The Identity Blueprint
Ernie Prescott
Enterprise identity and access management isn't a product you buy — it's a program you build. The Identity Blueprint covers the full spectrum: seven-phase IAM frameworks, zero trust architecture, JIT access, FIDO2 passkeys, identity governance, and the operational models that hold up at enterprise scale. Built for practitioners who are past the basics. Hosted by Ernie and Josée.
Episodes
Why You Must Kill Your Certificate Authority
You can migrate every user to the cloud and retire every workload, and Active Directory still won't go away — because two systems, your certificate authority and Exchange Hybrid, are quietly holding the domain controller hostage. 🔐In this episode, Ernie and Josée trace exactly how a low-privilege foothold — a phished user, an exposed ethernet jack — escalates into full domain compromise using nothing but native Windows features: coercing a domain controller into an NTLM handshake, relaying it to the certificate authority's web enrollment endpoint, and walking away with a certificate that mints a valid Ticket Granting Ticket. No custom exploit required. 🕵️We map the invisible web of trust holding that certificate authority in place — 802.1X Wi-Fi, VPN client authentication, smart card login, internal TLS — and why a hard shutdown doesn't produce a clean failure, it produces weeks of cascading outages that look nothing like a certificate problem. 🌐We debunk the "cloud mirage" assumption that Entra ID or Microsoft Cloud PKE can simply replace it, walk through the third-party platforms that actually bridge the gap, and cover the physical hardware problem post-quantum certificate sizes create for legacy network buffers. ⚛️Then we turn to Exchange Hybrid's zombie server trap — a fully patched, fully vulnerable on-prem server whose only remaining job is editing text fields in a database — and the exact sequence that finally lets you retire it. 📧You'll leave knowing exactly why these two systems block full Active Directory removal, and the precise migration sequence that finally lets you shut the domain controller down for good.If you're the one deciding when Active Directory can finally be retired, this episode is not optional. ✅Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
The Silent Killer of Active Directory Removal
Why is DNS the silent killer you don't see coming? Because the applications that kill your migration never touched DNS in the first place — so there's nothing in the logs to warn you. The error message will say "database unreachable." Your team will spend four hours on the SQL cluster. The actual problem died the second you turned off a domain controller nobody knew was still load-bearing.In this episode, Ernie and Josée start with the choice that shapes everything downstream: password hash sync versus pass-through authentication. One turns your password into an irreversible mathematical hash that lets your cloud apps keep running even if your entire data center goes dark. The other keeps validation strictly on-premises — a real compliance requirement in some industries, but one that creates a hard single point of failure. Then we go after the actual silent killer: legacy applications hard-coded to a domain controller's raw IP address, bypassing DNS entirely, so the moment that server finally goes offline, the failure looks like anything except what it actually is. We walk through why checking DNS logs gives you a false sense of safety, and the real discovery method — packet captures and raw network traffic analysis — that finds every hidden dependency before you ever pull the plug.You'll leave knowing exactly which authentication model fits your organization, and how to find the hard-coded dependencies that could sink your entire decommissioning project.If you're planning to power off your last domain controller, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
What Actually Breaks When You Migrate GPOs
Ask to move one workload slider to Intune — just the Wi-Fi policy — and Microsoft silently drags your entire antivirus and BitLocker management along with it, whether you're ready or not. This episode is what actually breaks when you migrate off Group Policy, and why some of it isn't optional.In this episode, Ernie and Josée trace why there's no cloud version of SYSVOL — the file share every Group Policy Object depends on — and why Microsoft never built one on purpose: the protocol itself can't survive being run across the public internet at global scale. We walk the actual mechanics of Intune's replacement architecture, the brutal translation gap that trips up admins moving legacy GPOs over (a hard 4-megabyte size limit, English-only text, and WMI filters that fail to translate at all), and the hidden dependencies buried inside co-management's workload sliders — including the one that silently forces three separate workloads to move together whether an admin intended that or not. We close with the exact endpoint logs administrators actually check to prove a transition worked, instead of trusting a cloud portal that can lag behind reality.You'll leave knowing exactly what breaks first when you cut the cord to on-prem Active Directory, and the specific traps that catch even experienced admins off guard.If you're the one planning a Group Policy migration, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
