Security & access
Who gets in, and what sits between them and the dataNobody keeps a second user list
Staff sign in with the Microsoft account they already use for email — no new password, no separate directory to maintain. Their group membership on the Microsoft side decides what they can see here, so somebody who joins the coating team gets the coating screens by being put in the group, and somebody who leaves is disabled in Entra and is out of this system on their next page load. Multi-factor is enforced by the same conditional access policy that already protects the mailbox.
Group to role mapping
Managed in Entra, applied here| Entra group | Role here | People | What they can reach |
|---|---|---|---|
| DG-Leadership | Full access | 4 | Everything, including finance and settings |
| DG-Finance | Finance & administration | 2 | Invoices · MYOB sync · Customers · Reports · Projects (read) |
| DG-Sales | Sales & projects | 4 | Enquiries · Quotes · Projects · Customers · Stock (read) · Reports |
| DG-Production | Workshop | 5 | Jobs · Schedule · Stock · Site forms · Roster (own) |
| DG-Coating | Coating services | 4 | Coating intake · Coating runs · Site forms · Jobs (read) · Roster (own) |
| DG-Supply | Supply & despatch | 4 | Stock · Purchasing · Imports · Despatch · Customers (read) |
Signed-in accounts
23 provisioned from the directory| Person | Sign-in name | Group | MFA | Device | Last sign-in |
|---|---|---|---|---|---|
Trisha RiddellFull access | trisha.riddell@doogoodaustralia.com.au | DG-Leadership | Microsoft Authenticator | Windows 11 — DG-DT-140 | 17 Aug, 2:35pm |
Nathan JonesFull access | nathan.jones@doogoodaustralia.com.au | DG-Leadership | Microsoft Authenticator | Windows 11 — DG-LT-163 | 17 Aug, 12:27pm |
Brad JonesFull access | brad.jones@doogoodaustralia.com.au | DG-Leadership | Microsoft Authenticator | Windows 11 — DG-DT-174 | 17 Aug, 11:17am |
Sam PetrovskiFull access | sam.petrovski@doogoodaustralia.com.au | DG-Leadership | Microsoft Authenticator | iPad — DG-IPAD-175 | 17 Aug, 2:52pm |
Karen WhitfieldFinance & administration | karen.whitfield@doogoodaustralia.com.au | DG-Finance | Microsoft Authenticator | iPhone — personal, compliant152 | 17 Aug, 1:09pm |
Rachel HoangSales & projects | rachel.hoang@doogoodaustralia.com.au | DG-Sales | Microsoft Authenticator | Windows 11 — DG-LT-138 | 16 Aug, 2:57pm |
Craig SullivanSales & projects | craig.sullivan@doogoodaustralia.com.au | DG-Sales | Microsoft Authenticator | iPhone — personal, compliant124 | 16 Aug, 6:54am |
Priya NairSales & projects | priya.nair@doogoodaustralia.com.au | DG-Sales | Microsoft Authenticator | Windows 11 — DG-LT-150 | 16 Aug, 10:18am |
Chloe BennettSales & projects | chloe.bennett@doogoodaustralia.com.au | DG-Sales | Microsoft Authenticator | iPhone — personal, compliant154 | 16 Aug, 12:27pm |
Dean MercerWorkshop | dean.mercer@doogoodaustralia.com.au | DG-Production | Microsoft Authenticator (number match) | iPhone — personal, compliant195 | 16 Aug, 12:02pm |
Tony MilenkovicWorkshop | tony.milenkovic@doogoodaustralia.com.au | DG-Production | Microsoft Authenticator (number match) | iPad — DG-IPAD-117 | 15 Aug, 7:16am |
Ben RoweWorkshop | ben.rowe@doogoodaustralia.com.au | DG-Production | Microsoft Authenticator (number match) | Windows 11 — DG-DT-173 | 15 Aug, 6:29am |
Adem YilmazWorkshop | adem.yilmaz@doogoodaustralia.com.au | DG-Production | Microsoft Authenticator (number match) | iPad — DG-IPAD-188 | 15 Aug, 8:08am |
