update

docs/deployment.md

@@ -193,6 +193,24 @@ Gitea uses its own SQLite database at
 After TLS is enabled, use the equivalent `https://` URLs without the temporary
 HTTP test port.
 
+### Final identity hardening
+
+After public DNS, WAN TCP 80/443 forwarding, and the Let's Encrypt certificate
+are working, configure Microsoft Entra ID as Gitea's OpenID Connect
+authentication source. Register the final callback URL:
+
+```text
+https://GITEA_DOMAIN/user/oauth2/entra/callback
+```
+
+Require assignment to the Entra enterprise application, apply the company's
+Duo-backed Conditional Access policy, and map the Entra `Gitea.User` and
+`Gitea.Admin` application roles into Gitea. Verify an Entra administrator can
+sign in and reach the broker before disabling Gitea's local password sign-in
+form. Keep a documented VM-console recovery procedure and retain the package
+reader and publisher as non-admin service accounts with narrowly scoped
+tokens.
+
 For local testing that bypasses Nginx, set `BROKER_DIRECT_PORT` and
 `GITEA_DIRECT_PORT` in `.env`. Set `GITEA_DIRECT_ROOT_URL` to the exact URL the
 test browser will use, including the VM hostname or IP address and port: