Microsoft Entra ID
Microsoft Entra ID is the starting point for most HMCTS Platform access.
Users must exist in the HMCTS tenant before they can be added to access groups.
Users with an @hmcts.net account usually already exist in the tenant. Users with a @justice.gov.uk account must be invited as guest users first, otherwise the azure-access pipeline will fail because the user account does not exist.
Guest invitation for justice.gov.uk users
An existing teammate should:
- Create a pull request in azure-access guest_user_invite.yml.
- Get the pull request approved by Platform Operations.
- Ask the user to accept the automated Microsoft invitation email after the pull request is merged.
See this example guest invite pull request.
Microsoft Entra ID groups
An existing teammate should create a pull request in azure-access prod_users.yml.
Get the pull request approved by Platform Operations.
The first user in a team should raise a #platops-help request with the required groups.
Before access is added, send the Acceptable Use Policy to the new starter.
Then add the required groups:
# For hmcts.net users, username is the part before @, e.g. mary.jayne
# For justice.gov.uk users, username is the full email, e.g. mary.jayne@justice.gov.uk
- name: username
groups:
- DTS CFT Developers # or DTS SDS Developers for SDS teams. Skip this if the user only needs GitHub.
- DTS GitHub Access # if the user needs GitHub
- <your-team-group> # check other team members to find the group
Common access groups
| Group | Provides access to |
|---|---|
DTS CFT Developers |
CFT developer access, Azure resources, VPN, application logs, LaunchDarkly and Docker Business eligibility |
DTS SDS Developers |
SDS developer access, Azure resources, VPN, application logs, LaunchDarkly and Docker Business eligibility |
DTS GitHub Access |
HMCTS GitHub organisation access |
DTS Docker Hub |
Docker Business eligibility where wider developer access is not needed |
<your-team-group> |
Team-specific Azure and application access |
Security clearance access package
Being a member of the DTS CFT Developers or DTS SDS Developers groups lets you request the security clearance access package.
Request the access package when you join.
Security clearance is required for access to sensitive resources such as production environments.
The access package expires after one year, so you must re-request it after one year.
There are checks in place on the azure-access pipeline to ensure certain groups require security clearance.
If you have not requested the package and been approved, you will not be able to be added to groups that grant access to sensitive resources.
Related access
- After the user is added to
DTS GitHub Access, follow GitHub onboarding. - For Docker Business setup, follow developer tools.
Troubleshooting
Inactive account email
You may receive an email warning that your account is close to being deleted because you have not logged into the CJS Common Platform Azure Tenant for a while.
Do not ignore this email if you use the CJS Common Platform Tenant or GitHub, as you will lose access to both if you do not log in.
To extend your access, visit the CJS Common Platform Azure portal.
Account deleted
If your account has been deleted and you need it re-enabled, create a ticket in the #platops-help Slack channel.
Someone will send you another guest invite.
Once that is done, ask one of your team members to re-add your access by following the Microsoft Entra ID groups instructions.
If you also had GitHub access, follow GitHub onboarding after your account and access groups have been restored.