How to Govern 40 Isolated OT Tenants Centrally
Your identity governance model works perfectly for IT. Point it at OT, and it can shut down a pipeline, crash a controller, or worse — because the two environments don't just need different tools, they need opposite priorities. Antivirus, vulnerability scanners, centralized identity — everything you'd normally do to secure a system is exactly what breaks an OT environment. This episode is why the IT playbook fails here, and what actually works instead.In this episode, Ernie and Josée trace why active defense is physically impossible in industrial environments — endpoint agents introduce latency that can throw a chemical process out of tolerance, and standard vulnerability scanners can crash a legacy controller's network interface outright. With detection off the table, the only real option is passive visibility and rigid isolation instead. We walk through the 40-tenant silo model: completely separate identity environments per facility, with zero trust relationships between them, connected back to headquarters only through outbound-only sync agents so a compromise in one facility can never become a master key into the rest. We close on the hardest tension in the entire model — how to keep zero standing privilege everywhere, while still guaranteeing an engineer can act immediately during a 2 a.m. physical emergency.You'll leave knowing exactly why IT security instincts fail in industrial environments, and the architecture that actually holds up in their place.If you're responsible for identity in an OT or critical infrastructure environment, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Why Your Web Firewall Is an Inside Threat
The attacker never had a password. They just asked a piece of hardware a simple question, and it handed over the keys to 700 storage buckets — because nobody had drawn a hard line between proving who someone is and deciding what they're allowed to touch.In this episode, Ernie and Josée break down the real architectural divide behind that failure: Microsoft Entra ID as the passport office that verifies who you are, and AWS IAM as the mechanical locksmith that's never once asked. We trace how SCIM keeps the two in sync automatically, like an aggressive HR department for the cloud, and how Cedar — AWS's mathematically verified policy language — replaces static role checks with authorization decisions made fresh on every single request. We close with the payoff: an employee in a coffee shop reaching a twenty-year-old Kerberos application with zero VPN, zero exposed ports, and one seamless identity-aware proxy doing the translation invisibly in the background.You'll leave knowing exactly where authentication ends and authorization begins — and why collapsing that line is how a single overprivileged role turns into a headline breach.If you're the one deciding what a cloud role is actually allowed to touch, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Secure Your Infrastructure Without Service Accounts
For twenty years, every server and every application in your environment had a password somewhere — a service account, a computer account — managed by a human who was supposed to rotate it on schedule and usually didn't. That model quietly became obsolete the moment infrastructure started spinning up and disappearing in minutes instead of living for years, and most organizations are still running critical systems on it anyway.In this episode, Ernie and Josée trace how managed identities eliminate that problem entirely — no password exists anywhere, for anyone, ever, closing off an entire category of attack rather than just hardening it. Then we turn to the harder question: what do you do with the legacy application that still expects Active Directory to exist? We walk through both real architectural paths available today — Microsoft's Entra Domain Services, which recreates the legacy directory in the cloud, and the identity-aware gateway approach from Okta, Ping, and Keycloak, which modernizes access at the front door instead. Each is built for a different priority, and we lay out exactly how each one actually works under the hood.You'll leave knowing exactly how to eliminate static service accounts for good, and which of the two legitimate paths forward actually fits what your organization needs most.If you're the one deciding how legacy applications survive a cloud migration, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Day One of an M&A. Okta and Ping, Bloodhounds Sniffing Out Hidden Risk.
