The Identity Blueprint

Ernie Prescott

0.0 (0)
Technology

Enterprise identity and access management isn't a product you buy — it's a program you build. The Identity Blueprint covers the full spectrum: seven-phase IAM frameworks, zero trust architecture, JIT access, FIDO2 passkeys, identity governance, and the operational models that hold up at enterprise scale. Built for practitioners who are past the basics. Hosted by Ernie and Josée.

4d ago

Secure Your Infrastructure Without Service Accounts

For twenty years, every server and every application in your environment had a password somewhere — a service account, a computer account — managed by a human who was supposed to rotate it on schedule and usually didn't. That model quietly became obsolete the moment infrastructure started spinning up and disappearing in minutes instead of living for years, and most organizations are still running critical systems on it anyway. In this episode, Ernie and Josée trace how managed identities eliminate that problem entirely — no password exists anywhere, for anyone, ever, closing off an entire category of attack rather than just hardening it. Then we turn to the harder question: what do you do with the legacy application that still expects Active Directory to exist? We walk through both real architectural paths available today — Microsoft's Entra Domain Services, which recreates the legacy directory in the cloud, and the identity-aware gateway approach from Okta, Ping, and Keycloak, which modernizes access at the front door instead. Each is built for a different priority, and we lay out exactly how each one actually works under the hood. You'll leave knowing exactly how to eliminate static service accounts for good, and which of the two legitimate paths forward actually fits what your organization needs most. If you're the one deciding how legacy applications survive a cloud migration, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Sep 1

Day One of an M&A. Okta and Ping, Bloodhounds Sniffing Out Hidden Risk.

You just merged networks with a company that might already be compromised — and they can't tell you, because they don't know either. That's day one. Not a checklist item. A live, unknown risk sitting inside a network you now own. Then it gets worse: the person responsible for deciding who keeps access is a manager staring at a list of strangers, with zero context, under pressure to not break payroll. So they approve everything. That's how a breach nobody caught turns into a breach nobody's watching. In this episode, Ernie and Josée cover how Okta and Ping are actually built to survive that exact failure. Okta doesn't leave the judgment call to a confused manager — access gets bundled into pre-built packages so nobody's approving two hundred individual permissions blind. Ping goes further and contains the blast radius at the data level, filtering what someone can actually see down to the individual field, so legitimate access doesn't mean seeing everything. And when the acquired company genuinely doesn't know what it's hiding, we walk the exact forensic playbook for finding it yourself — financial records, DNS anomalies, TLS handshakes. You'll leave knowing exactly where the real exposure hides in an Okta or Ping integration, and how each platform actually contains it once you find it. If you're responsible for securing an integration like this, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Aug 25

Day One of the M&A. Okta and Ping Solve Day One Access Differently.

This episode gives you the exact mechanics for achieving day-one cross-org access with Okta and Ping: how to bridge an acquired company's on-prem Active Directory without touching it, how namespace collisions actually get resolved, and the full authentication chain that gets a legacy app working with zero code changes. In this episode, Ernie and Josée run the same day-one M&A scenario we covered on Microsoft Entra, this time through Okta and Ping. We trace how lightweight directory agents and PingFederate bridge an acquired company's on-prem AD without ever migrating it, how a namespace collision between two employees who happen to share a name gets resolved through mapping rules, and the full token-to-header chain that lets a federated user reach a legacy application it's never even heard of. We close with the exact SAML tracer workflow architects actually use to diagnose it when the frictionless login isn't so frictionless. You'll leave knowing exactly how to deliver real cross-organizational access in 48 hours — without a rip-and-replace migration and without a single exposed inbound port. If you're the one debugging this at 6 a.m. on launch day, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Aug 18

Every M&A Deal Carries Inherited Risk. Here's How Microsoft Entra Secures It.

This episode gives you the actual playbook for the risk you inherit in an M&A deal: how to migrate overlapping access groups without a naming collision, how to forensically expose shadow IT tenants before they become a backdoor, and why data migration servers keep becoming the entry point attackers actually use. In this episode, Ernie and Josée map the full M&A identity risk landscape — starting with the Marriott-Starwood breach, where an undetected intrusion sat inside the target company's network for years before and after the deal closed. We walk the actual mechanics of migrating groups and application access without collisions, then go hunting for shadow IT tenants using B2B graph data, expense reports, DNS telemetry, and TLS fingerprinting. We close with the Oracle-Cerner breach, and the uncomfortable architectural lesson it teaches: the temporary migration servers built to move the data are almost always less secure than either company's actual production environment. You'll leave knowing exactly where the real exposure hides in an M&A integration — and it's rarely where either company's security team is looking. If you're responsible for securing an integration like this, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Aug 11

Day One of the M&A. How Does Integration Start on Microsoft Entra?

