Start here. Pick a recipe to scaffold most of this for you, then tell us what you're trying to do.
Compose the design from the enterprise toolbox, then let the tool draft the write-up. Edit anything it gets wrong.
Resources (tick what this design uses)
For a production Kontoor agent this is mandatory: AzureAD SSO + MFA, roles through KIM. The tool pre-fills the standard answer.