Latest / Identity at the Center / #299 - Unpacking Entra ID and DevOps with Microsoft Product Manager Merill Fernando

Transcript

#299 - Unpacking Entra ID and DevOps with Microsoft Product Manager Merill Fernando · Identity at the Center

0:00
We are tweaking and fine tuning all of that and making them more
0:04
efficient. So it's going to be something
0:06
that's going to be like leveraged and used in a lot of
0:09
contexts and. Yeah, it's a, it's a huge game
0:13
changer for like every context. You know, I think about IGA and
0:18
I think about a business user being able to create an access
0:23
review ad hoc just by describing what they want to see in the
0:28
results. Who has access to this certain
0:32
role in my application and has used it within the past 60?
0:36
Days. And then, oh, you know, Jim
0:39
McDonald comes back. OK, tell me what Jim McDonald
0:43
has done in my application over the past sixty days.
0:47
I think you know, being able to query and quiz based on human,
0:54
you know human language model so powerful.
0:57
You had the voice. As long as it's accurate.
1:00
Yeah, that's true, as long as he's not hallucinating.
1:08
This is identity at the center if it has anything to do with
1:13
IAM. This is the go to podcast now
1:17
your host Jim McDonald and Jeff Stedman.
1:27
Welcome to the Identity the Center Podcast.
1:29
I'm Jeff, and that's Jim. Hey, Jim.
1:31
Hey, Jeff, how are you? Not so bad yourself.
1:35
Doing great. So on the last episode, I told
1:38
you I was, I'm in Sturgis, SD for the Big Bike Rally, the
1:43
world's biggest bike rally. And then I was going to see
1:46
Jelly Roll in concert. Well, I saw him in concert on
1:51
Tuesday. And Jeff, I've been to probably
1:54
200 concerts in my life. No, no exaggeration.
1:58
I go to 1015 concerts or music festivals a year and this has to
2:05
be one of the best all time concerts I've been to.
2:09
And and what I realized, it's kind of a weird realization, but
2:14
what I realized was that concert technology has taken a major
2:21
like hyper leap into the future. So behind him he had what I
2:28
would call like a, a wide screen, like a like a huge
2:34
television potentially it was being projected, I don't know.
2:37
But the clarity of things as they're moving, as they're
2:41
cutting in, you know, video of him live on stage with other
2:48
things happening in the background.
2:51
It, you know, you could render that on your computer screen,
2:54
But to render that, you know, 100 by 100 is pretty amazing.
2:59
And the other thing was it's like a A2 dimensional screen
3:04
behind him, but it looked like it was 3D.
3:07
He had like this skull that looked like it was hovering over
3:11
the center of the stage. And it looked like like like
3:16
lights were like, you know, going around it on the skull and
3:20
man, it looks like 3 dimensional.
3:23
It was blowing me away. So yes, he was performing.
3:26
It was a great performance, but the tech was blowing me away.
3:28
You know, I was like thinking, I wish Jeff was here to see this.
3:33
It sounds pretty interesting. I I'll be honest, I don't know
3:35
the first thing about Jelly rolls or than eating them so I
3:38
have no idea what type of music it is or I don't know if I've
3:42
ever heard a Jelly roll song. You definitely seen them.
3:46
Isabel, 300 and 5400 lbs. He's got tattoos all over his
3:50
face. He's definitely right in the
3:54
center of pop culture, right? And it's kind of a mix between
3:58
hip hop, rap and rock'n'roll and country music.
4:04
Like he's got something going on that I wouldn't say there's
4:07
anybody else who does exactly what he does.
4:10
And then he's like a a Southern Baptist preacher.
4:13
He gets in between his songs and he starts preaching to the crowd
4:16
and getting people fired up, and he's a really cool guy.
4:21
But his concert was just something else, and the
4:24
technology was a big part of that.
4:26
Well, you texted me a couple of pictures.
4:28
It's kind of hard to see on on, you know, a small iPhone screen
4:31
and probably didn't do it justice.
4:32
But hey, I'm glad you had a good time.
4:36
There's nothing quite like 5 music, I don't think, especially
4:39
when it's a great performance. So good for you man.
4:43
Yeah, yeah. And, you know, I just, I'm not
4:45
having a great time. Concerts are great.
4:47
Last night I was at another concert in between performers.
4:52
They had this thing where people riding motorcycles between the
4:56
crowd. Now they put like this caution
4:58
tape, but it created a false sense of safety.
5:02
I think, 'cause these guys are riding, you know, 800 LB
5:05
motorcycles fast and doing wheelies and burnouts and stuff.
5:09
I thinking all it takes is for them to slip, mess up and you
5:14
get hit by one of those motorcycles.
5:16
Man, you are. You're dead on arrival.
5:20
So you got that going for you, you got good music and then the
5:23
the potential death by motorcycle.
5:25
Good music and I survived so well.
