Chapter 37 — Identity and access management: operations | Engineering Identity and access management

Open, free learning for anyone who wants to protect people and technology. No account is required to read this text or its worked answers.

Chapter 37 — Identity and access management: operations

Lesson map

Lesson 37 published. Map, example, EX109.

flowchart TD
  N0["Learning outcomes"]
  N1["37.1 Routine operations"]
  N2["37.2 Identity incidents"]
  N3["37.3 Change management"]
  N4["37.4 Access reviews"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5
  N5 --> EX["Worked example"]
  EX --> Q["Exercise EX109"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["37.1 Routine operations"]
  N2["37.2 Identity incidents"]
  N3["37.3 Change management"]
  N4["37.4 Access reviews"]
  N5["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> N5 --> Q["EX109"]

[Learning outcomes]
    |
    v
[37.1 Routine operations]
    |
    v
[37.2 Identity incidents]
    |
    v
[37.3 Change management]
    |
    v
[37.4 Access reviews]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX109]

Learning outcomes

You will (1) run routine identity operations; (2) handle incidents involving identity; (3) manage changes and access reviews.

37.1 Routine operations

Daily identity operations include checking the HR feed and connector status, reviewing failed provisioning operations, handling exception requests and watching sign-in success and alert queues. Weekly tasks include reviewing emergency account use and administrator activations. Monthly tasks include certificate expiry checks and a report on success measures. Sana writes each task in a runbook with steps, expected results and escalation contacts, so the three-person team can share the work and cover absences without relying on memory. Runbooks are reviewed after every incident and at least yearly.

37.2 Identity incidents

When a staff account is suspected compromised, the response follows a runbook: confirm signals with the user through a trusted channel, revoke sessions and tokens, reset or re-register authenticators with verified identity, review recent activity for actions taken, and inform the security team. Revoking sessions matters because disabling a password alone does not end existing sessions. Each incident is recorded with timeline and lessons. Sana practises the runbook with synthetic scenarios in the test tenant so the team acts quickly when a real case arrives.

37.3 Change management

Identity changes follow the process designed in chapter 14: version control, review, automated tests and staged deployment. Operations adds a change calendar, so changes avoid busy periods such as payroll week, and a rule that conditional access changes require a second approver. Emergency changes are allowed but reviewed within two working days. Sana measures change failure rate, the share of changes needing rollback, as an indicator of whether the process is working or being bypassed under pressure. Trends in this rate are reviewed monthly.

37.4 Access reviews

Quarterly access reviews ask managers to confirm each team member's roles and exceptions. Drawing on lessons that approve-all reviews achieve little, Sana designs reviews that show plain-language descriptions, last-use dates and highlights for unused or conflicting access, and keep each manager's list short by excluding standard role access already governed by HR job data. Removals happen automatically when a manager rejects an item. Completion rates and removals are reported, so reviews are judged by what they change, not by how many clicks they collect.

Worked example

Runbooks cover twelve daily, weekly and monthly tasks; a synthetic compromise drill completes session revocation in nine minutes; the first improved access review removes 7 percent of reviewed items.

Synthetic case. Tasks, drills and figures are synthetic.

Errors and limits

Disabling a password without revoking sessions leaves an attacker's existing session active.

Exercises

EX109 — Session revocation reason. Why must sessions be revoked in a compromise? Rubric: 3 = disabling password alone does not end existing sessions;; 2 = sessions persist;; 1 = speed;; 0 = none.
EX110 — Change failure rate. What does change failure rate measure? Rubric: 3 = share of changes needing rollback;; 2 = rollbacks;; 1 = speed;; 0 = none.
EX111 — Review design. Name two features of Sana's improved access reviews. Rubric: 3 = plain descriptions, last-use dates, highlights, short lists, automatic removal (two);; 2 = one;; 1 = vague;; 0 = none.

Synthesis

Runbooks, practised incident response, disciplined change and meaningful access reviews keep identity secure day to day.

Continue studying — chapter 37 of 50

← Chapter 36 (draft) · Course chapter index · Chapter 38 (draft) →