Identity Security
Delegation Without Fragility
Design least-privilege OU tasks and custom roles that survive turnover, using just enough automation to stay honest.
Overview
We compare built-in delegation wizards with scripted patterns, practice JEA-adjacent thinking for AD tasks, and document approval flows that survive audits. Labs emphasize reversible grants and time-bound access stories.
What is included
- OU task split exercises with real tickets
- Just-in-time access storytelling for stakeholders
- Review of common toxic delegation chains
- PowerShell scaffolding without shipping prod scripts
- Pair writing for helpdesk runbooks
- Quality standards checkpoints for new grants
- Peer review ritual in under twenty minutes
Outcomes
- Produce a delegation map for one business unit
- List two grants to sunset this quarter with rationale
- Draft a reversible access experiment for a pilot group
FAQ flip cards
Hover or focus to reveal answers.
Question
Is MIM covered?
Answer
We mention it only as historical context; labs stay in native AD tooling.
Question
Can managers attend?
Answer
Yes, the afternoon storytelling blocks are written for mixed audiences.
Question
What we skip
Answer
We do not implement PAM products or cloud privileged roles.
Experience notes
“
Peer review ritual is now a weekly calendar hold. Still getting app owners to read the quality standards checkpoints.