Monday.com engineers urged to make identity central to product architecture

Identity is becoming the quiet architecture choice that decides whether monday.com can keep shipping automation without widening the blast radius of every credential. Microsoft’s Zero Trust model, built on explicit verification, least privileged access, and assuming breach, maps directly onto a platform that now carries customer work, data, and AI actions across many apps and services.

Why identity is now a product decision

The old habit in software teams was to bolt on access control after launch. That approach breaks down fast when a work platform starts orchestrating real business operations, because every new permission path can become a security gap, a support burden, or both. Microsoft’s guidance puts identity first for a reason: user and application authentication and authorization are the entry point into the broader identity and secrets stack, and Entra ID is meant to sit in the path of every access request.

For monday.com engineers, that means identity can no longer live in a separate security checklist. It has to shape product architecture from the start, especially when the product is designed to connect people, workflows, and AI agents on one platform. A feature that looks simple in a demo can become much more complicated in an enterprise account if it does not respect device health, user identity, location, environment, and risk at the moment of access.

What Zero Trust changes for engineering teams

Zero Trust is not only about blocking threats. It is about reducing trust to the smallest useful unit, then checking that unit again and again. Microsoft’s framework pushes developers toward standards-based authentication libraries, registration of apps in Microsoft Entra ID, and delegated identity and access management rather than custom security logic scattered through each app.

That matters for monday.com because the platform increasingly acts as a control plane for work. If a product team gives an automation too much scope, or exposes an internal service account with broad access, the failure is no longer isolated to one board or one workflow. Least privilege becomes a practical engineering rule: every API token, service account, and AI action should have only the minimum access needed to complete its task.

The same logic applies to product design. Product managers need to ask where permissions live, how they are reviewed, and what happens when the context changes. A user who can edit data from a managed office laptop may not need the same access from an unmanaged device on an unfamiliar network, and Microsoft’s Conditional Access model is built around those distinctions.

The guardrails that matter in day-to-day work

For a fast-moving SaaS team, Zero Trust becomes real only when it shows up in routine workflows. The most common failure points are not exotic attacks. They are messy contractor onboarding, privilege creep, and offboarding that leaves too much access behind.

A practical monday.com implementation would start with a few operational guardrails:

• Route every sensitive app through a central identity provider rather than building one-off login logic.
• Require least privilege for internal tools, API access, and AI agents, then review those permissions on a schedule.
• Use Conditional Access to factor in user identity, device health, location, environment, and risk before granting access.
• Treat onboarding and offboarding as identity events, not admin chores, so contractor access expires cleanly.
• Tie privileged workflows to standards-based authentication and SSO so enterprise customers can manage control from their own stack.

These are not abstract security ideals. They are the difference between a product that scales cleanly and one that accumulates invisible access debt every time a team ships a new feature.

Why monday.com’s trust posture matters inside the company

The scale numbers tell you why this is now a core operating issue. monday.com says its trust center covers more than 250,000 customers worldwide, and its investor materials describe the company as an AI work platform used by more than 250,000 customers to bring people, workflows, and AI agents together on one platform. At that scale, access control is no longer a back-office concern. It is part of the customer experience.

The company also says its security controls are built around international standards and best practices, including ISO 27001, ISO 27018, SOC 2, and OWASP Top 10. Internally, monday.com says security is guided by a Security Team and a Security Forum that brings together Infrastructure, R&D, Operations, and IT. That structure matters because access control touches every part of the product and every part of the business. Engineers build the plumbing, operations maintain the environment, IT manages the workforce edge, and R&D keeps adding new features that can either strengthen or stress the system.

For employees, that means security is not just a compliance layer. It is part of the product conversation. When a feature team pushes to ship faster, the relevant question is not only whether the feature works. It is whether it can be deployed safely across different users, devices, and data boundaries without forcing customers into risky workarounds.

What enterprise buyers expect from monday.com

The access stack already shows how monday.com positions itself for enterprise use. The company says Pro and Enterprise plans support Google SSO, while Enterprise plans also support Okta, OneLogin, Azure AD, and custom SAML 2.0. Account administrators can also enable two-factor authentication through text message or an authenticator app.

That is more than a checkbox list. It is the operational proof that monday.com can fit into a customer’s existing identity framework instead of asking the customer to rebuild it around monday.com. For enterprise sales teams, the message is straightforward: the product is not just flexible, it is controllable. Buyers can keep their own identity systems in place, apply their own access policies, and reduce the blast radius if a credential is compromised.

That is especially important as procurement teams get more exacting about how SaaS tools handle human access, contractor access, and automated access. The conversation is no longer limited to feature depth. It now includes whether the platform can prove that the right person, device, and service is accessing the right data at the right time.

AI raises the stakes, not just the pitch

monday.com’s first-quarter 2026 results add a sharp business reason for this shift. The company reported revenue of $351.3 million, up 24% year over year, and said it launched an AI Work Platform with Native Agents. That combination matters because AI features do not just automate tasks. They can also multiply the consequences of a bad permission model.

If an AI agent inherits overly broad access, it can move faster than a human user ever could, and it can do so across more systems at once. That is why secure AI starts with secure identity. Zero Trust is not a side conversation for AI-era work platforms. It is the control system that determines whether automation is useful or dangerous.

For monday.com, the strategic lesson is plain. The company is building more execution into the platform, which means identity has to be treated as a core product layer, not an afterthought. The teams that get this right will make the platform safer to scale, easier for enterprise customers to trust, and harder for one bad permission to turn into a company-wide problem.