Evidence search
Search
Search titles, summaries, topics, providers, authors, and the full open-access corpus.
Results for “Offboarding”
14 publicationsMove Microsoft Sentinel to the Defender portal without breaking automation
Onboarding a Sentinel workspace to the Defender portal changes incident providers, grouping, fields and automation timing with no documented error. Inventory what depends on them, rehearse safely and cut over before March 31, 2027.
Detection & response · Microsoft Sentinel / Microsoft Defender · By Cloud Security DeskGive a SaaS vendor an AWS role without creating a confused deputy
A vendor's cross-account role is safe only if your trust policy demands an exact external ID, the vendor's backend generates and enforces it per tenant, and your reviews catch drift and offboard the role.
Identity & access · Amazon Web Services · By Cloud Security DeskRoll over a SAML signing certificate without an SSO outage
Replacing an identity provider's SAML signing key is a separate contract with every service provider. Classify each one by how it learns keys, overlap where it can hold two and finish by removing the old key everywhere.
Identity & access · Microsoft Entra / Okta / Google Workspace / Amazon Web Services · By Cloud Security DeskBuild an inventory of non-human identities across cloud accounts
Find every service account, service principal, role and key across AWS, Entra and Google Cloud, then record the owner, credential type, privilege and last use that turn a list into decisions.
Identity & access · Amazon Web Services / Microsoft Entra / Microsoft Azure / Google Cloud / OWASP · By Cloud Security DeskProtect and recover your AWS root account
Protect AWS root access with MFA, current recovery contacts, separate daily administration, and a clear plan for Organizations member accounts.
Identity & access · AWS · By Cloud Security DeskGive Google Cloud teams access through IAM groups
Give Google Cloud teams IAM access through owned groups, choose a sensible resource scope, and verify migration and removal with practical checks.
Identity & access · Google Cloud · By Cloud Security DeskGet an alert when Google Cloud project access changes
Build a Google Cloud log-based alert for project IAM changes, verify the filter and notification channel, and understand incident limits.
Detection & response · Google Cloud · By Cloud Security DeskGive Azure readers access to one resource group
Assign Reader without granting write access or assuming it grants data access.
Identity & access · Azure · By Cloud Security DeskSet explicit trust boundaries for Entra partner access
Accepting another tenant’s authentication claims is a specific trust decision, not blanket approval of its users, devices or access to your applications.
Identity & access · Microsoft · By Cloud Security DeskFind the Purview audit history your investigation can still retrieve
Resolve Purview audit availability at the record level by separating actor eligibility, retention policy, collection status, investigator scope and export limits.
Detection & response · Microsoft Purview / Microsoft 365 · By Cloud Security DeskProve Identity Center permission changes reached every account
A permission-set change is complete only when the intended accounts, account-local policies, provisioning results and assignments have converged.
Identity & access · AWS · By Cloud Security DeskPasskey deployment needs a recovery design
A workforce passkey rollout needs a recovery contract before broad enforcement. Separate credential custody, enrollment evidence and application sessions.
Identity & access · NIST / FIDO Alliance / Microsoft Entra · By Cloud Security DeskMeasure SCIM offboarding at the application
A successful provisioning update proves a directory action, not the end of every application session. Define and test the application's offboarding contract.
Identity & access · SCIM / Microsoft Entra · By Cloud Security DeskClose the AWS sessions that survive identity shutdown
Removing a login does not by itself establish that issued AWS credentials have lost their authority. Build a revocation procedure that accounts for both.
Identity & access · AWS · By Cloud Security Desk