IntegrAuth Academy
Identity, security and practical AI — free, from zero. Byte-sized lessons, real diagrams, hands-on labs, zero fluff. Two programs, each with its own exam and certificate.
English is hard? Your browser can translate this page into Tamil, Telugu, Kannada, Malayalam or Hindi. Tech words stay in English so you learn the real names.
How?
- Chrome on phone: ⋮ menu → Translate
- Chrome on computer: right-click → Translate to …
- Edge: the translate icon in the address bar
Cheat sheet & pop quiz
You have walked through the whole operations playbook. Here is the short version, a map for finding answers fast, and five questions to check what you learned.
If you remember nothing else…
| # | The one-line takeaway |
|---|---|
| 1 | Push, don't wait. SCIM creates Priya's account before her first login. It sets active:false the moment she is offboarded. Also revoke live sessions. |
| 2 | SCIM delivery is at-least-once, so your endpoint must be idempotent. Dedupe on a stable id, or a retried create makes a duplicate. |
| 3 | The SCIM bearer token writes accounts. Keep it on the server, limit it to one connection and rotate it. Never send it to a browser. |
| 4 | Identity events are security telemetry. Tag each login with a MITRE ATT&CK technique, a Sigma rule and a severity. Tune the rule: too low gives false alarms, too high misses attacks. |
| 5 | Stream, don't poll. Send logs to your SIEM over an authenticated endpoint, as they happen. Alert on high-signal events. Never log passwords or tokens. |
| 6 | Revoke before you delete. Cut access and end sessions and refresh tokens first. Then wait through a cooling-off window that can be undone. Then erase. |
| 7 | Erasure must reach the copies you forgot, such as RAG vectors. Keep only what the law requires. In audit logs, cut the link to the person. |
| 8 | A push authenticator signs, never shares. The private key stays in the keystore. Number matching stops blind taps. RAR shows Maya the real amount before she taps. |
| 9 | Access piles up. This is entitlement creep. Beat it with access reviews that show usage data next to every grant. Rank by risk. Revoke unused grants by default. |
| 10 | When the IdP is down, break-glass is the emergency account that is not federated. Its secret is split and sealed. It alerts on ANY use, has a time limit and is fully audited. Prefer just-in-time elevation to standing admin. Add dual control. After use, rotate and review. |
| 11 | Reconciliation compares the directory with each app's real accounts. It fixes orphaned, duplicate, unowned and entitlement drift. A forgotten active account is an attacker's easy way in. |
Ops question → where the answer lives
| When someone asks… | …the answer lives in |
|---|---|
| Who has access to what right now, and how do we cut it the day someone leaves? | SCIM provisioning · the joiner–mover–leaver lifecycle |
| How do we spot an identity attack while it happens? | Identity telemetry & SIEM · when things go wrong |
| A user demands deletion. What can we delete, and in what order? | The right to be forgotten · the rules (GDPR) |
| Can we trust an approval tap, or is it just for show? | Building a custom push authenticator · human-in-the-loop approvals |
| We deleted the account. Why did an AI helper still show the person? | Right to be forgotten · permission-aware RAG |
| How do we give access from a group without a ticket for each person? | SCIM groups become roles · personas |
| Everyone has more access than they use. How do we trim it? | Access reviews & least privilege |
| The IdP is down and we are locked out. What now? | Break-glass & privileged access |
| How do we know a leaver's account did not survive in some app? | Reconciliation & drift |
Pop quiz — five questions
Q1 · Priya resigns. HR clicks "offboard" at 4:59 p.m. on Friday. She never logs in to the analytics app in her last week. Why is her access gone anyway?
SCIM is proactive. The directory sends a PATCH that sets active:false the moment HR offboards. The account is disabled without waiting for a login. Sessions already open end when they expire, unless you revoke them. An app that only uses JIT keeps the account until someone removes it by hand (SCIM provisioning).
Q2 · The directory's network has a problem. It sends the same POST /Users create for Sam again. Your endpoint makes a second account. Which rule did you break?
Idempotency. SCIM deliveries are at-least-once, so a retried create must be deduped on a stable id. If not, a retry makes a duplicate. (The bearer token allows the write. Keep it on the server, limit it to one connection and rotate it. Never put it in a browser.) See SCIM provisioning.
Q3 · Zara sees a flood of "Approve?" prompts on one account within seconds. What technique is this, and how should the feed tag it?
Push fatigue, also called MFA request generation: T1621 in MITRE ATT&CK. The normalizer maps it to that technique, plus a Sigma-style rule and a severity. Then Zara can go straight to the account and the IP addresses. She does not read raw JSON (identity telemetry & SIEM).
Q4 · Maya asks to be forgotten. A month later, Kai, an AI agent, still shows her details in an answer. The team says they deleted her account. What went wrong?
They erased the identity record but not the derived copies. These are the RAG vectors that an AI feature stored about Maya. Erasure must reach those too, so purge them by id. If not, you removed the book and left the photocopies (the right to be forgotten · RAG).
Q5 · Maya's phone shows a plain "Approve this request?", but the token it makes allows a ₹50,000 transfer. Which design idea fixes this?
Show the real transaction with RAR (Rich Authorization Requests). The authorization_details travel with the request, and the phone shows "Send ₹50,000 to +91 98… — approve?". The details are bound into the token, so the API enforces them. A generic prompt over a token that allows more is consent theater (building a custom push authenticator).
That is Identity Operations: provisioning, telemetry, erasure, a custom authenticator, access reviews, break-glass access and reconciliation. You now know how to run identity. Next up is Enterprise identity. It covers the directories, Kerberos, governance and privileged access that most workforces still run on. It also covers password policy and device trust. Start Enterprise identity.
You have learned it. Now build it. Browse our free security micro-tools at the tools shelf. Explore our services. Talk to our team when you are ready to design the real thing.