Skip to main content

Security and Governance

Identity and Access​

  • Microsoft Entra ID (Azure Active Directory) is the identity provider for all platform components.
  • Service Principals with Managed Identities are used for all service-to-service authentication (Notebooks → OneLake, What-If Server → Rating Engine, Pipeline → Azure SQL).
  • Human access to Fabric workspaces follows a least-privilege RBAC model: Viewer, Contributor, Member, and Admin roles assigned at workspace level.

Data Security​

  • OneLake data is encrypted at rest (AES-256) and in transit (TLS 1.2+).
  • Fabric SQL Scenario DB uses Transparent Data Encryption (TDE) and Azure Private Endpoint for network isolation.
  • Rating Engine communication is secured with mutual TLS or API key authentication, depending on the engine's security model.

Compliance​

  • All scenario runs and their outputs are retained with immutable audit records to support actuarial sign-off and regulatory review.
  • Power BI Row-Level Security ensures that analysts and underwriters can only access premium data for their authorised business units and territories.