Session Abstract

Most organisations cannot answer two questions about their own source code: what protects it, and who can reach it. Rulesets exist in some repositories and not in others, and they are never the same everywhere. Access granted to code only ever accumulates and is never revoked, and managing that is a manual task that falls to "someone". Fixing this changes how people work, and that is where the protection comes from. Every change to protection is reviewed before it applies, and every grant of access is approved by a second person. Nothing depends on anyone remembering how things are supposed to be. Mistakes and omissions are captured and corrected. No drift and no inappropriate access! This session walks through a working implementation of two engines, using IaC and GitHub Actions with a supporting act by Entra ID. The first declares rulesets as code, compares them against live configuration for drift, and realigns repositories automatically to adhere to the rules. It blocks. The second reports who has access to what code, with warnings when something is out of line. A team member can request access to a code base and a colleague approves it, with the grant applied automatically. Revoking access happens immediately, with no approval at all. Expect live configuration, real code, and the things that broke on the way. You leave with a model where protection survives the first time it is inconvenient, and where the answer to who can reach your code is a report rather than a screenshot.

Magnus Mårtensson

Magnus Mårtensson is an entrepreneur, a Microsoft Most Valuable Professional (MVP) for Azure since the start of the cloud, and a Microsoft Regional Director (RD). He is a consultant, architect, product development lead, and he runs his own company Loftysoft. As an international speaker Magnus travels the world to teach, network, learn, and experience. His passions include connecting with audiences and organizing conferences such as CloudBurst and GlobalAzure. He is of course also very into good food, wine, and great company. Topping it all is mind-sharing, so when you see him at a conference, come over and say hi!