5:28
Good. Well, it sounds like you're
5:30
having a good time. You're traveling.
5:31
I'm in another hotel courtesy of our day jobs.
5:36
So I'm in. Where am I?
5:38
Where am I right now? Minneapolis.
5:40
You're always in Minneapolis, OR.
5:41
New York I am. I'm up here quite a bit.
5:44
Weather is absolutely perfect today, I want to say like felt
5:49
like 72°. I went out for lunch, met
5:53
somebody, had, you know, had lunch with them wearing, you
5:56
know, I'm shorts and AT shirt at this point, so perfect weather.
6:00
But now I and I head to Dallas tomorrow for the surprise
6:03
birthday party that we talked about in our last episode.
6:06
So right. Yes, and we will be explaining
6:08
the surprise by doing this episode because it's going to.
6:13
Be a couple weeks out at this point.
6:14
Yeah, yeah, yeah. So I'm officially on PTO.
6:18
It's the first time since I guess December that I've been on
6:21
PTO for a day or two. You're a December PTO guy.
6:26
You save it all up until the end.
6:29
Yeah. I mean, nobody does anything
6:31
anyway between like Christmas and New Year's kind of roughly
6:34
in that area. So there's it's easier to take
6:37
that time off and not have quite the backlog when you get back
6:41
into work. Yes.
6:42
So in our last episode we talked about RFPs.
6:45
And one thing that we should have mentioned is don't issue
6:48
your RFP and make the response due on January 2nd or third
6:52
because that means that some poor unfortunate soul is going
6:56
to have to work on that thing for the last two weeks of the
6:59
year. What do you mean some porn?
7:01
That's that's us. We're the poor unfortunate soul.
7:03
I'm the poor unfortunate. Soul, you're the poor
7:06
unfortunate soul trying to get that done with people who are
7:09
all on vacation. See, now that's a sneaky play.
7:12
If you're doing an RFP like that, that is all that.
7:15
That raises suspicions that you're not really open to an
7:19
RFP. You're trying to, you know, get
7:22
someone in and hope that you get few respondents or fewer
7:26
respondents and make it easier for a preferred vendor or
7:29
something like that that stands wrong or right.
7:30
Just saying. That's what I would do if I were
7:33
the customer issues and I had a preferred vendor.
7:35
Yeah. All right.
7:36
Let's talk conferences because we actually have three
7:39
conferences to talk about because we have a new discount
7:42
code for one coming up. Let's start with Identity Week.
7:46
You and I are going to be at Identity Week America, September
7:49
11th and 12th. If you use code IDAC 30, you get
7:53
30% off your registration. That code also works for the
7:56
Asia Conference taking place in Singapore October 22nd, 23rd.
8:02
I'm going to be hosting some sort of panel there with a bunch
8:05
of really smart people and just trying to generally keep up with
8:07
them. And you and I will be doing
8:09
podcast things there. So hopefully people come out and
8:11
say hello and show support doesn't cost you anything to use
8:14
the code. We don't get anything other than
8:16
just hey, you know, we were we were able to refer people to to
8:18
come out there and and join us. What else?
8:21
We got authenticate conference that is also coming up sooner
8:24
than sooner than we probably wish it were because we have so
8:29
much to do for it. But that's October 14th and 16th
8:32
in Carlsbad, CA. If you use the code IDAC 15, you
8:35
get 15% off your registration and the early bird I believe is
8:39
ending soon, September 9th. So depending on when you listen
8:42
to this, hopefully you have stacked discounts at that point.
8:47
If not, still use the code get 15% off and then the new one you
8:51
want to talk about Sempress. Yeah.
8:53
So the SEMPRESS conference is called the HIP Conference.
8:56
It's going to be a very hip conference.
8:59
That stands for Hybrid Identity Protection.
9:02
And we got a discount code for that as well, IDAC POD, IDACPODI
9:10
get you 20% off. That conference is in a very
9:14
cool city, New Orleans, and it takes place from November 13th
9:20
through 14th. Yeah, yeah, I'm excited.
9:24
So anybody out there who's listening, who's, you know, you
9:27
have a conference and you want to issue a discount code, here's
9:31
the requirement. IDAC podcast only issues only
9:35
tells our listeners about the best conference or discount
9:39
code. So if you come in, you give us a
9:41
15% discount code and you give somebody else a 20%, you get
9:45
blacklisted. We'll never mention any
9:47
confidence again. Ain't happening.
9:49
That conference is dead to me. Exactly.
9:52
So guys, when we give a a conference code, we always make
9:56
sure that it's the best one available.
9:58
Otherwise we're not going to talk it up.
10:00
So the three that we gave today are the best available for those
10:05
conferences. Anybody out there who's got a
10:07
conference that's in the identity space, there's got to
10:09
be identity related and wants to do the same or security?
10:12
Infosec is fine I think if there's related.
10:15
Areas, yeah. It can't be comic, comic
10:18
conference or whatever. Hey, I like Comic Con.
