Identity Lab · Free with membership
Learning Lab
Identity, one domain at a time. 13 tracks and 81 modules so far, each a short narrated lesson and a hands-on exercise, mapped to CISSP, CCSP, SC-300.
How a module works
About ten minutes each. Nothing you pick leaves your browser.
- 1A narrated lessonA few minutes with sound, captions and a transcript. Each one opens on something that went wrong at a company, then explains why.
- 2A hands-on exerciseA sign-in log, a policy or an inventory to work through: find what doesn't belong, name it, and choose the first move.
- 3The debriefWhat gave it away, the rule to automate, and how to stop it happening again, with the sources it was checked against.
The tracks
One per domain of the Lab's framework.
Domain 01 8 modulesIdentity Fundamentals & Directory ServicesJoiners, movers and leavers · One person, one identity · Identity data: sources of truth · Active Directory, and what to protect · LDAP, read and written · Microsoft Entra ID and cloud directories · Groups and roles · Hybrid identity
Domain 02 9 modulesAuthentication & CredentialsPhishing-resistant MFA · Going passwordless · Password policy, the NIST way · Account recovery and self-service reset · Single sign-on and sessions · Adaptive authentication · NTLM, and how to retire it · RADIUS and TACACS+ · Local and remote access
Domain 03 7 modulesFederation & Identity StandardsSAML, and the key that signs everything · OAuth: delegation, done safely · OpenID Connect: who signed in · Token security: whoever holds it · App registrations and consent · Federating with partners · SCIM: accounts follow the directory
Domain 04 7 modulesAuthorization & Access ModelsAccess control models, and who decides · Roles, and the role explosion · Attributes, policies, and the engine that decides · Least privilege, and separation of duties · Entitlement management: access with an end date · Authorization in the cloud · Roles in Microsoft Entra, and in your apps
Domain 05 6 modulesIdentity Governance & AdministrationProvisioning, and the accounts nobody asked for · Access reviews that actually remove access · Separation-of-duty violations, and exceptions · Inside an IGA platform · Identity analytics: the access that doesn’t fit · Lifecycle workflows, and guests who leave
Domain 06 7 modulesPrivileged Access ManagementVaults, check-out, and rotation · Privileged sessions, brokered and recorded · Just in time, and zero standing privilege · Secrets: out of code, and out of reach · Running a PAM program · Service accounts, and the paths to admin · Emergency access accounts
Domain 07 6 modulesCloud & Workload IdentityAWS IAM: roles, not keys · Azure and Google Cloud identity · Workload identity: the accounts software uses · Kubernetes identity · CIEM, and entitlement sprawl · Workload identity federation- Domain 08 5 modulesZero Trust & Modern Identity ArchitectureZero trust: no trust by location · Continuous access evaluation · Device trust · AI agents, and non-human identity · Identity-aware network access
Domain 09 6 modulesIdentity Threats & Security OperationsIdentity attack techniques · Detection and ITDR · Active Directory hardening and tiering · Identity incident response · Risk-based protection · Sign-in and audit logs
Domain 10 6 modulesCompliance, Risk & AuditRegulatory drivers · Frameworks in practice · Audit support and evidence · Access risk management · Cloud compliance and audit reports · Identity Secure Score and reporting
Domain 11 5 modulesAutomation & EngineeringScripting for identity · APIs and integration · Identity as code · Troubleshooting method · Cross-tenant synchronization
Domain 12 4 modulesCommunication & Professional SkillsStakeholder communication · Documentation and runbooks · Delivery and vendor management · Judgment and prioritization
Domain 13 5 modulesCustomer IAM (CIAM)Customer identity architecture · Consent and privacy · Fraud and bot defense · Scale and user experience · Identity proofing
Free with membershipSign up with your email and the link we send is your way in: no password, no newsletter. Members also get 9 signal hunts, a map of the domains against CISSP, CCSP, SC-300, and the tabletop scenarios each module points to. Free in the meantime: protocol practice and the self-assessment.Join free
CISSP and CCSP are marks of ISC2, and Security+ is a mark of CompTIA. The Lab maps to these outlines; it isn't endorsed by ISC2, CompTIA, Microsoft or IDPro.