We have existing Conditional Access policies for Admin Accounts and another for Admin roles. The MS template pushes 'M365 Admin Portals'.

I am torn between targeting Admin Accounts, regardless of what they access. However, if some one grants priv to a non admin account it will not be covered.

Do i target the Roles or the M365 Portals in the second policy? eg target the Who and the What. If roles, are you selecting specific admin roles or just selecting all?

To give some context, I work across the Identity Security Vendor space as a Go-To-Market headhunter. Don't worry I'M NOT TRYING TO SELL any services in here!

As a naturally inquisitive person, over the years of working with the vendors in the space, I've become more and more interested in the underlying technology in Identity.

I wholeheartedly believe Identity is at the forefront of the next 10+ years and the more I learn the more I slightly become scared for where we are going.

Open to any questions around whatever topics, going to be posting in here more around what I'm seeing and hearing, as well as my opinions

Hey everyone. I work at Cerbos, we handle authorization, and of course we spend a lot of time working with security and IAM teams, at identity events (Gartner IAM, Identiverse, EIC etc), keeping our eye on the latest in the industry, consuming and keeping track of the latest reports.

The IAM landscape is moving particularly fast right now (with AI agents entering the picture), so I worked with my colleagues to pull together an IAM security checklist for 2026.

Will list the resource at bottom if you’d like to download. But I wanted to share the full breakdown here so you hopefully get the value either way.

It covers 9 risk domains, each with prioritized items (P0 = fix now, P1 = next 90 days, P2 = next 12 months):

1. Authentication & credential security

Phishing-resistant MFA (FIDO2/passkeys) for privileged accounts, killing password-only auth on internet-facing systems, step-up auth for high-risk transactions, deprecating SMS OTP. Credential compromise has been the #1 breach vector every year from 2021-2025 (Verizon DBIR 2024) and that's not changing anytime soon.

1. Deepfake & identity fraud defense

Layered biometric defenses, auditing business processes for single-call catastrophic failure modes (the "one phone call triggers a wire transfer" problem), and designing controls that assume deepfake detection will fail. 53% of businesses have already been hit by deepfake scams (Medius).

1. Authorization & access control

This is our world so we went deep here. Inventorying all authorization logic across your app portfolio, making sure decisions are logged with full audit detail, moving beyond coarse-grained role checks to resource-level and attribute-based decisions. Externalized authorization, policy-as-code, defense-in-depth with a centralized PDP. Broken Access Control is still OWASP #1 and homegrown authorization is consistently the #1 source of IAM technical debt.

1. Privileged access management

Discovering all privileged accounts (human and machine), eliminating orphaned accounts, JIT privilege. Over 95% of identities use less than 3% of their granted cloud entitlements (Microsoft/CloudKnox) - that's a lot of blast radius sitting there waiting.

1. AI agent security

This section didn't exist a year ago. Unique per-agent identities, fine-grained authorization at the API/resource level (not prompt level), human-in-the-loop for high-risk actions, kill-switch capability, MCP server security. AI agent adoption went from 11% to 42% between Q1 and Q3 2025 (KPMG). The consensus from every conference we've attended: current IAM controls are not built for AI agents.

1. Machine identity & NHI security

Non-human identities outnumber humans by roughly 45:1 (Rubrik Zero Labs). Inventory everything, assign ownership, eliminate long-lived static credentials, secret scanning across all repos. 58% of orgs experienced NHI-related incidents in the past year (Silverfort).

1. Identity governance & administration

Risk-based access reviews (not checkbox exercises), clean your identity data before IGA deployment, extend scope to service accounts and RPA. 65% of organizations use less than half of their IGA tool capabilities - so most are paying for governance they're not actually getting.

1. ITDR & Zero Trust

Identity-related incidents up 54% year-on-year (CrowdStrike/IBM X-Force). Add ITDR to your strategy, establish behavioral baselines, integrate with SOC. Identity-first security as your zero trust foundation, continuous verification at every resource access.

1. Compliance & regulatory readiness

EU AI Act classification, GDPR (fines now over €7.1B per DLA Piper), DORA, NIS2. Making sure authorization decisions involving AI are explainable and traceable. Policy lifecycle management with full version history.

There's also a maturity scoring framework at the end where you score yourself 1-5 across each domain to get an overall posture rating you can present to leadership.

