Advi AccessPackages

graph TB
    subgraph ELM["Entra ID — Entitlement Management"]
        direction TB
        subgraph CAT1["Katalog: Advi Ansatte"]
            R1["Basis - Intern"]
            R2["Basis - Konsulent"]
            R3["Basis - MSP Tekniker"]
            R4["Basis - Leder"]
            R5["Basis - Lærling"]
            R6["Basis - Lærling Fagansvarlig"]
        end
        subgraph CAT2["Katalog: MSP"]
            M1["App - Huntress"]
            M2["App - CIPP"]
            M3["App - Hudu"]
            M4["App - Keepit"]
            M5["Alle MSP Kunder"]
            M6["Kunde - ..."]
        end
        subgraph CAT3["Katalog: Konsulent"]
            K1["App - Azure DevOps"]
            K2["App - GitHub Copilot"]
            K3["SWA - ca.advi.no"]
            K4["SWA - secgen.advi.no"]
            K5["SWA - tier.advi.no"]
            K6["Kunde - ..."]
        end
        subgraph CAT4["Katalog: Lab"]
            L1["Lab - Azure Sandbox"]
            L2["Lab - M365 Dev Tenant"]
            L3["Lab - Sikkerhetstesting"]
            L4["Lab - Twingate"]
        end
        subgraph CAT5["Katalog: Lisenser"]
            LI1["Lisens - Copilot"]
            LI2["Lisens - Teams Phone"]
            LI3["Lisens - Visio"]
            LI4["Lisens - Power BI Premium"]
            LI5["Lisens - Power Automate"]
            LI6["Lisens - Windows 365"]
            LI7["Lisens - Project"]
        end
    end

    USER["Ansatt"] -->|"Søker tilgang"| ELM
    ELM -->|"Tildeler"| GRP["Entra ID Grupper
(AP-prefiks)"]
    GRP -->|"Gir tilgang til"| RES["Ressurser
Enterprise Apps · SWA · Teams · SharePoint · Lisenser"]

    style ELM fill:#f8fafc,stroke:#0d3c74,stroke-width:2px
    style CAT1 fill:#eff6ff,stroke:#1e40af
    style CAT2 fill:#f0fdf4,stroke:#166534
    style CAT3 fill:#fef3c7,stroke:#92400e
    style CAT4 fill:#f3e8ff,stroke:#6b21a8
    style CAT5 fill:#fce7f3,stroke:#9d174d
    style USER fill:#0d3c74,color:#fff,stroke:#0d3c74
    style GRP fill:#0693e3,color:#fff,stroke:#0693e3
    style RES fill:#10b981,color:#fff,stroke:#10b981
            

graph LR
    subgraph AP["Access Packages"]
        P1["Basis - Konsulent"]
        P2["App - Huntress"]
        P3["SWA - ca.advi.no"]
        P4["Lisens - Copilot"]
        P5["Lab - Azure Sandbox"]
    end

    subgraph GR["Entra Grupper"]
        G1["AP-Ansatte-Basis-Konsulent"]
        G2["AP-MSP-App-Huntress"]
        G3["AP-Konsulent-SWA-CaAdviNo"]
        G4["AP-Lisens-Copilot"]
        G5["AP-Lab-AzureSandbox"]
    end

    subgraph RES["Ressurser"]
        R1["8 Enterprise Apps
Teams · SharePoint"]
        R2["Enterprise App:
Huntress Portal"]
        R3["Azure SWA:
ca.advi.no"]
        R4["Lisens: M365 Copilot
(gruppebasert)"]
        R5["Azure RBAC:
Sandbox Subscription"]
    end

    P1 --> G1 --> R1
    P2 --> G2 --> R2
    P3 --> G3 --> R3
    P4 --> G4 --> R4
    P5 --> G5 --> R5

    style AP fill:#eff6ff,stroke:#1e40af
    style GR fill:#f0fdf4,stroke:#166534
    style RES fill:#fef3c7,stroke:#92400e
            

graph LR
    A["Tilgang tildelt"] --> B["Review-periode starter"]
    B --> C{"Reviewer svarer?"}
    C -->|"Godkjent"| D["Tilgang beholdes"]
    C -->|"Avslått"| E["Tilgang fjernes"]
    C -->|"Ikke svart"| F{"Auto-fjern
aktivert?"}
    F -->|"Ja"| E
    F -->|"Nei"| G["Eskalering til admin"]
    D --> H["Neste review-syklus"]
    H --> B

    style A fill:#0d3c74,color:#fff
    style D fill:#10b981,color:#fff
    style E fill:#ef4444,color:#fff
    style G fill:#f59e0b,color:#fff
            

graph TB
    subgraph LCW["Lifecycle Workflows (bruker-side)"]
        direction TB
        J["Joiner
Ny ansatt starter"] --> AT["Tildel basispakker
basert på department + jobTitle"]
        MV["Mover
Bytter avdeling"] --> ADJ["Fjern gammel basis
Tildel ny basis"]
        LV["Leaver
Ansatt slutter"] --> RM["Fjern alle tilganger
Deaktiver konto"]
    end

    subgraph EG["Event Grid + Logic Apps (ressurs-side)"]
        direction TB
        NG["Ny AP-gruppe
oppdaget"] --> LA1["Logic App:
Opprett Access Package"]
        NA["Ny Enterprise App
registrert"] --> LA2["Logic App:
Foreslå katalog + pakke"]
        NL["Ny lisens-SKU
aktivert"] --> LA3["Logic App:
Opprett lisenspakke"]
        LA1 --> AC["Teams Adaptive Card
Godkjenning"]
        LA2 --> AC
        LA3 --> AC
    end

    subgraph GAC["Governance as Code (git)"]
        direction TB
        GIT["Git repo
access-governance/"] --> PR["Pull Request
Review + validering"]
        PR --> PIPE["Azure DevOps Pipeline
terraform plan / apply"]
        PIPE --> ENTRA["Entra ID
oppdateres"]
        DRIFT["Nattlig drift-sjekk"] --> DIFF["Avviksrapport
git vs. Entra"]
    end

    AT --> ENTRA
    ADJ --> ENTRA
    RM --> ENTRA
    AC -->|"Godkjent"| ENTRA

    style LCW fill:#eff6ff,stroke:#1e40af
    style EG fill:#fef3c7,stroke:#92400e
    style GAC fill:#f0fdf4,stroke:#166534
    style ENTRA fill:#0d3c74,color:#fff,stroke:#0d3c74
    style AC fill:#0693e3,color:#fff,stroke:#0693e3
            

graph LR
    A["Behov oppstår"] --> B["PR i git
(endre JSON)"]
    B --> C["Pipeline: validate
Sjekk JSON, navnestandard,
at grupper eksisterer"]
    C --> D["Code review
IT godkjenner"]
    D --> E["Merge til main"]
    E --> F["Pipeline: deploy
Graph API / Terraform"]
    F --> G["Entra oppdatert"]
    H["Nattlig drift-sjekk"] --> I{"Avvik?"}
    I -->|"Ja"| J["Rapport + varsel"]
    I -->|"Nei"| K["Alt OK"]

    style A fill:#f8fafc,stroke:#64748b
    style B fill:#eff6ff,stroke:#1e40af
    style C fill:#fef3c7,stroke:#92400e
    style D fill:#f3e8ff,stroke:#6b21a8
    style F fill:#0d3c74,color:#fff,stroke:#0d3c74
    style G fill:#10b981,color:#fff,stroke:#10b981
    style J fill:#ef4444,color:#fff,stroke:#ef4444