myDRE Standard Services Specification
This document provides an overview of the standard myDRE platform features and Research Support services. Functionality may be added or changed through ongoing platform development. Availability and permitted actions depend on the user's role, tenant configuration, and applicable service agreements.
See also myDRE optional services.
1. Research Support & Institutional Enablement
anDREa provides structural onboarding, ongoing validation, and technical tooling to empower the Tenant's decentralized Local Research Support (RS) Teams.
Support Infrastructure & Meetings
- Structured Training & Support: Includes comprehensive RS team onboarding, targeted specialized training modules, and ongoing ad-hoc advisory support.
- Research Support Meetings: Support Team meetings for all Research Support members across clients are offered every two weeks to discuss operational questions, platform updates, and relevant issues.
- System Knowledge Base: Unrestricted access to the core repository, including Research Support specific restricted section reserved for support infrastructure management.
Ticketing and Knowledge Base Support
- Access to the ticketing system and Knowledge Base for end-user specific and authorized Research Support personnel.
- When requested, organization-specific ticket forms, ticket service levels, reports, and Knowledge Base sections can be configured where supported and agreed.
- Support-agent access and permissions are provided according to the applicable service arrangements.
Infrastructure Delegation & Control
- Dedicated access enabling the RS team to provision isolated Workspaces directly within the Tenant's Azure Subscriptions (capped at 100 Workspaces per individual subscription).
- Multi-subscription scalability support, allowing seamless link mapping to Tenant-specific on-premises infrastructure via dedicated network configurations.
- Decentralized management hooks to dynamically assign or modify the designated Workspace Accountable and manage cost center allocations.
- Administrative pathways to enroll new researchers into the centralized anDREa Entra ID ecosystem alongside myDRE Insights integration.
2. User Portal Operational Parameters (mydre.org)
The primary workspace environment operates under a zero-trust model where available workspace actions depend on the user's assigned role. The Workspace Accountable can delegate permitted workspace-management actions to Privileged Members. Permissions are defined in the myDRE Role Matrix.
Security, Identity, & Self-Service Boundary
- Enforced Access Matrix: Access to the portal is strictly gated via multi-factor authentication (MFA) utilizing the Microsoft Authenticator app with advanced contextual indicators.
- Account Management and Recovery: Users can submit supported profile-change and recovery requests through myDRE. Password recovery is also available through the supported Microsoft self-service route. Users can register supported MFA methods and hardware security keys in accordance with the applicable authentication policy. Organizational SCIM integration is managed through the authorized Research Support workflow, not by ordinary workspace users.
- Community Engagement: Universal access to the public Knowledge Base, automated system status announcements, and active participation in the dedicated myDRE Community section.
Virtual Machine (VM) Management
- VM Limit: The default maximum is 11 VMs per workspace, subject to the applicable tenant and platform configuration.
- Orchestration Matrix: Users can dynamically audit VM power states, deploy new instances using either vanilla base distributions (Windows Server / Linux) or custom organization-specific templates, utilize cost-optimized Azure Spot VMs, and rename active assets.
- Access Control: Facilitates secure Remote Desktop Protocol (RDP) file downloads for Windows workstations.
note
To maintain a secure network boundary, direct external access to Linux instances is restricted. Linux environments must be accessed securely via a Windows jump box VM.
- VM and OS Disk Resizing: Users with the required permissions can increase OS disk capacity and change VM size to supported options in the tenant-specific SKU list. Resizing is subject to Azure compatibility and availability constraints and may require a restart or deallocation.
- Automated Shutdown Control: Users can toggle or customize specific automated de-allocation profiles (specifying exact execution times and time zones) to optimize budget burn rates.
- Copy Virtual Machine: Creates a reusable VM image for deploying new VMs within the workspace. Requests to make an image available to additional workspaces can be submitted through a support ticket and are subject to the applicable authorization and configuration requirements.
- VM Operations: View VM status, start or deallocate VMs, assign friendly display names, and delete VMs, subject to workspace permissions.
- Azure Management Access: Where permitted, a link to the VM in the Azure portal provides access to additional management information and operations.