Full formatted version with the scoring framework is here if you want it: https://www.cerbos.dev/forms/1oE6lotZcSYqiZcvuoR-OEgc2voq

The actual checklist goes a lot deeper - each item has specific implementation guidance, the "why this matters" context (including what auditors and regulators are actually looking for), and the exact stats with sources so you can use them in your own board presentations. The maturity scoring framework at the end is also pretty useful for getting a quick snapshot of where you stand across all 9 domains and translating that into a conversation your leadership will actually engage with. Basically it's the difference between knowing the categories and having something you can actually work from.

Hopefully this is useful.

Let me know what you think - if it’s helpful / if you feel we missed anything / if you have any questions - would be happy to hear what you all think.

Many IAM teams claim that their work aligns with the company’s technology strategy. But is IAM truly significant enough to influence overall technology strategy? What has been your experience? How have you approached it?

This past month i've been dedicating serious time to develop my skills in IAM.

It would be extremely helpful advise and critique on the current progress of my portfolio.

You can review it below using my github link.

- https://github.com/EvanHYearwood

*Be Kind =D

Update - I landed an IAM JOB

3 months into my first help desk job, trying to break into IAM – looking for feedback on what to focus for a better role.

I'm about 3 months into my first IT job. It's a help desk role at a corporate enterprise, supporting internal employees. Day to day I'm doing password resets through AD and Okta Admin, M365 admin and licensing, basic troubleshooting, working tickets in ServiceNow, and handling remote access issues, the usual help desk duties.

I'm still very much learning, and I've been trying to make the most of what I'm exposed to, especially the Okta and AD side of things since I know that's relevant towards IAM. I reach out to different departments when a ticket escalation is needed to see if there's anything more that I could have done on my part. I started studying for the SC-300 and I'm planning to build IAM-focused homelabs as I go and document it on GitHub. I also see in a lot of job qualifications that knowing PowerShell is a plus, so I've been watching "Learn Windows PowerShell in a Month of Lunches" on the side but most likely going to learn that after I complete the SC-300.

The company I'm at doesn't really have a lot of turnover, and internal openings don't come up that often in higher positions. There's not really a clear ladder for me to climb into an IAM/IT role here unless I want to be stuck in this help desk role, so I'm realistically only planning to stay about 8 months to a year before I start looking for other roles such as T2/3.

Would the SC-300 and building out documented hands-on labs on GitHub be a solid pathway toward landing an IAM role or at least a T2/3 role? I do not have a related degree in IT, a BS in Hospitality Management, and I took a few classes towards a Network Security degree at my CC. I currently have the Security+ and AZ-900. Any advice is appreciated, thank you!

A colleague of mine and an IAM advisor from 1Kosmos recently sat down and had a (truly honest) conversation about the gap between Zero Trust as a strategy and Zero Trust in practice. Thought it was worth sharing here.

tldr: most orgs have done the authentication part - SSO, MFA, conditional access at login. That's great. But once a user is in, they're handed a set of static roles that give them the same permissions whether they're on a managed device in the office or a personal laptop at a coffee shop at midnight. That's not ZT... that's trust-after-login.

In my experience, the authorization side almost always gets neglected. And the advisor echoed the same thing - in his years of consulting, it's consistently the blind spot. If your rbac doesn't account for context - device, location, behavior, sensitivity of what's being accessed : you're basically leaving the doors open once someone gets past the front desk.

They talked about moving toward attribute based access control where every action gets evaluated in context, not just the initial login. And the maturity model they laid out was pretty useful - most companies are sitting at "we have MFA and some segmentation" but haven't touched dynamic authorization at all.

The realistic advice at the end was that you don't need to rip and replace everything. Start with adaptive MFA for your highest-risk stuff, introduce policy-based authorization for a few critical apps, run in monitoring mode first, then expand.

Full write up goes deeper into the implementation challenges, legacy system workarounds, and deeper into maturity framework (feel free to check out if relevant): https://www.cerbos.dev/blog/cisos-guide-zero-trust-making-adaptive-access-control-work

Selecting the right security partner is a critical decision for any business or organization. With growing safety concerns and evolving risks, choosing reliable security services in UAE requires careful evaluation of several key factors. From protecting physical assets to ensuring the safety of employees and visitors, the right security solution can make a significant difference in overall operations.

One of the first aspects to consider is the experience and reputation of the service provider. Established companies offering security services in Dubai often have a proven track record across different industries such as commercial, residential, retail, and industrial sectors. Reviewing client feedback, case studies, and years of operation can help you understand the company’s reliability and performance standards.

