Lesson 2 of 414 min

Identity architecture at scale

Conditional Access design, PIM (Privileged Identity Management), privileged access workstations, identity governance.

Organizational directory structure on a laptop screen — Photo by Christina Morillo on Pexels

Conditional Access: persona-based policy sets (e.g. internal user, external guest, admin). Block legacy auth as the floor.

Privileged Identity Management (PIM): just-in-time elevation. Permanent Global Admins are a smell.

Diagram · Active Directory hierarchy

Privileged Access Workstations (PAW (Privileged Access Workstation)): admins use a hardened, isolated device for admin tasks — never their daily driver.

Key takeaways

▸Persona-based CA (Conditional Access) scales
▸PIM removes standing privilege
▸PAW limits credential theft blast radius

Next: Incident response design →