The Identity Blueprint

Ernie Prescott

0.0 (0)
Technology

Enterprise identity and access management isn't a product you buy — it's a program you build. The Identity Blueprint covers the full spectrum: seven-phase IAM frameworks, zero trust architecture, JIT access, FIDO2 passkeys, identity governance, and the operational models that hold up at enterprise scale. Built for practitioners who are past the basics. Hosted by Ernie and Josée.

3d ago

Why You Must Kill Your Certificate Authority

You can migrate every user to the cloud and retire every workload, and Active Directory still won't go away — because two systems, your certificate authority and Exchange Hybrid, are quietly holding the domain controller hostage. 🔐 In this episode, Ernie and Josée trace exactly how a low-privilege foothold — a phished user, an exposed ethernet jack — escalates into full domain compromise using nothing but native Windows features: coercing a domain controller into an NTLM handshake, relaying it to the certificate authority's web enrollment endpoint, and walking away with a certificate that mints a valid Ticket Granting Ticket. No custom exploit required. 🕵️ We map the invisible web of trust holding that certificate authority in place — 802.1X Wi-Fi, VPN client authentication, smart card login, internal TLS — and why a hard shutdown doesn't produce a clean failure, it produces weeks of cascading outages that look nothing like a certificate problem. 🌐 We debunk the "cloud mirage" assumption that Entra ID or Microsoft Cloud PKE can simply replace it, walk through the third-party platforms that actually bridge the gap, and cover the physical hardware problem post-quantum certificate sizes create for legacy network buffers. ⚛️ Then we turn to Exchange Hybrid's zombie server trap — a fully patched, fully vulnerable on-prem server whose only remaining job is editing text fields in a database — and the exact sequence that finally lets you retire it. 📧 You'll leave knowing exactly why these two systems block full Active Directory removal, and the precise migration sequence that finally lets you shut the domain controller down for good. If you're the one deciding when Active Directory can finally be retired, this episode is not optional. ✅ Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Oct 6

The Silent Killer of Active Directory Removal

Why is DNS the silent killer you don't see coming? Because the applications that kill your migration never touched DNS in the first place — so there's nothing in the logs to warn you. The error message will say "database unreachable." Your team will spend four hours on the SQL cluster. The actual problem died the second you turned off a domain controller nobody knew was still load-bearing. In this episode, Ernie and Josée start with the choice that shapes everything downstream: password hash sync versus pass-through authentication. One turns your password into an irreversible mathematical hash that lets your cloud apps keep running even if your entire data center goes dark. The other keeps validation strictly on-premises — a real compliance requirement in some industries, but one that creates a hard single point of failure. Then we go after the actual silent killer: legacy applications hard-coded to a domain controller's raw IP address, bypassing DNS entirely, so the moment that server finally goes offline, the failure looks like anything except what it actually is. We walk through why checking DNS logs gives you a false sense of safety, and the real discovery method — packet captures and raw network traffic analysis — that finds every hidden dependency before you ever pull the plug. You'll leave knowing exactly which authentication model fits your organization, and how to find the hard-coded dependencies that could sink your entire decommissioning project. If you're planning to power off your last domain controller, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Sep 29

What Actually Breaks When You Migrate GPOs

Ask to move one workload slider to Intune — just the Wi-Fi policy — and Microsoft silently drags your entire antivirus and BitLocker management along with it, whether you're ready or not. This episode is what actually breaks when you migrate off Group Policy, and why some of it isn't optional. In this episode, Ernie and Josée trace why there's no cloud version of SYSVOL — the file share every Group Policy Object depends on — and why Microsoft never built one on purpose: the protocol itself can't survive being run across the public internet at global scale. We walk the actual mechanics of Intune's replacement architecture, the brutal translation gap that trips up admins moving legacy GPOs over (a hard 4-megabyte size limit, English-only text, and WMI filters that fail to translate at all), and the hidden dependencies buried inside co-management's workload sliders — including the one that silently forces three separate workloads to move together whether an admin intended that or not. We close with the exact endpoint logs administrators actually check to prove a transition worked, instead of trusting a cloud portal that can lag behind reality. You'll leave knowing exactly what breaks first when you cut the cord to on-prem Active Directory, and the specific traps that catch even experienced admins off guard. If you're the one planning a Group Policy migration, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Sep 22

How to Govern 40 Isolated OT Tenants Centrally

Your identity governance model works perfectly for IT. Point it at OT, and it can shut down a pipeline, crash a controller, or worse — because the two environments don't just need different tools, they need opposite priorities. Antivirus, vulnerability scanners, centralized identity — everything you'd normally do to secure a system is exactly what breaks an OT environment. This episode is why the IT playbook fails here, and what actually works instead. In this episode, Ernie and Josée trace why active defense is physically impossible in industrial environments — endpoint agents introduce latency that can throw a chemical process out of tolerance, and standard vulnerability scanners can crash a legacy controller's network interface outright. With detection off the table, the only real option is passive visibility and rigid isolation instead. We walk through the 40-tenant silo model: completely separate identity environments per facility, with zero trust relationships between them, connected back to headquarters only through outbound-only sync agents so a compromise in one facility can never become a master key into the rest. We close on the hardest tension in the entire model — how to keep zero standing privilege everywhere, while still guaranteeing an engineer can act immediately during a 2 a.m. physical emergency. You'll leave knowing exactly why IT security instincts fail in industrial environments, and the architecture that actually holds up in their place. If you're responsible for identity in an OT or critical infrastructure environment, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Sep 15