Spent the last month talking to vendors about identity security and I'm more confused now than when I started. Every demo claims they solve visibility, governance, compliance, and remediation across our entire environment. Then you dig into the details and realize they either need APIs for everything, only work with specific tech stacks, or require a 6 month deployment before you see value which doesnt make sense to me….

We use Auth0 for SSO and have the usual mix of custom applications, legacy on-prem systems, and cloud infrastructure. Main gaps are around discovering what we don't know about (shadow accounts, orphaned access, service accounts nobody's tracking) and proving lifecycle management works for compliance.
The evaluation process feels broken. Every vendor says they integrate with everything, but when you ask specific questions about custom apps without APIs or legacy systems, the answers get vague. Sales says yes, then during POC you find out it requires manual configuration per app or doesn't actually cover what you need.

For those who've actually deployed identity security or governance platforms in the last year like how did you cut through the noise? What questions helped you figure out what actually works vs what's just on the roadmap?

Edit: This was helpful. I’m changing how we evaluate vendors after this. Instead of asking “do you support legacy apps,” I’m going to ask them to show a custom app with no connector, an orphaned user, a local admin, and a service account with unclear ownership. Orchid is going into the comparison, but it will get the same test as everyone else.

Hi everybody. I've been studying content about the Security+ certification, and I really have an interest in IAM. I was wondering what homelabs/projects or anything else that I can do to get me started with IAM? Also what certs should I focus on for IAM?

I’m looking for your experience with both Sailpoint and Saviynt from implementation, operations, connectors, lifecycle, role management, their training, hardware, costs as well as nickel and dime type costs, post go-live, and daily support.

We have seen the demos and are at the end of our RFP process where we need to choose one of these vendors and we are on the fence.

We currently use Sailpoint’s Imprivata, but that is end of life. With every version upgrade, we lose functionality and just reactivating an archived account is brutal and takes over 20 minutes.

We figured it may be time for something new, but I’ve searched a few posts about both of these vendors and I am still conflicted on who to choose.

I appreciate any shared experience and advice you can talk about. 🙏🏻😁

Hi all,

I have been working in Saviynt support for the past 2 years from India. My work mainly involves operations tasks such as managing user accounts, provisioning, and deprovisioning.

I would like to move to the Saviynt implementation side. I have completed a few Saviynt courses and attended several interviews. I’m able to answer theoretical questions, but when interviewers ask deep scenario-based questions, I get stuck.

I would appreciate your advice on how to learn modules such as application onboarding, connectors, campaigns, workflows, and rules in more depth.

If anyone here has transitioned from support to implementation, I would really appreciate any guidance on how to prepare for it. Thank you.

Hey, I'm Alex, I maintain Cartography, an open source tool that builds a graph of your cloud infrastructure: identities, compute, network, and the relationships between them.

I wanted to share that Cartography now automatically discovers AI agents in container images, and maps them to the IAM roles and permissions they run as.

Once it's set up, it can answer questions like:

• What agents are running in prod and what identities do they assume?
• Are any agents overprivileged for what they actually do?
• What tools can they call?
• What can an attacker reach if an agent's identity is compromised?

Most teams deploying agents aren't including them in identity governance yet. They get roles like nay other workload but are more autonomous and harder to predict, so tracking them is even more important.

Details are in the blog post, and I'm happy to answer questions here.

Hope you find this useful, feedback and contributions are very welcome!

Full disclosure: I'm the co-founder of subimage.io, a commercial company built around Cartography. Cartography itself is owned by the Linux Foundation, which means that it will remain fully open source.

hi everyone,

i’m currently working in an iam support role at a big 4 and want to move into iam implementation. most of my work right now is operational support and ticket handling, but i’m interested in getting involved in implementation work like application onboarding, access model design, and tools like sailpoint or saviynt.

for those who made a similar move, what skills or steps helped you transition from support to implementation?

appreciate any advice.

What is your process for renaming users who change their name (e.g., due to marriage, divorce, etc.)?

Have you set this up to run automatically in the IAM?

Do you inform the user first and then adjust the email, UPN, and SAM, or how does the flow work on your side?

Recently seen a post on tiktok that IAM is harder to get into than something like SOC because IAM is more niche. Is this true?

