Skills

Identities, authentication vs authorization, least privilege, RBAC vs ABAC and the identity lifecycle.

Build a domain from scratch: forests, OUs, GPOs, DNS, sites, replication and FSMO roles.

How Windows authentication actually works on the wire, and how to troubleshoot it.

Enterprise AD CS hierarchy, certificate template hardening, GPO auto-enrollment, NDES SCEP, and Entra ID Certificate-Based Authentication (CBA).

Tenants, users, groups, licenses, admin roles and app registrations in Microsoft Entra ID.

Sync on-prem AD to Entra ID with Connect Sync or Cloud Sync — PHS, PTA, federation and seamless SSO.

Design a Zero Trust Conditional Access baseline — MFA, device compliance, locations and session controls.

Just-in-time admin access with approvals, MFA on activation and access reviews.

Entitlement management, access packages, access reviews, lifecycle workflows and HR-driven provisioning.

Automate Entra ID with Microsoft Graph, the Graph PowerShell SDK and managed identities.

Your first Okta org: users, groups, directories, the AD agent and the Okta Integration Network.

Connect apps with SAML and OIDC, provision users automatically and map profiles.

Authenticators, global session and app sign-in policies, FastPass and ThreatInsight.

No-code enterprise identity lifecycle automation: event hooks, connector cards, Okta Tables, scheduled audit flows, and automated JML deprovisioning.

Secure web apps and REST APIs with Okta: OIDC Authorization Code Flow with PKCE, custom authorization servers, dynamic JWT scopes, and Management SDKs.

Tokens, flows and scopes — decode real JWTs and integrate an app with Entra ID.

Configure SAML SSO for SaaS apps, read assertions and fix the usual errors.

Automated user and group lifecycle synchronization with SCIM 2.0 protocol: Entra ID and Okta to SaaS apps, custom expression mapping, and quarantine triage.

Scopes, built-in and custom roles, ABAC conditions, managed identities and workload identity federation.

Policies, roles, SCPs, permission boundaries and SSO into AWS from Entra ID.

Enterprise Google Cloud access governance: resource hierarchy, least-privilege custom roles, keyless service accounts, and workforce identity federation.

Design identity as the control plane: verify explicitly, least privilege, assume breach.

Entra ID Protection, Defender for Identity and hunting identity attacks in KQL.

Deploy phishing-resistant authentication: FIDO2 security keys, WebAuthn passkeys, Windows Hello for Business (WHfB), Temporary Access Pass, and SSSD Linux SSO.