Why Your Web Firewall Is an Inside Threat

The attacker never had a password. They just asked a piece of hardware a simple question, and it handed over the keys to 700 storage buckets — because nobody had drawn a hard line between proving who someone is and deciding what they're allowed to touch. In this episode, Ernie and Josée break down the real architectural divide behind that failure: Microsoft Entra ID as the passport office that verifies who you are, and AWS IAM as the mechanical locksmith that's never once asked. We trace how SCIM keeps the two in sync automatically, like an aggressive HR department for the cloud, and how Cedar — AWS's mathematically verified policy language — replaces static role checks with authorization decisions made fresh on every single request. We close with the payoff: an employee in a coffee shop reaching a twenty-year-old Kerberos application with zero VPN, zero exposed ports, and one seamless identity-aware proxy doing the translation invisibly in the background. You'll leave knowing exactly where authentication ends and authorization begins — and why collapsing that line is how a single overprivileged role turns into a headline breach. If you're the one deciding what a cloud role is actually allowed to touch, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Sep 8

Secure Your Infrastructure Without Service Accounts

For twenty years, every server and every application in your environment had a password somewhere — a service account, a computer account — managed by a human who was supposed to rotate it on schedule and usually didn't. That model quietly became obsolete the moment infrastructure started spinning up and disappearing in minutes instead of living for years, and most organizations are still running critical systems on it anyway. In this episode, Ernie and Josée trace how managed identities eliminate that problem entirely — no password exists anywhere, for anyone, ever, closing off an entire category of attack rather than just hardening it. Then we turn to the harder question: what do you do with the legacy application that still expects Active Directory to exist? We walk through both real architectural paths available today — Microsoft's Entra Domain Services, which recreates the legacy directory in the cloud, and the identity-aware gateway approach from Okta, Ping, and Keycloak, which modernizes access at the front door instead. Each is built for a different priority, and we lay out exactly how each one actually works under the hood. You'll leave knowing exactly how to eliminate static service accounts for good, and which of the two legitimate paths forward actually fits what your organization needs most. If you're the one deciding how legacy applications survive a cloud migration, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Sep 1

Day One of an M&A. Okta and Ping, Bloodhounds Sniffing Out Hidden Risk.

You just merged networks with a company that might already be compromised — and they can't tell you, because they don't know either. That's day one. Not a checklist item. A live, unknown risk sitting inside a network you now own. Then it gets worse: the person responsible for deciding who keeps access is a manager staring at a list of strangers, with zero context, under pressure to not break payroll. So they approve everything. That's how a breach nobody caught turns into a breach nobody's watching. In this episode, Ernie and Josée cover how Okta and Ping are actually built to survive that exact failure. Okta doesn't leave the judgment call to a confused manager — access gets bundled into pre-built packages so nobody's approving two hundred individual permissions blind. Ping goes further and contains the blast radius at the data level, filtering what someone can actually see down to the individual field, so legitimate access doesn't mean seeing everything. And when the acquired company genuinely doesn't know what it's hiding, we walk the exact forensic playbook for finding it yourself — financial records, DNS anomalies, TLS handshakes. You'll leave knowing exactly where the real exposure hides in an Okta or Ping integration, and how each platform actually contains it once you find it. If you're responsible for securing an integration like this, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Aug 25

Day One of the M&A. Okta and Ping Solve Day One Access Differently.

This episode gives you the exact mechanics for achieving day-one cross-org access with Okta and Ping: how to bridge an acquired company's on-prem Active Directory without touching it, how namespace collisions actually get resolved, and the full authentication chain that gets a legacy app working with zero code changes. In this episode, Ernie and Josée run the same day-one M&A scenario we covered on Microsoft Entra, this time through Okta and Ping. We trace how lightweight directory agents and PingFederate bridge an acquired company's on-prem AD without ever migrating it, how a namespace collision between two employees who happen to share a name gets resolved through mapping rules, and the full token-to-header chain that lets a federated user reach a legacy application it's never even heard of. We close with the exact SAML tracer workflow architects actually use to diagnose it when the frictionless login isn't so frictionless. You'll leave knowing exactly how to deliver real cross-organizational access in 48 hours — without a rip-and-replace migration and without a single exposed inbound port. If you're the one debugging this at 6 a.m. on launch day, this episode is not optional. Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Enterprise identity and access management isn't a product you buy — it's a program you build. The Identity Blueprint covers the full spectrum: seven-phase IAM frameworks, zero trust architecture, JIT access, FIDO2 passkeys, identity governance, and the operational models that hold up at enterprise scale. Built for practitioners who are past the basics. Hosted by Ernie and Josée.

Creator

Ernie Prescott
Years Active

2026
Episodes

21
Rating

Clean
Copyright

© 2026 The Identity Blueprint
Show Website

The Identity Blueprint