Identity is the new perimeter.

Writing on Digital Identity

• Jun 1, 2026 12 min read

  Entra Agent ID Across Clouds: Part 5, Anti-Patterns

  Final article in the five-part series on running Microsoft Entra Agent ID against third-party clouds. Closes the loop with the variants and failure modes that consume the same operational budget as the federated pattern without delivering its security properties, and ends with the takeaways worth pinning to the team wiki.

  Digital Identity Zero Trust Read →
• May 15, 2026 16 min read

  Entra Agent ID Across Clouds: Part 4, FIC, Cross-Tenant, and OBO

  Fourth article in the five-part series on running Microsoft Entra Agent ID against third-party clouds. Opens up the Federated Identity Credential as a first-class object: single-tenant, cross-tenant SaaS shape, and the orthogonal world of on-behalf-of (OBO) where the agent acts for a signed-in user.

  Digital Identity Zero Trust Read →
• May 1, 2026 26 min read

  Entra Agent ID Across Clouds: Part 3, Managed Identity and Entra Objects

  Third article in the five-part series on running Microsoft Entra Agent ID against third-party clouds. Pins down what the UAMI actually is in this architecture, why SAMI breaks federation, the three distinct Entra objects (UAMI, Blueprint, Agent Identity) and the three claims (sub, azp, oid) they each populate, and the production trade-off between federating the UAMI or the Agent Identity to the cloud.

  Digital Identity Zero Trust Read →
• Apr 25, 2026 26 min read

  Entra Agent ID Across Clouds: Part 2, Federation End to End

  Second article in the five-part series on running Microsoft Entra Agent ID against third-party clouds. Walks the federated pattern as two parallel federations sharing one managed-identity JWT, explains why a laptop cannot participate, and shows what actually travels on the wire (including the audience GUID that catches most first deploys).

  Digital Identity Zero Trust Read →
• Apr 15, 2026 15 min read

  Entra Agent ID Across Clouds: Part 1, Lower Environment and Secrets

  The opening article in a five-part series on running Microsoft Entra Agent ID against third-party clouds (AWS, GCP). Covers the two trust environments behind every cloud-agent deployment, and walks the secret-based pattern (the shape you use on a laptop, on a CI runner, or in any non-Azure dev box) end to end.

  Digital Identity Zero Trust Read →
• Mar 22, 2026 7 min read

  I Passed the CISSP in a Long Weekend. Here's the Honest Story

  I've been taking certifications for over twenty years. Most of them blurred together. Study for weeks, memorize a bunch of stuff, dump it into an exam, forget half of it by dinner. You know the drill.

  Digital Identity Read →
• May 8, 2024 2 min read

  Speaking at RSA Conference 2024: GM's Road to Modern Consumer Identity

  Notes from co-presenting at RSAC 2024 on General Motors' multi-year consumer identity modernization, and what it takes to do CIAM at automotive scale.

  Digital Identity Read →
• Feb 21, 2016 17 min read

  Using Client Certificate Authentication for Web API Hosted in Azure

  During recent customer engagement there was a discussion around client certificate [a.k.a tls mutual] authentication and how to use it with asp.net web api that is hosted on azure as a azure api app.

  Digital Identity Zero Trust Read →
• Feb 15, 2016 7 min read

  Developer's Guide to Automated Install of ADFS On Windows Server 2016 (TP4)

  Recently I ran into situations where have to build a developer enviorment that needs active directory federation services [adfs] running on windows server 2016 [currently in technical preview 4, hence w2k16-tp4,].

  Digital Identity Read →

Other topics