The Identity Blueprint

Why is DNS the silent killer you don't see coming? Because the applications that kill your migration never touched DNS in the first place — so there's nothing in the logs to warn you. The error message will say "database unreachable." Your team will spend four hours on the SQL cluster. The actual problem died the second you turned off a domain controller nobody knew was still load-bearing.

In this episode, Ernie and Josée start with the choice that shapes everything downstream: password hash sync versus pass-through authentication. One turns your password into an irreversible mathematical hash that lets your cloud apps keep running even if your entire data center goes dark. The other keeps validation strictly on-premises — a real compliance requirement in some industries, but one that creates a hard single point of failure. Then we go after the actual silent killer: legacy applications hard-coded to a domain controller's raw IP address, bypassing DNS entirely, so the moment that server finally goes offline, the failure looks like anything except what it actually is. We walk through why checking DNS logs gives you a false sense of safety, and the real discovery method — packet captures and raw network traffic analysis — that finds every hidden dependency before you ever pull the plug.

You'll leave knowing exactly which authentication model fits your organization, and how to find the hard-coded dependencies that could sink your entire decommissioning project.

If you're planning to power off your last domain controller, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Ask to move one workload slider to Intune — just the Wi-Fi policy — and Microsoft silently drags your entire antivirus and BitLocker management along with it, whether you're ready or not. This episode is what actually breaks when you migrate off Group Policy, and why some of it isn't optional.

In this episode, Ernie and Josée trace why there's no cloud version of SYSVOL — the file share every Group Policy Object depends on — and why Microsoft never built one on purpose: the protocol itself can't survive being run across the public internet at global scale. We walk the actual mechanics of Intune's replacement architecture, the brutal translation gap that trips up admins moving legacy GPOs over (a hard 4-megabyte size limit, English-only text, and WMI filters that fail to translate at all), and the hidden dependencies buried inside co-management's workload sliders — including the one that silently forces three separate workloads to move together whether an admin intended that or not. We close with the exact endpoint logs administrators actually check to prove a transition worked, instead of trusting a cloud portal that can lag behind reality.

You'll leave knowing exactly what breaks first when you cut the cord to on-prem Active Directory, and the specific traps that catch even experienced admins off guard.

If you're the one planning a Group Policy migration, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

Your identity governance model works perfectly for IT. Point it at OT, and it can shut down a pipeline, crash a controller, or worse — because the two environments don't just need different tools, they need opposite priorities. Antivirus, vulnerability scanners, centralized identity — everything you'd normally do to secure a system is exactly what breaks an OT environment. This episode is why the IT playbook fails here, and what actually works instead.

In this episode, Ernie and Josée trace why active defense is physically impossible in industrial environments — endpoint agents introduce latency that can throw a chemical process out of tolerance, and standard vulnerability scanners can crash a legacy controller's network interface outright. With detection off the table, the only real option is passive visibility and rigid isolation instead. We walk through the 40-tenant silo model: completely separate identity environments per facility, with zero trust relationships between them, connected back to headquarters only through outbound-only sync agents so a compromise in one facility can never become a master key into the rest. We close on the hardest tension in the entire model — how to keep zero standing privilege everywhere, while still guaranteeing an engineer can act immediately during a 2 a.m. physical emergency.

You'll leave knowing exactly why IT security instincts fail in industrial environments, and the architecture that actually holds up in their place.

If you're responsible for identity in an OT or critical infrastructure environment, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

The attacker never had a password. They just asked a piece of hardware a simple question, and it handed over the keys to 700 storage buckets — because nobody had drawn a hard line between proving who someone is and deciding what they're allowed to touch.

In this episode, Ernie and Josée break down the real architectural divide behind that failure: Microsoft Entra ID as the passport office that verifies who you are, and AWS IAM as the mechanical locksmith that's never once asked. We trace how SCIM keeps the two in sync automatically, like an aggressive HR department for the cloud, and how Cedar — AWS's mathematically verified policy language — replaces static role checks with authorization decisions made fresh on every single request. We close with the payoff: an employee in a coffee shop reaching a twenty-year-old Kerberos application with zero VPN, zero exposed ports, and one seamless identity-aware proxy doing the translation invisibly in the background.

You'll leave knowing exactly where authentication ends and authorization begins — and why collapsing that line is how a single overprivileged role turns into a headline breach.

If you're the one deciding what a cloud role is actually allowed to touch, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

For twenty years, every server and every application in your environment had a password somewhere — a service account, a computer account — managed by a human who was supposed to rotate it on schedule and usually didn't. That model quietly became obsolete the moment infrastructure started spinning up and disappearing in minutes instead of living for years, and most organizations are still running critical systems on it anyway.

In this episode, Ernie and Josée trace how managed identities eliminate that problem entirely — no password exists anywhere, for anyone, ever, closing off an entire category of attack rather than just hardening it. Then we turn to the harder question: what do you do with the legacy application that still expects Active Directory to exist? We walk through both real architectural paths available today — Microsoft's Entra Domain Services, which recreates the legacy directory in the cloud, and the identity-aware gateway approach from Okta, Ping, and Keycloak, which modernizes access at the front door instead. Each is built for a different priority, and we lay out exactly how each one actually works under the hood.

