Chapter 18 — Supervised project

Chapter 18 — Supervised project

Lesson map

Lesson 18 published. Map, example, EX069.

flowchart TD
  N0["Learning outcomes"]
  N1["18.1 Planning the project"]
  N2["18.2 Delivering and verifying"]
  N3["18.3 Presenting results"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4
  N4 --> EX["Worked example"]
  EX --> Q["Exercise EX069"]

Logical drawing

flowchart LR
  N0["Learning outcomes"]
  N1["18.1 Planning the project"]
  N2["18.2 Delivering and verifying"]
  N3["18.3 Presenting results"]
  N4["Synthesis"]
  N0 --> N1 --> N2 --> N3 --> N4 --> Q["EX069"]

[Learning outcomes]
    |
    v
[18.1 Planning the project]
    |
    v
[18.2 Delivering and verifying]
    |
    v
[18.3 Presenting results]
    |
    v
[Synthesis]
    |
    v
[Worked example] --> [Exercise EX069]

Learning outcomes

You will (1) plan a supervised identity improvement; (2) deliver and verify it; (3) present results and remaining work.

18.1 Planning the project

For his final project Tomas chooses to bring payroll under single sign-on, now that the supplier supports OpenID Connect, and to raise phishing-resistant methods to all dentists. He writes a plan with scope, risks, test steps, rollback, timeline and approvals from Priya and the practice manager. A written plan lets supervisors check his thinking before work begins, and it gives him a clear standard to measure the finished work against. Priya asks him to add a risk that payroll staff are unavailable during testing, with a fallback date.

18.2 Delivering and verifying

Tomas connects payroll in a test tenant first, then live with the practice manager and one finance user. He confirms role mapping, then disables local payroll passwords and verifies a local sign-in fails. For dentists, he runs passkey sessions over three weeks. He reruns the MFA coverage report: phishing-resistant methods rise from 6 to 10 of 28. Each result is verified against the plan's success measures rather than assumed from the configuration alone. He records every test and its outcome in the change record for the project file.

18.3 Presenting results

Tomas presents to Priya and the practice manager: what changed, evidence from tests and reports, problems met, and what remains, namely nurses and reception still on app-based methods and the appointment reminder integration needing a credential renewal process. He hands over updated runbooks and records. Priya assesses the project as complete, noting that his clear reporting of remaining work is as important as the improvements, because it lets the practice plan its next steps. The practice manager adds the remaining items to next year's plan.

Worked example

Payroll moves to OpenID Connect SSO with local passwords closed; phishing-resistant methods rise from 6 to 10 of 28 staff.

Synthetic case. Projects and figures are synthetic; OpenID Connect Core is a real source.

Errors and limits

Declaring a project complete from configuration alone, without verification against success measures, hides failures.

Exercises

• EX069 — Project scope. What two goals did the project have? Rubric: 3 = payroll SSO and passkeys for dentists;; 2 = two;; 1 = one;; 0 = none.
• EX070 — Coverage change. How did phishing-resistant coverage change? Rubric: 3 = 6 to 10 of 28;; 2 = rose;; 1 = fell;; 0 = none.
• EX071 — Payroll verification. How was the payroll change verified? Rubric: 3 = local sign-in attempt failed;; 2 = test;; 1 = assumed;; 0 = none.
• EX072 — Remaining work. Name one item of remaining work. Rubric: 3 = nurses and reception on app methods;; 2 = reminder credential;; 1 = vague;; 0 = none.

Synthesis

A planned, verified and honestly reported project shows readiness for independent identity work.

Continue studying — chapter 18 of 18

← Chapter 17 (draft) · Course chapter index · Worked results ↓ · Next course via chapter index →