Authentication and identity architecture for a management plane of a multi-tenant computing system

A computer implemented method, comprising:

• generating an instance of a startup application with a first set of permissions;
• using the first set of permissions to generate a subscription that includes a resource container to which computing system resources are assigned as subscription resources, a management application configured to access the subscription resources using role-based access, and a credential key vault stored within the subscription and storing a certificate credential;
• performing role assignment, with the instance of the startup application, assigning a role to the management application;
• and
• removing the first set of permissions prior to assigning subscription resources to the subscription.

A computer system, comprising:

• at least one processor;
• and
• a data store that stores computer executable instructions which, when executed by the at least one processor, cause the processor to implement:
• a subscription group that includes a plurality of subscriptions, each subscription comprising a resource container to which computing system resources are assigned as subscription resources;
• a management group having an assigned role;
• a set of management applications that are members of the management group, each management application, that is a member of the management group, being configured to access the subscription resources using role-based access with the role assigned to the management group;
• a separate management application, separate from the set of management applications, having an assigned role and configured to control membership of management applications in the management group and configured to access the subscription resources using role-based access;
• and
• a set of credential key vaults, each credential key vault being stored within a different corresponding subscription in the subscription group and storing a certificate credential, the separate management application using the certificate credential to perform a management operation on the subscription resources in the corresponding subscription.