You just merged networks with a company that might already be compromised — and they can't tell you, because they don't know either. That's day one. Not a checklist item. A live, unknown risk sitting inside a network you now own.Then it gets worse: the person responsible for deciding who keeps access is a manager staring at a list of strangers, with zero context, under pressure to not break payroll. So they approve everything. That's how a breach nobody caught turns into a breach nobody's watching.In this episode, Ernie and Josée cover how Okta and Ping are actually built to survive that exact failure. Okta doesn't leave the judgment call to a confused manager — access gets bundled into pre-built packages so nobody's approving two hundred individual permissions blind. Ping goes further and contains the blast radius at the data level, filtering what someone can actually see down to the individual field, so legitimate access doesn't mean seeing everything. And when the acquired company genuinely doesn't know what it's hiding, we walk the exact forensic playbook for finding it yourself — financial records, DNS anomalies, TLS handshakes.You'll leave knowing exactly where the real exposure hides in an Okta or Ping integration, and how each platform actually contains it once you find it.If you're responsible for securing an integration like this, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Day One of the M&A. Okta and Ping Solve Day One Access Differently.
This episode gives you the exact mechanics for achieving day-one cross-org access with Okta and Ping: how to bridge an acquired company's on-prem Active Directory without touching it, how namespace collisions actually get resolved, and the full authentication chain that gets a legacy app working with zero code changes.In this episode, Ernie and Josée run the same day-one M&A scenario we covered on Microsoft Entra, this time through Okta and Ping. We trace how lightweight directory agents and PingFederate bridge an acquired company's on-prem AD without ever migrating it, how a namespace collision between two employees who happen to share a name gets resolved through mapping rules, and the full token-to-header chain that lets a federated user reach a legacy application it's never even heard of. We close with the exact SAML tracer workflow architects actually use to diagnose it when the frictionless login isn't so frictionless.You'll leave knowing exactly how to deliver real cross-organizational access in 48 hours — without a rip-and-replace migration and without a single exposed inbound port.If you're the one debugging this at 6 a.m. on launch day, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Every M&A Deal Carries Inherited Risk. Here's How Microsoft Entra Secures It.
This episode gives you the actual playbook for the risk you inherit in an M&A deal: how to migrate overlapping access groups without a naming collision, how to forensically expose shadow IT tenants before they become a backdoor, and why data migration servers keep becoming the entry point attackers actually use.In this episode, Ernie and Josée map the full M&A identity risk landscape — starting with the Marriott-Starwood breach, where an undetected intrusion sat inside the target company's network for years before and after the deal closed. We walk the actual mechanics of migrating groups and application access without collisions, then go hunting for shadow IT tenants using B2B graph data, expense reports, DNS telemetry, and TLS fingerprinting. We close with the Oracle-Cerner breach, and the uncomfortable architectural lesson it teaches: the temporary migration servers built to move the data are almost always less secure than either company's actual production environment.You'll leave knowing exactly where the real exposure hides in an M&A integration — and it's rarely where either company's security team is looking.If you're responsible for securing an integration like this, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Day One of the M&A. How Does Integration Start on Microsoft Entra?
This episode gives you the exact integration mechanics for Day One of an M&A: how to bring an acquired company's identities into your Entra ID tenant without a multi-year Active Directory consolidation project, and without opening a single inbound firewall port.In this episode, Ernie and Josée tear down three real integration scenarios — starting with the classic case of acquiring a legacy, on-prem-only organization. We trace the outbound-only cloud provisioning agent that keeps the acquired company's network fully isolated, the object GUID join-key math that stops two employees from colliding, and the security hardening that shuts down a real hard-match hijack vector. We also compare manual B2B guest collaboration against automated cross-tenant sync with group mirroring, and walk the full proxy chain that lets a cloud-only user reach a legacy mainframe app without a second password — plus the diagnostic tree for when any piece of that chain breaks.You'll leave knowing exactly how to get an acquired workforce productive on Day One without gambling your timeline on a domain migration.If you're the architect who'll actually own this integration, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Okta and Ping Promise Freedom From Active Directory. Do They Deliver?