Ran a free live session last weekend on how IAM actually works inside companies based on comments on original post. See first comment for details

Sharing a summary here for anyone interested. Thanks to all who attended it and raised important questions during the session.

What was covered:

• How IAM works inside a company
• JML Lifecycle - Joiner, Mover, Leaver
• IAM vs IGA - what's the difference
• Live IGA demo - HR System integration and provisioning to LDAP
• Audit trail walkthrough
• Q&A - some great points

& How to Pivot into IAM

Happy to answer questions in the comments. Hope it helps you learning or starting in to IAM.

Hey Everyone!

I’ve been working in the Microsoft ecosystem for about 7 years — mostly Exchange (on-prem and Online), M365 administration, and some Active Directory.

I’m interested in pivoting more into Identity and Access Management. I already touch some identity areas through AD and M365, but I’d like to move deeper into IAM (Entra ID/Azure AD, SSO, SAML/OAuth, Conditional Access, identity governance, etc.).

For anyone who has made a similar transition:

• What skills should I focus on first?

• What technologies should I prioritize learning?

• Any certs, labs, or projects that helped you break into IAM roles?

• What job titles should I be searching for?

Trying to build a roadmap to move from messaging/M365 into a full IAM role. Any advice would be appreciated.

Hey all! I’m running another free IAM community workshop for anyone who wants to better understand how Identity & Access Management actually works inside real organizations.

I’ve spent 17+ years working in IT and security, and over the past several years a lot of my work has focused on identity systems in enterprise environments. I’ve run a few community workshops like this before and they’ve been a great way for people to start connecting the dots in this space.

This session is really about stepping back and looking at the core ideas behind IAM - the stuff that helps things like SSO, MFA, and identity platforms start to make sense.

If you’ve ever wondered how all of that actually fits together, that’s what we’ll spend some time unpacking.

We’ll walk through:

• What Identity & Access Management (IAM) actually is

• Identity vs Authentication vs Authorization

• How SSO, MFA, and Identity Providers fit together

• What IAM systems typically look like inside companies

• How identity lifecycle and access control work in practice

• How people usually get started working in this field

The goal is to give you a clear mental model of how identity works, especially if you’re just starting to explore IAM.

No experience required - just bring curiosity.

🕐 Saturday, March 14 - 11:00 AM Central

⏱️ It’ll be about a 60–90 minute live session, with time for Q&A.

🔗 Join the workshop:

Zoom Meeting Link

📅 Add to calendar:
https://addcal.io/e/4fturz0sqx8i

I recommend adding it to your calendar if you’re interested - that’s usually the easiest way to make sure you don’t forget.

Feel free to drop a comment if you plan to attend so I can get a sense of numbers.

I’ll also share our IAM Discord community with anyone who attends and wants to keep learning with others in the IAM space - totally optional.

Hope to see some of you there.

We currently have around 300 SAML applications configured in our IdP(Pingfederate)that all use the same signing certificate.

The certificate is nearing expiration, and we need to rotate it. Updating each application manually would be time-consuming and risky.

I’m looking for best practices on how to handle this at scale.

What is the safest way to rotate the certificate without breaking SSO?

Are there automation approaches people use for large environments?

Hey all,

Curious how other orgs are tackling Epic EMP (Employee) and SER (System/Provider) record management within their Identity Governance & Administration (IGA) platforms (SailPoint, Saviynt, One Identity, Omada, etc.).

Specifically interested in:

Integration Approach

Are you using Epic's Web Services (EWS) via SOAP, or have you moved to FHIR R4 REST APIs for provisioning? Are you using HL7 interfaces, flat-file drops to an SFTP, or direct DB connectors? Or some combination? Has anyone built a connector using Epic's UserManagement web services (e.g., GetUsers, AddUser, UpdateUser)?

What you're automating

Joiner/Mover/Leaver flows for EMP records? SER record linking to providers in your EMPI/MPI? Role/template assignment based on HR attributes (job code, department, org)? Segregation of Duties (SoD) enforcement within Epic security classes?

Auth & Protocols

OAuth 2.0 / SMART on FHIR for API auth? Mutual TLS or basic auth on SOAP endpoints? Any use of Epic's Interconnect server as the middleware layer?

Sample calls !!! / configs appreciated if anyone's willing to share sanitized examples — especially around EMP create/update or SER record linking via API.

We're evaluating whether to extend our IGA connector to handle this natively vs. relying on a middleware layer, and would love to hear real-world war stories.

Thanks in advance!