Signed updates on the ring you choose
Pro: each update signed by Invardia, approved by a person before it reaches your ring, and installed between runs by the product itself.
Purpose
Updating a tool that writes Conditional Access should never be a manual project, and never a surprise.
Design
The update job checks the release of your ring, checks that Invardia signed it, builds it in your own registry and installs it only between runs, then reads every part back. A release reaches the later rings only after it has run on the earlier ones and a person at Invardia has approved it.
Business opportunities
You stay current without a maintenance window, with a record of which version runs and who approved it.
Related features
A hybrid worker for Active Directory
Tags of AD-synced users are written in Active Directory by a small worker that only connects out and has no password.
Jobs on your schedule
Every job runs on the schedule you set - daily, weekly or every few hours - with Preview and Apply on demand.
Alert mail from one mailbox only
Alerts are sent from a shared mailbox that the engine may send as - and no other mailbox in the tenant.
Runs in your Azure, one identity per part
Container Apps jobs, a web app and an Azure SQL database in your subscription, each part on its own managed identity with only its own rights.