Chapter 28 — Identity and access management: implementation I | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 28 — Identity and access management: implementation I

Lesson map

Lesson 28 published. Map, example, EX082.

flowchart TD
  N0["Learning outcomes"]
  N1["28.1 Phasing"]
  N2["28.2 Pilot group"]
  N3["28.3 Report-only policies"]
  N4["28.4 Enforcement"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX082"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["28.1 Phasing"]
  N2["28.2 Pilot group"]
  N3["28.3 Report-only policies"]
  N4["28.4 Enforcement"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX082"]

[Learning outcomes]
    |
    v
[28.1 Phasing]
    |
    v
[28.2 Pilot group]
    |
    v
[28.3 Report-only policies]
    |
    v
[28.4 Enforcement]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX082]

Learning outcomes

You will (1) implement the identity provider in phases; (2) pilot single sign-on and passkeys; (3) enforce policies after monitoring.

28.1 Phasing

Sana's implementation plan has phases: build the provider and HR feed; integrate a pilot group of ten applications; enrol pilot staff in passkeys; then roll out by department and application group. Each phase has entry criteria, such as tests passed in the test tenant, and exit criteria, such as sign-in success above an agreed level with no unresolved critical tickets. Lessons from each phase change the next. Phasing limits the number of people affected by any mistake and builds the team's confidence step by step.

28.2 Pilot group

The pilot covers the IT department and the planning department, about 180 staff, chosen because IT can troubleshoot and planning uses a mix of old and new applications. Pilot staff agree to report problems through a dedicated channel. Sana holds a short daily check-in with the identity team during the first two weeks. Success criteria are set beforehand, so the decision to proceed rests on evidence rather than impressions, and the pilot's issues are recorded for every later department's preparation.

A failure that only appears in planning's older applications, for example, will surface with 180 staff rather than with the whole council.

28.3 Report-only policies

Conditional access policies are first deployed in report-only mode, where the provider records what it would have done without enforcing it. Reviewing these records reveals effects nobody predicted: a scanner that signs in with a shared account, staff who work from a partner building with unusual network addresses and an old mobile app that cannot handle multi-factor prompts. Each is investigated with its owner. Some lead to policy adjustments, while others reveal behaviour that should stop, such as the shared scanner account, which gets its own managed identity.

28.4 Enforcement

After report-only review, policies are enforced department by department, at quiet times, with staff informed and the service desk briefed. For the first days, Sana watches sign-in failures and desk tickets closely. Any unexpected block is investigated and fixed by correcting the policy or the device, not by adding a broad exception. Emergency access accounts, excluded from conditional policies but monitored closely, remain available in case a policy error locks out administrators, and their use triggers an immediate alert. Each department's enforcement is confirmed in writing.

Worked example

The pilot of 180 staff and ten applications reaches 98.9 percent sign-in success; report-only mode exposes a shared scanner account, a partner building and an old mobile app, each resolved before enforcement.

Synthetic case. Departments, applications and figures are synthetic.

Errors and limits

Enforcing new access policies without a report-only period turns unpredicted effects into outages.

Exercises

EX082 — Pilot departments. Which departments form the pilot, and why? Rubric: 3 = IT and planning: troubleshooting plus mixed applications;; 2 = two;; 1 = all;; 0 = none.
EX083 — Report-only meaning. What does report-only mode do? Rubric: 3 = records what would happen without enforcing;; 2 = log only;; 1 = blocks;; 0 = none.
EX084 — Emergency account handling. How are emergency access accounts treated? Rubric: 3 = excluded from conditional policies, monitored, use alerts;; 2 = monitored;; 1 = deleted;; 0 = none.

Synthesis

Phased implementation, a well-chosen pilot, report-only review and careful enforcement bring the design safely into use.

Continue studying — chapter 28 of 50

← Chapter 27 (draft) · Course chapter index · Chapter 29 (draft) →