Skip to main content

Azure Entra ID Tasks

This runbooks page contains guidance on regular tasks that the Platform Operations support role may be expected to perform in relation to Entra ID (Azure AD) and related services.

Add user to Entra ID Group for NOMIS Modernisation Platform SSO

These requests are typically raised via the #ask-digital-studio-ops Slack channel, and should be actioned by the support engineer on duty.

Steps

  • Log into the Azure Portal

  • In user profile (top right) select Switch Directory and select the Ministry of Justice directory from list below. Hit Switch.

  • Select Microsoft Entra ID, and then select Groups from the left-hand menu.

  • In the search bar, add azure-aws-sso-nomis-access and select the group from the results.

  • Navigate to Users, and then select + Add members from the top menu.

  • Drop the provided username in the search bar, tick the checkbox next to the user, and select Select from the bottom menu.

Once added, inform the user that they may have to wait as long as 6 hours for the change to take effect.

NOTE - This approach will only work if the @justice.gov.uk name for the user (e.g. firstname.surname) is less than or equal to 16 characters. If it exceeds 16 characters, it is recommended that you add the user to the ministryofjustice/nomis-access Github team - ask the user to provide their Github ID for this approach. The Github ID must also be 16 characters or less (if this is not the case, point the user to this guide in order to change it.) This approach may also take up to 6 hours in order to take effect. If the user is either working for Syscon, or is a maintainer of the Infrastructure, you would need to consider adding them to a different team than nomis-access - see this guide for more info.

Reset user MFA for App Insights access (HMPPS directory)

If a request lands in the #ask-digital-studio-ops Slack channel to reset a user’s MFA for App Insights access, this can be actioned as follows:

Steps

  • Log into the Azure Portal

  • In user profile (top right) select Switch Directory and select the HMPPS directory from list below. Hit Switch.

  • Search for Microsoft Entra Privileged Identity Management service and select it.

  • Click Tasks on left-hand menu, then select My roles.

  • Select Role Global Administrator and click Activate.

  • Provide a Reason in the freetext box (ie ressetting user MFA for App Insights access) and click Activate.

  • Search for the user in the search bar, select their name, and click Require re-register multifactor authentication.

  • Inform the user that they will be prompted to reset their MFA the next time they log in to App Insights.

This page was last reviewed on 4 September 2026. It needs to be reviewed again on 4 March 2027 .