Brakeline single sign-on rollout

Brakeline's nine depots move from passwords to Entra ID. Ticket SUP-388. Kept as the example for later rollouts.

Brakeline: Priya Nair (IT lead), Sam Whitfield (Leeds operations, portal administrator) · ACME: Ana Ruiz, Marek Nowak (engineering), Rafael Duarte

Plan

Two weekends, each depot rehearsed with a test account the week before.

Weekend	Depots	People
Sat 7 Mar	Leeds, Wakefield, Bradford, York	520
Sat 14 Mar	Doncaster, Sheffield, Hull, Grimsby, Immingham	580

Steps per depot

1. Priya's team creates the depot's enterprise app in Entra ID and sends us its metadata through the ticket.
2. Marek loads the metadata into identity-service. (There is no upload in the portal yet.)
3. Rehearsal on the Thursday: a test account signs in through Entra ID.
4. Saturday morning before the early shift: the depot's switch goes on.
5. People sign in with their Brakeline account from the next sign-in. Anyone signed in stays signed in.

What happened

• Hull: the rehearsal failed on Thu 12 Mar. The certificate we had loaded was Grimsby's; the two files had the same name. Loaded again, rehearsal passed the same afternoon. This is why the checklist now asks for one test account per depot, not one for the customer.
• Leeds: 14 new starters had no Brakeline account yet and couldn't sign in on the Saturday morning. Priya's team made their accounts by 09:00; the shift lead kept them on the gate's paper list until then. The checklist now asks for new starters' accounts before the weekend.
• No downtime at any depot. No depot went back to passwords.
• Roles: Brakeline's groups are named by job, so the depot manager group gives the Depot manager title, not a depot. Fine for now: only administrators approve.

After

• Closed SUP-388 on 23 March.
• Updated the single sign-on checklist: one test account per depot, by the Tuesday before the switch.
• Asked product for a metadata upload in the portal, so a customer's IT can do steps 1 and 2 without us.