By the end of this episode, you'll know exactly how Okta and Ping handle the same identity challenges Microsoft solves with Entra — so you can evaluate either platform on real mechanics instead of vendor promises.In this episode, Ernie and Josée run the same stress test from the Microsoft episode through Okta and Ping: attribute-level source-of-authority switching down to a single field, the SPNEGO handshake that lets a cloud-authenticated user walk into a Kerberos app without a login screen, and why a Layer 7 access gateway closes off lateral movement in a way a VPN never could. We also cover just-in-time elevation — ephemeral certificates that mint in seconds and expire on a timer, no standing access required.You'll leave knowing exactly where Okta and Ping's architecture matches Microsoft's approach, and where it genuinely differs.If you're evaluating Okta or Ping against Microsoft for this exact migration, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
You Can Fire Active Directory. Can You Take the Keys Back?
By the end of this episode, you'll know exactly how a source-of-authority cutover happens without service disruption, and how to lock down every sensitive admin group so standing privilege — the thing attackers actually rely on — simply doesn't exist anymore.In this episode, Ernie and Josée go deep on the actual mechanics: the metadata flip that switches an object's source of authority without touching a single running session, why Cloud Kerberos Trust lets a pure cloud device walk into a legacy file share the domain controller has never heard of, and the June 2026 fix that closed a real hard-match hijack window for good. We close on zero standing privileges — how PIM for Groups turns eligible membership into a locked door that only opens on a verified, time-boxed request.You'll leave knowing exactly which controls govern your cutover risk, and how to make sure no admin account in your tenant sits privileged by default.If you're the one actually flipping these bits in production, not just approving the architecture diagram, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
The Cloud Quietly Fired Active Directory
This episode gives you a working, accurate model of hybrid identity in 2026: where authority actually lives, how it's protected end to end, and exactly where your remaining legacy footprint still needs attention. No guessing, no assumptions — just the real architecture, so you can defend it properly.In this episode, Ernie and Josée open Season Two — Beyond the Domain — by tracing exactly how an identity gets created today, why the industry built a one-way valve to stop a single compromised on-prem account from climbing into the cloud, and why even cloud-forward enterprises still carry what the industry calls the "ugly 20 percent" — the slice of infrastructure that isn't migrating.You'll leave knowing whether your organization's hybrid state is a deliberate, secured architecture or an assumption nobody's tested lately — and exactly what to check first.If you're an identity architect or security lead responsible for that boundary, this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Identity Program Operations and Metrics
Your dashboard says everything is fine. Intrusion detection normal. Firewall active. MFA compliance at 98%. Meanwhile, somewhere in your environment right now, credentials are being harvested and nobody's metric is moving. That is not a security program. That is an expensive illusion of one.In this episode, Ernie and Josée decode Phase 7 of the IAM engagement blueprint: operationalization and metrics. Drawing from SailPoint, CyberArk, Ping Identity, Okta, NIST, and CISA — this is the episode that defines what a living, breathing IAM operating model actually looks like in production. The four-tier human architecture, JML velocity metrics, the psychology of the access review rubber stamp, and the KPI dashboard that tells you whether you are mathematically secure or just compliant on paper.You'll leave knowing the difference between believing you are secure and being able to prove it — and exactly which dials to watch to know when something is wrong before your auditors find it first.If you are responsible for an identity program that is already live — this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Planning Successful Identity Management Rollouts
The most dangerous assumption in any identity rollout is that the hard part is technical. It isn't. The hard part is the manager who needs access right now and doesn't care how it gets done. The administrator who knows the bypass is wrong but creates it anyway. And the organization that spent millions on the architecture and nothing on planning for either of them.In this episode, Ernie and Josée tear apart Phase 6 of the IAM engagement blueprint: implementation planning. From translating a three-year strategic vision into granular executable projects, to mapping the dependencies that silently kill timelines, to the brutal honest assessment of whether your current team is actually equipped to build what the architecture demands.You'll leave knowing why IAM programs almost never fail because the code is broken — and exactly what to do about the three things that actually bring them down.If you've ever watched a multi-million dollar rollout collapse on launch day — this episode explains why, and how to make sure it never happens again.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