You'll leave knowing exactly how to eliminate static service accounts for good, and which of the two legitimate paths forward actually fits what your organization needs most.

If you're the one deciding how legacy applications survive a cloud migration, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

You just merged networks with a company that might already be compromised — and they can't tell you, because they don't know either. That's day one. Not a checklist item. A live, unknown risk sitting inside a network you now own.

Then it gets worse: the person responsible for deciding who keeps access is a manager staring at a list of strangers, with zero context, under pressure to not break payroll. So they approve everything. That's how a breach nobody caught turns into a breach nobody's watching.

In this episode, Ernie and Josée cover how Okta and Ping are actually built to survive that exact failure. Okta doesn't leave the judgment call to a confused manager — access gets bundled into pre-built packages so nobody's approving two hundred individual permissions blind. Ping goes further and contains the blast radius at the data level, filtering what someone can actually see down to the individual field, so legitimate access doesn't mean seeing everything. And when the acquired company genuinely doesn't know what it's hiding, we walk the exact forensic playbook for finding it yourself — financial records, DNS anomalies, TLS handshakes.

You'll leave knowing exactly where the real exposure hides in an Okta or Ping integration, and how each platform actually contains it once you find it.

If you're responsible for securing an integration like this, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

This episode gives you the exact mechanics for achieving day-one cross-org access with Okta and Ping: how to bridge an acquired company's on-prem Active Directory without touching it, how namespace collisions actually get resolved, and the full authentication chain that gets a legacy app working with zero code changes.

In this episode, Ernie and Josée run the same day-one M&A scenario we covered on Microsoft Entra, this time through Okta and Ping. We trace how lightweight directory agents and PingFederate bridge an acquired company's on-prem AD without ever migrating it, how a namespace collision between two employees who happen to share a name gets resolved through mapping rules, and the full token-to-header chain that lets a federated user reach a legacy application it's never even heard of. We close with the exact SAML tracer workflow architects actually use to diagnose it when the frictionless login isn't so frictionless.

You'll leave knowing exactly how to deliver real cross-organizational access in 48 hours — without a rip-and-replace migration and without a single exposed inbound port.

If you're the one debugging this at 6 a.m. on launch day, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

This episode gives you the actual playbook for the risk you inherit in an M&A deal: how to migrate overlapping access groups without a naming collision, how to forensically expose shadow IT tenants before they become a backdoor, and why data migration servers keep becoming the entry point attackers actually use.

In this episode, Ernie and Josée map the full M&A identity risk landscape — starting with the Marriott-Starwood breach, where an undetected intrusion sat inside the target company's network for years before and after the deal closed. We walk the actual mechanics of migrating groups and application access without collisions, then go hunting for shadow IT tenants using B2B graph data, expense reports, DNS telemetry, and TLS fingerprinting. We close with the Oracle-Cerner breach, and the uncomfortable architectural lesson it teaches: the temporary migration servers built to move the data are almost always less secure than either company's actual production environment.

You'll leave knowing exactly where the real exposure hides in an M&A integration — and it's rarely where either company's security team is looking.

If you're responsible for securing an integration like this, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

This episode gives you the exact integration mechanics for Day One of an M&A: how to bring an acquired company's identities into your Entra ID tenant without a multi-year Active Directory consolidation project, and without opening a single inbound firewall port.

In this episode, Ernie and Josée tear down three real integration scenarios — starting with the classic case of acquiring a legacy, on-prem-only organization. We trace the outbound-only cloud provisioning agent that keeps the acquired company's network fully isolated, the object GUID join-key math that stops two employees from colliding, and the security hardening that shuts down a real hard-match hijack vector. We also compare manual B2B guest collaboration against automated cross-tenant sync with group mirroring, and walk the full proxy chain that lets a cloud-only user reach a legacy mainframe app without a second password — plus the diagnostic tree for when any piece of that chain breaks.

You'll leave knowing exactly how to get an acquired workforce productive on Day One without gambling your timeline on a domain migration.

If you're the architect who'll actually own this integration, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott

By the end of this episode, you'll know exactly how Okta and Ping handle the same identity challenges Microsoft solves with Entra — so you can evaluate either platform on real mechanics instead of vendor promises.

In this episode, Ernie and Josée run the same stress test from the Microsoft episode through Okta and Ping: attribute-level source-of-authority switching down to a single field, the SPNEGO handshake that lets a cloud-authenticated user walk into a Kerberos app without a login screen, and why a Layer 7 access gateway closes off lateral movement in a way a VPN never could. We also cover just-in-time elevation — ephemeral certificates that mint in seconds and expire on a timer, no standing access required.

You'll leave knowing exactly where Okta and Ping's architecture matches Microsoft's approach, and where it genuinely differs.

If you're evaluating Okta or Ping against Microsoft for this exact migration, this episode is not optional.

Connect with Ernie Prescott on LinkedIn at linkedin.com/in/ernieprescott