IAM Projects & Notes
Things I'm building, testing, breaking, and learning.
End-to-End IAM, Part 1: The Architecture Behind Elytra and Ascendra
A deep dive into the architectural decision behind end-to-end-iam: why the HR system Elytra and the IGA platform Ascendra are kept fully separate, and how an event-driven outbox keeps them in sync anyway.
End-to-End IAM, Part 2: Provisioning to Entra ID with Microsoft Graph
A deep dive into how Ascendra actually provisions real accounts in Entra ID: why SCIM wasn't the right solution, how the Client Credentials flow works, and why UPN and email aren't the same thing.
End-to-End IAM, Part 3: How Reconciliation and JML Work
A deep dive into why event-driven provisioning isn't enough on its own, how periodic reconciliation catches what falls through the cracks, and the Resync bug that re-enabled a terminated user.
End-to-End IAM: From HR to Entra ID with Elytra and Ascendra
A fictional HR and IGA system that provisions real accounts in Entra ID via Microsoft Graph — JML flows, reconciliation, and a bug that re-enabled a terminated user.
OpenID Connect Authentication with Microsoft Entra ID
Building a Flask application that authenticates users through Microsoft Entra ID using OpenID Connect and OAuth 2.0 — to understand how Authorization Code Flow, ID Tokens, and Access Tokens work in practice.
Identity-Centric Security Design for Healthcare
Designing identity, access management and security controls for a small healthcare organization — built around Microsoft Entra ID as the central identity platform.
Conditional Access & Identity Protection
Risk-based Conditional Access and Identity Protection in Microsoft Entra ID — creating policies that force MFA on risky sign-ins and understand the difference between user risk and sign-in risk.
Cloudflare Access Federation with Entra ID
Federation, OIDC authentication and automatic SCIM provisioning between Entra ID and Cloudflare Access — step by step with common pitfalls documented.
AI-Assisted Azure RBAC Analysis
Combine Azure RBAC data with a local AI model (Ollama/llama3) and PowerShell to automatically identify over-privileged access and least privilege violations.
JML Monitor for Microsoft Entra ID
Built a JML monitor (Joiner-Mover-Leaver) for Microsoft Entra ID with Python and Graph API — to track group changes and detect access drift.
Hybrid Identity with Active Directory and Microsoft Entra ID
Build a hybrid identity environment with Windows Server 2022, Active Directory and Entra Connect — step by step from empty VM to synced identity environment.