When planning for an Identity Panel service upgrade it is important to follow standard Change Management protocol (e.g. ITIL).
In most organizations this includes preparing a CAB submission, for which the Identity Panel Upgrade Change Template has been prepared, with links to the SoftwareIDM Panel Tools and Upgrade guidance.
Prior to commencing such a change, it is vital that a suitable Risk Management methodology is adopted to identify and mitigate risks.
To protect our customers we have adopted the (PDF) Microsoft Solutions Framework Risk Management Discipline (researchgate.net) approach to prepare a starting point for undertaking this process.
Risk Assessment Template
| Risk Identifier | Risk Source | Risk Condition | Risk Consequence | Risk Probability | Risk Impact Classification | Risk Impact | Risk Exposure | Risk Mitigation |
| R01 | Azure AD | Authentication Failure - no MFA | Rollback Upgrade or require MFA for users | 1% | very high | 10 | 0.1 | Upgrade to latest IdP Release: • Previously the Identity Panel app registration requested the Group.Read.All permission to resolve group claim values for users with more membership than could be passed in the OIDC token. • Currently the IdP app registration no longer requests this permission, and it no longer redeems an access token • The redemption caused an error because MS started enforcing MFA for that API endpoint • The new version of IdP uses an app id and client secret in the security settings to make the API call. This means it no longer needs to use the delegated application permission which forces MFA ○ caused an error for some customers that were permitting Azure authentication without MFA |
| R02 | MongoDB | Data upgrade fails | Remediate or Rollback Upgrade | 5% | medium | 5 | 0.25 | Prepare for rollback and re-run • Take a database backup for the existing service • Retain the existing version on a separate app service until after the migration is completed |
| R03 | Azure AD | Client Secrets invalidated | Re-enter credentials | 10% | very low | 1 | 0.1 | Have all client secrets on-hand prior to commencement of upgrade |
| R04 | Identity Panel | PowerShell tasks fail | Replace with (verified) QA version | 20% | low | 1 | 0.2 | IdP version 6.x uses PowerShell 7 Core • When implemented in QA some workflows failed • Remediation was to use separate PS v5 session • New PS code to be included in deployment plan Upgrade QA to latest IdP build • New version has As Built doc to assist location of all PowerShell tasks |
| R05 | App Service | Failure to relocate to dedicated App Service | Rollback Upgrade | 2% | very low | 10 | 0.2 | While SIDM have performed this process successfully many times, be prepared for rollback and re-run • Take a database backup for the existing service • Retain the existing version on a separate app service until after the migration is completed |
| R06 | Identity Panel | Unexpected results | Troubleshooting and remediation | 20% | low | 5 | 1 | SIDM Best practice is to implement Test Panel for automated regression testing • Customer requires Test Panel license • Customer required to write test cases • Customer maintains strict PROD and NON-PROD alignment • Customer adheres to strict change migration program (non-prod -> prod) |
| R07 | Identity Panel | Customer delays upgrade | Non-compliance | 50% | very high | 10 | 5 | Customer commits to ongoing upgrade program |
Comments
0 comments
Please sign in to leave a comment.