The Nine Layers of Identity Architecture
Most organizations buy identity technology one piece at a time. A directory here. An MFA solution there. A PAM tool when the auditors ask for it. The result is nine disconnected layers that were never designed to work together — and an architecture that fails the moment it's tested.In this episode, Ernie and Josée decode Phase 5 of the IAM engagement blueprint: the technology architecture and three-year roadmap. Nine distinct functional layers — from the foundational directory and identity provider, through IGA and PAM, to non-human identity governance, ITDR, CIEM, and ZTNA — mapped, sequenced, and engineered to work as a single coherent system.You'll leave knowing exactly how to structure a realistic deployment across three horizons, why skipping steps is fatal, and what separates organizations that simply buy software from those that actually engineer a security program.If you're an architect or IT leader responsible for making all of this work together — this is the episode that hands you the architecture.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Securing Identities from Hire to Fire
Your employee submitted their resignation on Friday. By Monday morning their access was still fully active. Every system. Every application. Every privilege they ever accumulated.In this episode, Ernie and Josée go deep on Phase 4 of the IAM engagement blueprint: process and lifecycle design. The joiner, the mover, the leaver — every transition point in the human identity lifecycle where access gets granted, recalculated, and revoked. From birthright provisioning on day one, to separation of duties enforcement when someone changes roles, to the instant revocation mechanisms that close the latency window the moment someone walks out the door.You'll leave knowing exactly how a minor paperwork delay in HR becomes a fired employee with full access to your financial systems on a Friday night — and how to engineer that window permanently shut.If identity lifecycle is your responsibility — or it should be and nobody has claimed it yet — this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Why Identity Governance Must Lead Technology
Season 1, Episode 4: You automated your practices. You accelerated your procedures. Yet you're still failing your audits. Your platform isn't fixing your identity problem — it's accelerating it. And right now, you're operating blindly when you should be seeing everything.In this episode, Ernie and Josée break down Phase 3 of the IAM engagement blueprint: the policy and governance framework. Drawing from the Identity Management Institute, Microsoft Entra, SailPoint, Ping Identity, Okta, and CISA — this is the episode that establishes why governance isn't a phase you revisit after deployment. It's the conductor. Everything else is the orchestra.If you're a CISO, a VP, or an architect responsible for an identity program and the technology is already live — this episode is not optional.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Identity Strategy and Target State Design
Season 1, Episode 3: Identity isn't a technology problem. It's a strategy problem. And until your executive team agrees on where you're going, every platform you buy and every policy you write is just expensive guesswork.In this episode, Ernie and Josée map out Phase 2 of the IAM engagement blueprint: Identity Strategy and Target State Design. From building an executive vision that gets the CFO to write the check, to designing a target state capability map that governs employees, contractors, and autonomous AI agents — this is the episode that turns discovery into direction.You'll leave knowing how to design a zero-trust architecture that actually gets funded, and why skipping the decision gate guarantees failure regardless of the technology you choose.If you're an architect ready to stop fighting fires and start building something that lasts — this is your blueprint.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
Executing a Ruthless Identity Security Autopsy
Season 1, Episode 2: You can spend millions securing the front door. Vault-grade authentication. Biometric access controls. Armed monitoring around the clock. And an attacker will walk right past all of it — through the forgotten maintenance tunnel you didn't know existed. In this episode, Ernie and Josée execute Phase 1 of the IAM engagement blueprint: the identity security autopsy. A keystroke-level discovery process that surfaces every ghost account, shadow identity, and orphaned credential hiding in your environment before you build a single thing on top of them.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott
The Seven Phase Identity Security Blueprint
Season 1, Episode 1: One forgotten password. One orphaned VPN account with no MFA. That's all it took to shut down half the fuel supply of the United States East Coast. In this episode, Ernie and Josée unpack the seven-phase IAM Program Engagement Blueprint — the complete, sequenced framework for taking an enterprise from identity chaos to a governed, mathematically verifiable security program. From executive scoping to continuous operations, this is the architecture that separates organizations that get identity right from those that make headlines.Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott