I85PREP
⌘ K
OCI Multicloud Architect Associate study materials
OCI Multicloud Architect Associate study resources

OCI Multicloud Architect Associate: Identity and Access Management Across Clouds

OCI Multicloud Architect Associate · Work through your exam, one topic at a time.

All guide sections

Identity and Access Management Across Clouds

Identity and Access Management Across Clouds

This domain tests authentication and authorization across OCI and other clouds. The key idea: federation gives users one sign-in, but each cloud still authorizes actions with its own policy system. You must map identity to permissions deliberately.

Core rules and concepts

  • OCI IAM identity domains support SAML 2.0 federation with Microsoft Entra ID, Google Workspace, or another IdP, and SCIM for user and group lifecycle. Federation authenticates; OCI policies authorize.
  • OCI policies are written for a subject (group or dynamic group), verb, resource type, and compartment, for example Allow group OCI-DB-Admins to manage db-systems in compartment Prod. Dynamic groups match instances or functions by rule, enabling instance principals without stored keys.
  • Azure uses Microsoft Entra ID plus Azure RBAC roles at subscription, resource group, or resource scope. Google Cloud uses Cloud Identity and IAM roles at organization, folder, project, or resource scope. These are separate authorization planes.
  • Oracle Database@Azure integrates with Entra ID and Azure RBAC for service administration, while database privileges remain Oracle database privileges. Do not assume an OCI IAM policy controls an Azure-provisioned resource, or vice versa.
  • Enforce MFA and conditional access at the IdP; use break-glass local accounts sparingly, with MFA and vaulted credentials. Separate cloud administration from database administration.

Worked example

A company federates Entra ID to an OCI identity domain. The Entra group OCI-DB-Admins is mapped to an OCI group of the same name. An OCI policy grants that group manage db-systems in compartment Prod. The same staff get an Azure RBAC role to operate Oracle Database@Azure resources, but they receive no Oracle SYSDBA privilege; DBAs grant those separately. The reasoning: one sign-in, two authorization models, least privilege in each.

Traps

Assuming federation replicates group permissions; expecting SCIM to remove access instantly when a user leaves; granting tenancy-admin to avoid mapping groups; using personal accounts for break-glass; conflating Azure RBAC with Oracle database roles; and forgetting that dynamic groups are rule-based, not manually maintained.