1 min lesson
Risk-based & conditional access
Rebuild the parts of "Risk-based & conditional access", then say why each one matters.
Step 1 of 3
Risk-based & conditional accesscontext gates the login
Conditional access lets you require more (or block) based on signals: is the device managed and compliant, is the network expected, is the sign-in behavior anomalous. This is the IdP side of zero-trust - access is granted on posture, not just a correct password.
- Device posture
- Managed + compliant via MDM device trust; block unmanaged for sensitive apps
- Network / location
- Step-up or block on impossible-travel or unexpected geos
- Behavior / risk score
- Anomalous sign-in triggers re-auth or denial
- App sensitivity
- Finance/prod consoles demand stricter conditions than a wiki
Learn more
Full explanation
Admin hygiene
Admin hygieneprotect the thing that protects everything
- Scoped admin roles. No one carries super-admin for daily work; delegate the narrowest role that does the job.
- API tokens as service apps. Prefer scoped OAuth service apps over long-lived super-admin API tokens and rotate them.
- Break-glass accounts. A small number of emergency accounts, MFA-exempt only by deliberate design, vaulted, alerted on every use.
- Logging everywhere. Stream the System Log to the SIEM; admin actions and sign-in events are your forensic record and SOC 2 evidence.
Learn more
Full explanation
Okta vs Entra
Okta vs Entrahave a view, hold it lightly
- Dimension
- Sweet spot
- Okta
- Best-of-breed, app-agnostic, huge OIN catalog
- Entra ID
- Deep in Microsoft 365 / Azure shops
- Dimension
- Lifecycle
- Okta
- Strong workflows + universal directory
- Entra ID
- Strong when the org lives on Microsoft
- Dimension
- Cost model
- Okta
- Standalone spend
- Entra ID
- Often bundled with existing M365 licensing
- Dimension
- Pick it when
- Okta
- Mixed SaaS stack, want neutral identity hub
- Entra ID
- Already all-in on Microsoft and want one bill
| Dimension | Okta | Entra ID |
|---|---|---|
| Sweet spot | Best-of-breed, app-agnostic, huge OIN catalog | Deep in Microsoft 365 / Azure shops |
| Lifecycle | Strong workflows + universal directory | Strong when the org lives on Microsoft |
| Cost model | Standalone spend | Often bundled with existing M365 licensing |
| Pick it when | Mixed SaaS stack, want neutral identity hub | Already all-in on Microsoft and want one bill |
State a preference with a reason, then concede the other side's case - that's how staff engineers argue.
If asked Okta vs Entra, don't dodge - commit and qualify: "I lean Okta for a SaaS-diverse, vendor-neutral stack because the catalog and lifecycle workflows are strong, but in a Microsoft-everything org Entra's bundling and tight M365 integration usually win." A reasoned preference plus an honest trade-off reads as senior; "it depends" with no opinion reads as evasive.
Before the loop, be able to answer for any IdP you've run: where do admin tokens live and when did they last rotate, how many super-admins exist, are break-glass accounts vaulted and alerted and is the System Log shipping to a SIEM? Concrete answers here are the texture that separates an operator from someone who read the docs.
Learn more
Optional practice