The Identity Blueprint

Most organizations think keeping Active Directory around is the cheaper, safer option. It's actually the more expensive one — they're paying for two identity systems at once, and only using one of them. 💸 In this episode, Ernie and Josée make the financial and risk case for retiring on-prem Active Directory. We unpack the "stranded capital" problem: organizations already licensed for Entra ID P1 or P2 are paying for conditional access, risk-based identity protection, and Privileged Identity M...

You can migrate every user to the cloud and retire every workload, and Active Directory still won't go away — because two systems, your certificate authority and Exchange Hybrid, are quietly holding the domain controller hostage. 🔐 In this episode, Ernie and Josée trace exactly how a low-privilege foothold — a phished user, an exposed ethernet jack — escalates into full domain compromise using nothing but native Windows features: coercing a domain controller into an NTLM handshake, relaying i...

Why is DNS the silent killer you don't see coming? Because the applications that kill your migration never touched DNS in the first place — so there's nothing in the logs to warn you. The error message will say "database unreachable." Your team will spend four hours on the SQL cluster. The actual problem died the second you turned off a domain controller nobody knew was still load-bearing. In this episode, Ernie and Josée start with the choice that shapes everything downstream: password hash ...

Ask to move one workload slider to Intune — just the Wi-Fi policy — and Microsoft silently drags your entire antivirus and BitLocker management along with it, whether you're ready or not. This episode is what actually breaks when you migrate off Group Policy, and why some of it isn't optional. In this episode, Ernie and Josée trace why there's no cloud version of SYSVOL — the file share every Group Policy Object depends on — and why Microsoft never built one on purpose: the protocol itself ca...

Your identity governance model works perfectly for IT. Point it at OT, and it can shut down a pipeline, crash a controller, or worse — because the two environments don't just need different tools, they need opposite priorities. Antivirus, vulnerability scanners, centralized identity — everything you'd normally do to secure a system is exactly what breaks an OT environment. This episode is why the IT playbook fails here, and what actually works instead. In this episode, Ernie and Josée trace w...