Appearance
Access Matrix
Role-based access control reference for the Microtec ERP platform.
Process: All access requests go through your team lead → Azure DevOps admin
Principle: Least privilege — request only what you need for your role
Review cycle: Access is audited quarterly
Role Definitions
| Role | Description |
|---|---|
| Backend Dev | .NET developer working on ERP/BO backend services |
| Frontend Dev | Angular developer working on MFE apps |
| Mobile Dev | Flutter developer working on BoMobileApp, ERPMobileApps, VanSalesMobileApp |
| DevOps | Platform/infrastructure engineer |
| Architect | Technical lead, system design decisions |
| QA | Test engineer, manual and automated testing |
| Manager | Engineering manager, non-technical oversight |
Azure Portal Access
| Resource Group | Backend Dev | Frontend Dev | Mobile Dev | DevOps | Architect | QA | Manager |
|---|---|---|---|---|---|---|---|
mic-erp-be-dev-* | Reader | — | — | Owner | Reader | Reader | — |
mic-erp-be-stage-* | — | — | — | Owner | Reader | Reader | — |
mic-erp-be-preprod-* | — | — | — | Owner | Reader | — | — |
mic-erp-be-prod-* | — | — | — | Owner | Reader | — | — |
mic-erp-fr-dev-* | — | Reader | — | Owner | Reader | Reader | — |
mic-erp-fr-stage-* | — | — | — | Owner | Reader | Reader | — |
mic-backend-shared-sql-rg | — | — | — | Contributor | Reader | — | — |
| All environments | — | — | — | — | Reader | — | Reader |
Reader = view resources and logs, cannot make changes
Contributor = deploy and configure resources, cannot manage IAM
Owner = full access including IAM management
Azure DevOps Access
| Resource | Backend Dev | Frontend Dev | Mobile Dev | DevOps | Architect | QA | Manager |
|---|---|---|---|---|---|---|---|
| Repos (all) | Contributor | Contributor | Contributor | Admin | Admin | Reader | Reader |
| Pipelines — run | Yes | Yes (frontend only) | Yes (mobile only) | Yes | Yes | Yes (test pipelines) | — |
| Pipelines — edit | — | — | — | Yes | Yes | — | — |
| Pipeline — prod deploy | — | — | — | Yes (with approval) | Yes (with approval) | — | — |
| Boards | Contributor | Contributor | Contributor | Contributor | Admin | Contributor | Admin |
| Artifacts (NuGet) | Read | — | — | Read+Write | Read+Write | — | — |
| Test Plans | — | — | — | — | — | Admin | — |
Azure Container Registry (ACR)
| ACR | Backend Dev | Frontend Dev | DevOps | Architect | QA |
|---|---|---|---|---|---|
micerpbedevacr (dev) | Pull | — | Push+Pull | Pull | — |
micerpbestageacr (stage) | — | — | Push+Pull | Pull | Pull |
micerpbeproductionacr (prod) | — | — | Push+Pull | — | — |
micerpfrdevacr (frontend dev) | — | Pull | Push+Pull | Pull | — |
micerpfrstageacr (frontend stage) | — | — | Push+Pull | Pull | Pull |
SQL Server VM
Access is via SSH and SQL authentication. The SQL VM is in mic-backend-shared-sql-rg.
| Access Type | Backend Dev | Frontend Dev | DevOps | Architect | DBA |
|---|---|---|---|---|---|
| SSH (22) | — | — | Yes (mic-shared-sql) | — | Yes |
| SQL Server (1433) | Dev DB only | — | All DBs | Read-only (all) | All DBs |
| SQL Agent | — | — | Yes | — | Yes |
| sysadmin role | — | — | — | — | Yes |
SSH key for SQL VM: ~/.ssh/mic-shared-sql
SSH user: sqladmin
Host: 20.50.120.95 (via VPN)
Azure Key Vault
| Key Vault | Backend Dev | DevOps | Architect | Security |
|---|---|---|---|---|
mic-erp-be-dev-skv | Get secrets (dev only) | Full access | List+Get | Audit only |
mic-erp-stg-kv | — | Full access | List | Audit only |
mic-erp-be-preprod-skv | — | Full access | — | Audit only |
mic-erp-uat-kv | — | Full access | — | Audit only |
| Production KV | — | Full access (with MFA) | — | Audit only |
[WARNING] Production Key Vault access requires MFA and is logged. Any access without a linked incident or change ticket is flagged for review.
Keycloak Admin Console
| Realm | Backend Dev | Frontend Dev | DevOps | Architect | QA |
|---|---|---|---|---|---|
microtec (dev) | Manage clients | View only | Admin | Admin | View users |
microtec (stage) | — | — | Admin | View | View users |
microtec (prod) | — | — | Admin (read-mostly) | View | — |
businessowner (dev) | View only | — | Admin | Admin | View users |
master realm | — | — | Admin (DevOps lead only) | — | — |
Seq Logging
| Environment | Backend Dev | Frontend Dev | DevOps | QA | Manager |
|---|---|---|---|---|---|
| Dev Seq (localhost:1234) | Full access | Read | Full access | Read | — |
| Stage Seq | — | — | Full access | Read | — |
| Production Seq | — | — | Full access | — | — |
On-Prem Servers
| Server | Backend Dev | DevOps | Architect |
|---|---|---|---|
eg-sv-01 (192.168.120.233) | — | SSH | — |
eg-sv-vip (192.168.120.12) | — | SSH + NPM admin | — |
eg-sv-ai (192.168.120.254) | SonarQube (read) | SSH + admin | SonarQube admin |
| ESXi (192.168.120.207) | — | Admin (DevOps lead only) | — |
| Build agents | — | SSH | — |
VPN required for all on-prem server access.
Monitoring and Alerting
| Tool | Backend Dev | Frontend Dev | DevOps | Architect | Manager |
|---|---|---|---|---|---|
| App Insights (dev) | Read | — | Full | Read | — |
| App Insights (stage) | — | — | Full | Read | — |
| App Insights (prod) | — | — | Full | Read | Read (dashboards) |
| Alert rules | — | — | Full | — | — |
| Action groups (escalation) | — | — | Admin | — | Member |
Requesting Access
Standard request
Submit to your team lead via the internal ticketing system:
Request Type: Access Grant
System: [Azure DevOps / Azure Portal / SQL Server / Keycloak / ...]
Environment: [dev / stage / preprod / uat / prod]
Role: [your role]
Justification: [brief explanation]
Duration: [permanent / temporary (specify dates)]
Approver: [team lead name]Elevated access (stage/prod)
Production access requests require:
- Team lead approval
- Engineering manager approval
- Security team notification
- Time-limited grant (max 30 days) with mandatory review
Emergency access (P0 incident)
For P0 incidents, temporary elevated access can be granted by the on-call DevOps lead without standard approval flow. All emergency access grants must be reviewed and either converted to standard access or revoked within 48 hours of incident resolution.
Access Revocation
Access is automatically reviewed and revoked when:
- Team member leaves the company (immediate revocation)
- Role changes (access adjusted within 5 business days)
- Project involvement ends (access adjusted within 10 business days)
- Quarterly access audit finds excess permissions