StaffSecurityIdentity

Design a Global Identity and Access Management System

A Staff-level walkthrough of a globally distributed identity and access platform that authenticates 1B+ users and 10B+ logins a day across OAuth 2.0, OpenID Connect, and SAML. It trades stateless JWT validation against real-time revocation, with conditional access scoring risk on every sign-in behind a 99.999% availability target. Follow it top to bottom, or jump to any step.

Level: Staff
Category: Identity · Security
Interview time: 45 min

100% free · No login required

WHAT THIS QUESTION TESTS

·Stateless JWT validation done locally vs. revoking a token already issued

·Conditional access: risk signals gate access on every authentication

·Multi-protocol support and B2B/B2C cross-tenant federation

·Token caching: client-side access tokens plus cached signing keys

★ STAFF-LEVEL SIGNALS

★Picks JWT for stateless scale, then closes the revocation gap with Continuous Access Evaluation

★Treats conditional access as the security core — impossible travel, leaked creds, device compliance feed policy

★Justifies an eventually-consistent global directory over ACID SQL to hit 99.999% availability

★Layers token lifetimes (1h access + 90d refresh) to balance security, UX, and auth-server load

Requirements

Functional Requirements

Authentication: Verify user identity via password, MFA, passwordless (FIDO2), SSO
Authorization: Role-based access control (RBAC), attribute-based access control (ABAC)
Token management: Issue, validate, refresh, and revoke JWT tokens
Multi-protocol: OAuth 2.0, OpenID Connect, SAML 2.0
Conditional access: Policies that evaluate risk before granting access
Cross-tenant: B2B (invite external users), B2C (customer identity), federation
MFA orchestration: Step-up authentication for sensitive operations

Non-Functional Requirements

Latency: Token validation < 5ms (cached); token issuance < 500ms
Availability: 99.999% (identity is the foundation — if auth is down, everything is down)
Scale: 1B+ users, 10B+ authentications/day
Security: Zero tolerance for auth bypass vulnerabilities

Architecture

┌──────────┐ OAuth/OIDC/SAML ┌──────────────────┐

│ Client │───────────────────▶│ Identity │

│ (app/web) │ │ Provider (IdP) │

└──────────┘ └────────┬──────────┘

│

┌───────────────┼───────────────┐

│ │ │

┌─────┴──────┐ ┌──────┴──────┐ ┌─────┴──────┐

│ Directory │ │ Token │ │ Policy │

│ Service │ │ Service │ │ Engine │

│ (users, │ │ (issue, │ │ (conditional│

│ groups, │ │ validate, │ │ access) │

│ roles) │ │ refresh) │ │ │

└────┬──────┘ └─────────────┘ └────────────┘

│

┌────┴──────┐

│ Azure │

│ Cosmos DB │

│ (global │

│ user dir)│

└───────────┘

Deep dives

WHERE STAFF IS WON

Deep Dive 1: Authentication Flows

OAuth 2.0 Authorization Code Flow (web apps):

1. User clicks "Sign in" → redirect to login.microsoftonline.com

2. User authenticates (password + MFA if required)

3. IdP returns authorization code to app's redirect URI

4. App exchanges code for tokens (access_token + id_token + refresh_token)

5. App uses access_token to call APIs

Client Credentials Flow (service-to-service):

1. Service authenticates with client_id + client_secret (or certificate)

2. IdP issues access_token (no user context)

3. Service calls target API with token

Device Code Flow (devices without browser — TV, IoT):

1. Device displays code: "Enter ABCD-1234 at microsoft.com/devicelogin"

2. User enters code in browser on another device, authenticates

3. Device polls IdP until user completes authentication

4. IdP issues tokens to device

Deep Dive 2: Conditional Access Policies

Evaluated on EVERY authentication — the security brain of the system.

Policy example:

IF user.risk_level == "high" // Identity Protection risk score

AND device.compliance == false // Intune MDM check

AND location NOT IN trusted_network // Named locations

THEN

REQUIRE multifactor_authentication

AND BLOCK file_download // Allow web access but no downloads

AND SESSION max_duration = 1_hour // Shorter session

Risk signals:

Sign-in risk: Impossible travel (login from NYC and Tokyo within 1 hour), known malicious IP, anonymous proxy, password spray detection
User risk: Leaked credentials detected on dark web, anomalous behavior pattern
Device risk: Non-compliant device, jailbroken/rooted, outdated OS

Deep Dive 3: Token Management and Caching

Token types:

Access token (JWT): Contains claims (user, roles, scopes). Short-lived: 1 hour. Validated locally by resource server (no network call — just verify JWT signature).
Refresh token: Long-lived (90 days). Used to get new access tokens without re-authentication.
ID token: Contains user profile info. Used by client app only (not sent to APIs).

Token caching strategy:

Client-side: Cache access token until expiry (1 hour)

→ 90% of API calls use cached token (no auth round-trip)

→ On expiry: use refresh token to get new access token (1 round-trip)

→ On refresh token expiry (90 days): full re-authentication required

Server-side: Cache token validation keys (signing keys)

→ Download from well-known endpoint: /.well-known/openid-configuration

→ Cache signing keys for 24 hours

→ Token validation = verify JWT signature locally (< 1ms)

Token revocation (the hard problem):

JWTs are stateless — can't "revoke" a token that's already issued
Solution: Continuous Access Evaluation (CAE)
Resource servers check token validity against IdP on critical events
Events: password change, user disabled, device non-compliant
Within 1 minute of revocation event, token is no longer accepted

Tradeoffs

Decision

Option A

Option B

Choice

Token format

Opaque (server lookup)

JWT (stateless validation)

JWT (scale, no auth server bottleneck)

Token lifetime

Short (1 min, secure)

Long (24 hours, fewer round-trips)

1 hour + refresh (balance)

MFA enforcement

Always (most secure)

Risk-based (better UX)

Risk-based + always for sensitive ops

Directory backend

SQL (ACID)

Cosmos DB (global, eventually consistent)

Cosmos DB (global presence required)

Protocol support

OAuth 2.0 only

OAuth + SAML + WS-Fed

All (enterprise interop required)

Token revocation

Short TTL only

CAE (Continuous Access Evaluation)

CAE (real-time revocation)

Monitoring

Authentication success rate: Alert if < 98% (may indicate brute force or outage)
MFA completion rate: Alert if < 90% (UX issue or attack)
Token issuance latency p99: Alert if > 2 seconds
Conditional access policy evaluation time: Alert if > 100ms
Failed sign-in patterns: Detect password spray, credential stuffing
Risky sign-in volume: Alert if spike in high-risk detections

★

Rubric — Senior vs Staff

Dimension

Senior signal

Staff signal

Token strategy

Issues JWTs and validates signatures locally on the resource server.

Chooses JWT for scale, then addresses the revocation gap with CAE and short TTLs.

Authorization model

RBAC with roles and scopes carried in the token.

Layers ABAC and conditional access; policies consume real-time risk signals.

Availability

Replicates the user directory across regions.

Targets 99.999% and defends an eventually-consistent global store over ACID SQL.

Protocols & federation

Implements OAuth 2.0 and OpenID Connect.

Adds SAML/WS-Fed plus B2B/B2C federation for enterprise interop.

Security posture

Requires MFA at sign-in.

Risk-based step-up MFA, anti-bypass design, and monitoring for spray and credential stuffing.

★ MORE WALKTHROUGHS

Want more breakdowns like this?

Join free early access for upcoming RAG, LLM eval, agents, and AI infrastructure walkthroughs.

Join Free Early Access →