Configure access management

The step-by-step mechanics for creating groups and registering applications in Microsoft Entra ID live in About identity and access management. This page covers what to do and in what order as part of a new CDF project handoff with Cognite. You can use it as a checklist, then follow the linked Admin guides for each step.

The steps below are written for Microsoft Entra ID. If you use another supported identity provider — for example, Amazon Cognito — the process follows the same order: create IdP groups, invite guest users, register applications, send tenant and group identifiers to Cognite, then register Cognite applications after provisioning. See About identity and access management for provider-specific procedures. Other providers must meet minimum IdP requirements.

This is the identity provider half of Who creates what. Customer IT creates Entra ID groups and application registrations. Cognite provisions the CDF organization after you send tenant and group object IDs. CDF groups with capabilities are created later, when the implementation team installs the Cognite Toolkit and deploys the Foundation deployment pack. When you sign up with Cognite, you’ll receive information about the environment where your CDF project(s) will be hosted. Work through the checklist, collecting the information as you go, and submit it to Cognite when you’re done.

Submit client secrets and other sensitive values through a secure, encrypted channel, for example Yopass — never in plain email or chat.

Collect your Entra ID tenant information

Sign in to the Azure portal as an admin, select Microsoft Entra ID, and note the Primary domain and Tenant ID from the Overview page.

Create your Entra ID groups

Create one security group per row below, following the persona-led naming pattern (see Create groups in Entra ID for the click-through steps), and note each group’s Object Id.

Group name	Group description
`admin_all_prod`	Full administrative access to the production project, including group management.
`producer_all_prod`	Read and write access to all data in the production project, including contextualization and data governance capabilities.
`producer_<type>_prod`¹	Same as `producer_all_prod`, scoped to a specific data set or resource type (for example, `producer_ep_pi_prod` for a PI extraction pipeline).
`consumer_all_prod`	Read access, for dashboard and application use.
`consumer_<type>_prod`¹	Same as `consumer_all_prod`, scoped to a specific data set or resource type.
`admin_all_dev`²	Full administrative access to the dev/test project.
`producer_all_dev`²	Read and write access in the dev/test project.
`consumer_all_dev`²	Read access in the dev/test project.

¹ Only if you scope access below the whole project — see Resource naming conventions for the full token grammar.
² Only if you’re using a dedicated dev/test environment. The dev suffix covers both dev and test.

For a seamless first sign-in, also create a CDF group with view/use capabilities and add all user accounts to it. Caution: every authenticated user automatically becomes a member — scope its capabilities to the minimum required.

Add Cognite and partner users as guests

Add the Cognite/partner users you were given as guest users in your Entra ID tenant:

Solution architects (primary technical contacts) → admin_all_prod, admin_all_dev, producer_all_prod, producer_all_dev.
Other Cognite/partner users → producer_all_prod, producer_all_dev.

Register a separate app in Entra ID for each extractor or tool (for example, one for transformations, one for functions) and add it to the relevant group. Follow Add a service account to a CDF group for the full procedure, using the same persona-led pattern for the app name (for example, producer_pp_prod for a processing pipeline service principal).

Send Cognite your tenant information

Return the domain, tenant ID, and group object IDs you collected to Cognite, through a secure channel.

Once Cognite has provisioned your project, follow Register the Cognite API and applications in Microsoft Entra ID to register the Cognite API and the applications your users need. Then test and verify that users can sign in and access the expected CDF data.