Deepan Udaiyar

Most phishing-resistant rollouts secure the front door and leave the back doors open. The factor gets upgraded, and then password reset, account recovery, and authenticator enrollment carry on working the way they always did, which is to say phishably. An attacker does not need to beat the strong factor if they can quietly enroll a new one.

This program was built from the opposite end. Recovery and enrollment were designed first, and the authentication policy followed a single principle: friction should scale inversely with attested device trust. A device the organization can vouch for signs in with one hardware-protected factor and gets on with its day. A device that it cannot vouch for has to prove more. Trust is asserted by the device management platform rather than by the endpoint itself, which is the difference between a signal and a claim.

The work covered authentication policy across every sign-in surface, an enrollment route for populations that cannot hold a standard authenticator, and administrative access treated as its own tier rather than an extension of ordinary access.

Led an end-to-end Active Directory decoupling and decommission covering several hundred users and directory objects in two months, with no cutover downtime. Directory migrations fail at the cutover window, so this one removed the window: a form submission triggered an Okta Workflow that unassigned the directory link, issued a temporary credential, and delivered it over a secure channel, so migration ran at user pace rather than as a single event. Accounts, service accounts, and shared mailboxes were converted through a no-sync organizational unit and restored as cloud objects. Groups cannot be moved, only recreated, so replacements were pre-staged under a temporary prefix, and the originals were moved out of sync scope. The new groups were renamed and the original aliases reassigned, so no mail flow or app assignment broke. Bulk group creation, account deletion, and object moves were scripted in PowerShell, with directory sync cycles deliberately paced rather than triggered on demand. Converted accounts were restored through Microsoft Graph, and directory synchronization was disabled only after verifying no objects remained sourced from on-premises.

Joiner and leaver work is where identity programs quietly fail. The steps are simple, there are a lot of them, and every one is a chance to leave an account behind.

This is a Bash and Python pipeline that runs the whole sequence across Google Workspace, Okta, Jamf, and BambooHR in a single pass. It turns half an hour of manual work into about five minutes, and makes a batch of fifty users no harder to process than one. The time saved matters less than the two properties that come with it: the run is identical every time, and it leaves an auditable trail of what was created, changed, and removed. Published as an open repository.