Lab · 14 / 16
How the pieces connect.
This is the shape most medium and large companies converge on. Walk through a normal working life: someone joins, signs in every day, asks for access, does an admin task, gets attacked and finally leaves.
Scenario 1 of 8
Five layers
In plain words From the top: where people come from, who decides their access, who checks them at the door, what they reach, and who watches.
Each layer has one job. Governance decides, the identity core enforces, resources trust the core, monitoring sees everything. Problems start when a layer is skipped, such as accounts created directly in an app.
Scenario 2 of 8
Joiner: Ada is hired
In plain words HR enters the new hire once, and the accounts she needs appear on their own before her first day.
The HR record triggers IGA. Birthright roles, based on department and location, create the directory account, the groups and the SaaS accounts through SCIM or connectors.
Scenario 3 of 8
Every day: one sign-in
In plain words One check at the door in the morning, then every room opens without a new password.
The IdP authenticates with MFA or a passkey, evaluates conditional access (device, location, risk) and federates to apps with OIDC or SAML. Apps never store passwords.
Scenario 4 of 8
Extra access: request and review
In plain words Anything beyond the basics is asked for, approved and checked again later.
Requests go through IGA with SoD checks and approvals, then provisioning. Periodic access reviews and reconciliation catch what is no longer needed or was granted outside the process.
Scenario 5 of 8
Privileged task
In plain words Admins use a separate, watched door for the most dangerous rooms.
Admins sign in to PAM through the IdP with strong MFA, get just-in-time access to one server, and work through a recorded session. IGA decides who may become an admin in the first place.
Scenario 6 of 8
Detection and response
In plain words Cameras in every corridor: a login from two countries in ten minutes raises an alarm.
Sign-in logs, admin sessions and directory changes flow to the SIEM. ITDR watches the identity systems themselves for attacks such as token theft, MFA fatigue or a new domain admin. Response can revoke sessions at the IdP.
Scenario 7 of 8
Leaver: Ada leaves
In plain words One change in HR, and every badge is switched off the same day.
The termination event disables the directory account, revokes IdP sessions, removes SaaS accounts and any privileged access. Forgotten accounts of former employees are one of the most common audit findings.
Scenario 8 of 8
Principles to keep
In plain words One source of truth, one front door, no permanent master keys, and someone always watching.
HR drives the lifecycle. Every app federates to one IdP. Least privilege, with no standing admin rights. Phishing-resistant MFA for everyone, starting with admins. Treat the IdP, the directory and PAM as tier 0: if they fall, everything falls.