Owen FitzgeraldWorkshop | owen.fitzgerald@doogoodaustralia.com.au | DG-Production | Microsoft Authenticator (number match) | iPad — DG-IPAD-169 | 15 Aug, 10:27am |
Luke AntoniouCoating services | luke.antoniou@doogoodaustralia.com.au | DG-Coating | Microsoft Authenticator (number match) | iPhone — personal, compliant172 | 10 Aug, 8:51am |
Josh TranCoating services | josh.tran@doogoodaustralia.com.au | DG-Coating | Microsoft Authenticator (number match) | iPad — DG-IPAD-125 | 9 Aug, 9:36am |
Ricky PereiraCoating services | ricky.pereira@doogoodaustralia.com.au | DG-Coating | Microsoft Authenticator (number match) | Windows 11 — DG-LT-187 | 12 Aug, 1:04pm |
Nadia FarahCoating services | nadia.farah@doogoodaustralia.com.au | DG-Coating | Microsoft Authenticator (number match) | Windows 11 — DG-LT-118 | 9 Aug, 7:49am |
Marcus DengSupply & despatch | marcus.deng@doogoodaustralia.com.au | DG-Supply | Microsoft Authenticator | iPhone — personal, compliant166 | 14 Aug, 10:04am |
Jason KirkSupply & despatch | jason.kirk@doogoodaustralia.com.au | DG-Supply | Microsoft Authenticator | Windows 11 — DG-DT-120 | 8 Aug, 2:05pm |
Steve RangerSupply & despatch | steve.ranger@doogoodaustralia.com.au | DG-Supply | Microsoft Authenticator | Windows 11 — DG-WS-169 | 9 Aug, 4:07pm |
Manny CostaSupply & despatch | manny.costa@doogoodaustralia.com.au | DG-Supply | Microsoft Authenticator | Windows 11 — DG-WS-179 | 12 Aug, 2:54pm |
Hayley GrovesFinance & administration | hayley.groves@doogoodaustralia.com.au | DG-Finance | Microsoft Authenticator | Windows 11 — DG-DT-156 | 14 Aug, 12:20pm |
Edge events
12 blocked · 4 challenged · 4 denied, last 7 days| When | Type | Rule | Source | Path | Action |
|---|---|---|---|---|---|
| 17 Aug, 5:29pm | WAF | SQL injection — OWASP core ruleset Payload matched sqli-942100 on a query parameter | 45.148.10.205 RU | /api/records | Blocked |
| 17 Aug, 1:13pm | Bot | Bot Fight Mode Automated client, no browser integrity | 104.248.44.229 SG | /quotes | Challenged |
| 17 Aug, 7:33am | Rate limit | 100 requests / minute per IP Threshold exceeded — 412 requests in 60s | 92.63.197.126 RU | /api/search | Blocked |
| 17 Aug, 3:24am | WAF | Path traversal — OWASP core ruleset Encoded ../ sequence in the request body | 185.220.101.47 NL | /api/actions | Blocked |
| 16 Aug, 12:36pm | WAF | Managed ruleset — Log4j JNDI lookup string in a header | 159.89.214.38 US | /api/records | Blocked |
| 16 Aug, 11:14am | Access | Entra ID — no matching group Identity not in tenant doogoodaustralia.com.au | 175.45.176.82 KP | / | Denied |
| 16 Aug, 9:48am | Access | Entra ID — DG-Production Dean Mercer — MFA satisfied | 203.219.44.69 AU | /jobs | Allowed |
| 16 Aug, 1:38am | Access | Entra ID — DG-Leadership Trisha Riddell — MFA satisfied, compliant device | 203.219.44.86 AU | / | Allowed |
| 15 Aug, 5:35pm | Access | Conditional access — non-compliant device Device not enrolled in Intune | 203.219.44.7 AU | /settings | Denied |
| 15 Aug, 6:10am | Bot | Known scraper — verified bot list Non-verified crawler on an authenticated path | 47.128.62.10 SG | /customers | Blocked |
| 15 Aug, 4:49am | TLS | TLS 1.3 enforced Handshake — TLS_AES_256_GCM_SHA384 | 203.219.44.166 AU | / | Logged |
| 15 Aug, 4:36am | Rate limit | 20 logins / minute Repeated authentication attempts | 77.83.36.188 RO | / | Challenged |
| 14 Aug, 9:05pm | WAF | SQL injection — OWASP core ruleset Payload matched sqli-942100 on a query parameter | 45.148.10.42 RU | /api/records | Blocked |
| 14 Aug, 6:15pm | Rate limit | 100 requests / minute per IP Threshold exceeded — 412 requests in 60s | 92.63.197.85 RU | /api/search | Blocked |
| 14 Aug, 5:31pm | Bot | Bot Fight Mode Automated client, no browser integrity | 104.248.44.5 SG | /quotes | Challenged |
| 14 Aug, 4:44am | WAF | Path traversal — OWASP core ruleset Encoded ../ sequence in the request body | 185.220.101.59 NL | /api/actions | Blocked |
| 13 Aug, 12:02pm | Access | Entra ID — DG-Leadership Trisha Riddell — MFA satisfied, compliant device | 203.219.44.5 AU | / | Allowed |
| 13 Aug, 8:32am | WAF | Managed ruleset — Log4j JNDI lookup string in a header | 159.89.214.75 US | /api/records | Blocked |
| 13 Aug, 4:39am | Access | Entra ID — no matching group Identity not in tenant doogoodaustralia.com.au | 175.45.176.131 KP | / | Denied |
| 13 Aug, 2:41am | Access | Entra ID — DG-Production Dean Mercer — MFA satisfied | 203.219.44.151 AU | /jobs | Allowed |
| 12 Aug, 6:10am | Bot | Known scraper — verified bot list Non-verified crawler on an authenticated path | 47.128.62.125 SG | /customers | Blocked |
| 12 Aug, 5:45am | Access | Conditional access — non-compliant device Device not enrolled in Intune | 203.219.44.164 AU | /settings | Denied |
| 12 Aug, 3:12am | Rate limit | 20 logins / minute Repeated authentication attempts | 77.83.36.111 RO | / | Challenged |
| 12 Aug, 12:42am | TLS | TLS 1.3 enforced Handshake — TLS_AES_256_GCM_SHA384 | 203.219.44.187 AU | / | Logged |
| 11 Aug, 11:11am | WAF | Path traversal — OWASP core ruleset Encoded ../ sequence in the request body | 185.220.101.198 NL | /api/actions | Blocked |
| 11 Aug, 10:43am | WAF | SQL injection — OWASP core ruleset Payload matched sqli-942100 on a query parameter | 45.148.10.221 RU | /api/records | Blocked |
☁
Cloudflare doogoodaustralia.com.au · Enterprise
Active Web Application Firewall
Managed ruleset + OWASP core, paranoia 2
Managed and OWASP core rulesets in front of every route, including the API.
Zero Trust access
Zero Trust — Entra ID identity provider
Cloudflare Access sits in front of the app and hands off to Microsoft Entra ID for identity. No password reaches this system.
TLS
TLS 1.3 minimum, HSTS 12 months, preload
Every connection is encrypted end to end. HSTS is preloaded so a browser will not attempt plain HTTP.
DDoS protection
L3/L4 and L7 always-on
Always-on network and application layer mitigation, no configuration and no failover to manage.
Data residency
Australia — data residency pinned to AU data centres
Requests and stored data are pinned to Australian data centres.
Backup
Point-in-time restore, 30 days
Point-in-time restore of the whole database to any moment in the last thirty days.
Events by type
WAF 8
Bot 4
Rate limit 4
Access 8
TLS 2
How a request gets here
- Cloudflare edge — TLS terminated at the nearest Australian data centre, DDoS and bot mitigation applied.
- WAF — managed and OWASP rulesets inspect the request, including anything posted to the API.
- Rate limiting — per-IP thresholds on the search and action endpoints.
- Cloudflare Access — the request must carry a valid identity, or it never reaches the application.
- Microsoft Entra ID — identity and MFA are verified against the tenant, and group membership is read.
- The application — the role from that group decides which screens and which records are returned.