterprise Architecture Explorer™
Select a capability to see how it is designed and governed
Nine capability domains, each with the business value it produces, the architecture concepts it depends on, example Microsoft services, its dependencies on other domains, and the practices that keep it durable.
Identity
Identity is the primary control plane of a modern estate. Every other domain depends on knowing who is acting, on what device, with what entitlement, for how long.
Business value
- Reduces the standing privilege that turns an incident into a breach
- Makes access decisions reviewable and reportable
- Removes duplicate directories that block consolidation
Architecture concepts
- Single authoritative identity source with automated lifecycle
- Conditional access based on user, device, and risk signals
- Just-in-time elevation instead of permanent administrative rights
- Periodic access review with documented outcomes
Example Microsoft services
Microsoft Entra ID
Directory, authentication, and conditional access
Entra ID Governance
Access reviews, entitlement management, lifecycle workflows
Entra Privileged Identity Management
Time-bound elevation and approval for administrative roles
Services are referenced descriptively for architectural context. EAX Systems is a verified member of the Microsoft AI Cloud Partner Program; membership does not imply Microsoft endorsement, a Solutions Partner designation, or certification.
Dependencies
- Authoritative HR or student record source
- Network and device management for signal quality
Best practices
- Consolidate directories before migrating workloads
- Eliminate shared administrative accounts before adding new controls
- Express access policy as configuration, not documentation