This episode gives you the exact integration mechanics for Day One of an M&A: how to bring an acquired company's identities into your Entra ID tenant without a multi-year Active Directory consolidation project, and without opening a single inbound firewall port. In this episode, Ernie and Josée tear down three real integration scenarios — starting with the classic case of acquiring a legacy, on-prem-only organization. We trace the outbound-only cloud provisioning agent that keeps the acquired company's network fully isolated, the object GUID join-key math that stops two employees from colliding, and the security hardening that shuts down a real hard-match hijack vector. We also compare manual B2B guest collaboration against automated cross-tenant sync with group mirroring, and walk the full proxy chain that lets a cloud-only user reach a legacy mainframe app without a second password — plus the diagnostic tree for when any piece of that chain breaks. You'll leave knowing exactly how to get an acquired workforce productive on Day One without gambling your timeline on a domain migration. If you're the architect who'll actually own this integration, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Aug 4

Okta and Ping Promise Freedom From Active Directory. Do They Deliver?

By the end of this episode, you'll know exactly how Okta and Ping handle the same identity challenges Microsoft solves with Entra — so you can evaluate either platform on real mechanics instead of vendor promises. In this episode, Ernie and Josée run the same stress test from the Microsoft episode through Okta and Ping: attribute-level source-of-authority switching down to a single field, the SPNEGO handshake that lets a cloud-authenticated user walk into a Kerberos app without a login screen, and why a Layer 7 access gateway closes off lateral movement in a way a VPN never could. We also cover just-in-time elevation — ephemeral certificates that mint in seconds and expire on a timer, no standing access required. You'll leave knowing exactly where Okta and Ping's architecture matches Microsoft's approach, and where it genuinely differs. If you're evaluating Okta or Ping against Microsoft for this exact migration, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Jul 28

You Can Fire Active Directory. Can You Take the Keys Back?

By the end of this episode, you'll know exactly how a source-of-authority cutover happens without service disruption, and how to lock down every sensitive admin group so standing privilege — the thing attackers actually rely on — simply doesn't exist anymore. In this episode, Ernie and Josée go deep on the actual mechanics: the metadata flip that switches an object's source of authority without touching a single running session, why Cloud Kerberos Trust lets a pure cloud device walk into a legacy file share the domain controller has never heard of, and the June 2026 fix that closed a real hard-match hijack window for good. We close on zero standing privileges — how PIM for Groups turns eligible membership into a locked door that only opens on a verified, time-boxed request. You'll leave knowing exactly which controls govern your cutover risk, and how to make sure no admin account in your tenant sits privileged by default. If you're the one actually flipping these bits in production, not just approving the architecture diagram, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Jul 21

The Cloud Quietly Fired Active Directory

This episode gives you a working, accurate model of hybrid identity in 2026: where authority actually lives, how it's protected end to end, and exactly where your remaining legacy footprint still needs attention. No guessing, no assumptions — just the real architecture, so you can defend it properly. In this episode, Ernie and Josée open Season Two — Beyond the Domain — by tracing exactly how an identity gets created today, why the industry built a one-way valve to stop a single compromised on-prem account from climbing into the cloud, and why even cloud-forward enterprises still carry what the industry calls the "ugly 20 percent" — the slice of infrastructure that isn't migrating. You'll leave knowing whether your organization's hybrid state is a deliberate, secured architecture or an assumption nobody's tested lately — and exactly what to check first. If you're an identity architect or security lead responsible for that boundary, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Enterprise identity and access management isn't a product you buy — it's a program you build. The Identity Blueprint covers the full spectrum: seven-phase IAM frameworks, zero trust architecture, JIT access, FIDO2 passkeys, identity governance, and the operational models that hold up at enterprise scale. Built for practitioners who are past the basics. Hosted by Ernie and Josée.

Creator

Ernie Prescott
Years Active

2026
Episodes

16
Rating

Clean
Copyright

© 2026 The Identity Blueprint
Show Website

The Identity Blueprint