Lead IAM Engineer
Zero Trust IAM for a Hybrid Cloud
Conditional access and least-privilege identity across Entra ID and AWS for a 2,000-person SaaS company.
Sample case study — realistic but fictional. Replace with your own engagement and metrics.
Context
A 2,000-employee SaaS company ran a hybrid estate: on-premises Active Directory synced to Entra ID, plus a sprawling AWS footprint accumulated over five years of team-by-team account creation. Identity had grown organically — every team solved access its own way — and a SOC 2 Type II audit was six months out.
Problem
- Standing privilege everywhere. ~40 engineers held long-lived
AdministratorAccessin production AWS accounts “just in case.” - Inconsistent assurance. MFA was enforced for some apps, optional for others; there was no notion of device or location trust.
- No single front door. Several SaaS apps authenticated against local accounts, bypassing the IdP and the audit trail entirely.
Approach
- Made Entra ID the single identity provider and federated AWS through IAM Identity Center, so every session starts from one authenticated, MFA’d identity.
- Replaced standing AWS admin with permission sets mapped to groups, granted just-in-time and time-boxed — least privilege by default.
- Authored Conditional Access policies keyed on user risk, device compliance, and location, rather than a single static MFA toggle.
- Codified the whole thing in Terraform so access is reviewable in pull requests and reproducible across environments.
Architecture
Outcome
- Standing admin access cut ~90% — from ~40 always-on admins to a handful of break-glass accounts, with the rest elevating just-in-time.
- 100% of workforce SSO moved behind Conditional Access with phishing-resistant MFA.
- Access reviews dropped from days to hours: group membership and permission sets are now declarative and diffable.
- Cleared the IAM control objectives for the SOC 2 audit with no findings.
Stack
- Entra ID + Conditional Access — the policy decision point for every sign-in.
- AWS IAM Identity Center — federated, time-boxed access to AWS accounts.
- Terraform — access as reviewable, version-controlled code.
- SAML / OIDC — federation between the IdP and downstream apps.