File System, Ingress, & Egress Controls
- Workspace File Share: Files and folders shown in the portal's Files section belong to the workspace share, which is available to VMs in that workspace. The Files section supports file-management functions but does not display file contents.
- File Share Recovery: Workspace file shares have snapshots taken every 24 hours and retained on a rolling 30-day basis. Authorized users can restore supported file-share content through the self-service recovery functionality. Personnel access to workspace data is governed by Clarification Data Access on myDRE and the Data Handling Policy.
- Data Ingress Paths: Supports direct web-browser drag-and-drop actions for small files, enterprise-grade data moves via Azure Storage Explorer, or integration with the automated Upload API.
- Data Egress: Supported routes include download requests, workspace-to-workspace transfers, and approved outbound network paths. Request-based transfers follow the applicable approval workflow. Authorized Accountables and Privileged Members can review requests and approve or reject them; supported review functionality includes inspection before approval.
important
Workspace-to-workspace transfers require the requester to be a member of both workspaces and require approval through the applicable transfer workflow. Data-access and transfer boundaries are described in Clarification Data Access on myDRE.
External Network & Budgetary Governance
- Outbound Domain Control: Researchers can explicitly configure and toggle outbound-only internet access using domain-level or static IP-address allowlisting (Access Control Lists).
- Costs and Budget Alerts: Supports workspace cost visibility, one or more budgets, configurable warning thresholds, and notification email addresses. Budget alerts notify designated contacts when thresholds are reached; they do not, by themselves, impose a spending cap.
3. Administrative Portal Management (admin.mydre.org)
The Admin Portal is an isolated environment restricted exclusively to authorized Research Support members who have successfully completed onboarding. Authentications must originate from verified organizational email domains.
Workspace & Lifecycle Control
- Research Support can create workspaces through the Admin Portal.
- Full governance privileges to safely rename existing Workspaces, reassign the role of Accountable Member from a validated pool of verified privileged users, adjust organizational tracking metadata, and execute clean system archiving or decommissioning processes.
Automated Reporting & Log Inspection
Provides authorized Research Support with reports and logs within its permitted organizational scope:
- Workspace access logs and explicit user activity histories.
- VM operation records, including start, stop, and deallocation events.
- Records of outbound domain allowlist changes.
- Financial usage distributions sorted by active organizational cost centers.
- System-generated Access Review tracking metrics and Entra ID sign-in logs.
User Lifecycle & Entitlement Access Reviews
- User Management Requests: Research Support can submit single or bulk account-creation requests and supported account-management requests for users belonging to its organization. Requests are reviewed and executed by anDREa Support. Supported actions include name and correspondence email changes, password and MFA resets, deactivation, and reactivation, with user verification where required.
- SCIM Management: Authorized Research Support can manage the supported SCIM integration and associated tokens.
- Account and Workspace Boundaries: Account deactivation prevents platform sign-in. Reactivation and correspondence email changes do not automatically restore workspace permissions. These workflows and organizational management boundaries are described in Overview User Management and Research Support.
- Access Review Governance: Enforces a multi-tiered validation cadence to eliminate entitlement creep:
┌────────────────────────────────────────────────────────────────────────┐ │ MANDATORY ACCESS REVIEW CADENCE │ ├────────────────────┬────────────────────┬──────────────────────────────┤ │ 📅 Monthly/Ad-hoc │ 📅 Quarterly │ 📅 Biannual (System Enforced)│ ├────────────────────┼────────────────────┼──────────────────────────────┤ │ Initiated by RS │ Initiated by RS │ Automated platform trigger; │ │ for high-turnover │ for standard │ forces universal validation │ │ project tracking. │ compliance audits. │ profiles across all systems. │ └────────────────────┴────────────────────┴──────────────────────────────┘
Initiating a review triggers automated notification emails to Accountables and Privileged Members containing encrypted reference links to complete pending token validations directly inside the User Portal.
4. Manual / Out-of-SLA Request Parameters
The following advanced architectural adjustments cannot be executed via self-service controls. They must be formally requested by authorized personnel through a standard support ticket:
- Provisioning independent high-speed scratch disks or auxiliary Azure Blob Storage instances.
- Bypassing outbound firewall restrictions to open unrestricted, full outbound internet pathways.