10:21
I'll go to Comic Con. If Comic Con wants to sponsor
10:23
and like bring us out there and do a discount code.
10:26
I will not say no to that. I'm just saying.
10:28
All right. If we get to go out to Comic
10:30
Con, then I guess I'll I'll soften up.
10:32
I was looking for a for some kind of conference we won't do.
10:37
But you're right, there's probably very few that we
10:39
wouldn't, we wouldn't at least show up if we can get if we can
10:42
get on in there for free and they want the podcast, all
10:46
right. Can you imagine?
10:48
I died at the center at something like Comic Con?
10:51
I mean, I know you and I are nerds, and, you know, that's
10:53
geek culture and I'm all about it.
10:55
But I think most people are like, who the heck are these
10:57
guys? Yeah.
10:59
Oh yeah, for sure. Absolutely.
11:02
Let's let's get going with today's show.
11:05
We are joined by Meryl Fernando. He's the product manager.
11:09
He's a product manager, I should say at Microsoft, joining us all
11:12
the way from Melbourne, Australia.
11:14
Welcome to the show, Meryl. Hey, hey, Jeff.
11:17
Hey, Jim. I'm super excited to be here
11:20
joining all of you to talk all things identity.
11:23
It's my passion these days. Well, you're amongst friends
11:27
because this is what we do here. Real quickly though, what do you
11:30
think of like, identity at the center, being at like Comic Con
11:34
or something like that? How do you think that would fly?
11:38
I'm sure my kids will roll their eyes.
11:45
Yeah, would would be exciting though.
11:49
That would be the ultimate crossover.
11:50
How about that? All right, let's let's talk a
11:52
little bit about your identity background.
11:53
How did you get into the world of identity?
11:55
Is it something that you chose or did it choose you?
11:58
It actually chose me. I'm relatively new to identity.
12:03
I'm I just came into the identity space when I was like
12:07
in my 40s. So it's never too late to come
12:10
into identity, I would say. And it's been an amazing,
12:14
awesome community. I've built like a great
12:18
friendships with folks from across the globe, from Germany
12:22
to the US to like all parts, all corners of the world in in this
12:28
space. And everyone is friendly, always
12:31
excited to learn new things and always excited to share new
12:35
things as well. And everyone tries to just build
12:38
up the community. So that that's the thing that I
12:40
really love about the whole identity space.
12:45
And it's at the centre of everything.
12:47
So it's an app name as well for the podcast?
12:53
Well, it's a good thing I trademarked it so long ago.
12:57
Let's talk about your recent journey, right?
13:00
You said you're recent into IM. What were you doing before IM?
13:03
And then what caused you to switch?
13:05
Or was it just like, oh, all of a sudden I'm an IM?
13:08
Or was it something you consciously?
13:09
Sought out, yeah. So when I first started like way
13:14
back when I was really young and this was when NT was just coming
13:19
out with the, the whole idea of the Active Directory, I was
13:26
reading this whole empty book and I was just falling asleep
13:29
reading it after I couldn't just go past the 1st 5 pages.
13:34
So then I knew like, no, this is not my passion, but I really
13:37
loved dev like writing, building things, creating things.
13:41
And so I just went down the, the dev path building applications,
13:47
it used to be Windows apps, then web apps and then like things
13:51
like SharePoint and all of that. So that's what I've been doing
13:55
all throughout my career, like being a solution architect.
13:59
I really love solving problems and you know, building things
14:04
for folks. And it's sort of you, you get to
14:06
create new things. And that's what I really like
14:08
the whole creativity that's involved in in that.
14:12
So security identity were like the last things on my on my
14:16
mind, but I just accidentally fell into the role of leading
14:21
the whole Microsoft 365 team at one of the largest companies in
14:27
in Australia, like my previous loan at at Telstra.
14:30
And that's when I saw this new cloud scale as your AD at that
14:37
time in Tri D and it was very different to the on Prem AD
14:41
world where you, you know, the slightest sneeze and you could
14:45
bring down the AD environment and like they were always on
14:48
pins. They had been set for managing
14:50
it. And then I saw this cloud scale
14:53
as UAD, which, you know, you could throw call APIs into it.
14:57
It would never go down. It had resilience built into it.
15:00
And I was like, this is the future.
15:02
And so I started playing around with it and just accidentally
15:07
fell into the whole security thing.
15:10
And then I, my manager at Microsoft who hired me in, he
15:17
just called me once and said, this is role.
15:21
Are you interested? And I like, I was like, what
15:24
would someone do? Like it's just a login page.
15:26
Like what's, what's the amount of work that you can have in
15:29
identity? Because coming from a dev
15:31
background, it's, it's sort of something you always want to
15:34
just get out of the way. It's just a login page.
15:36
You just do that because you're focused on building whatever the
15:40
solution that you're working on. And yeah, so now the joke's on
15:43
me. I'm doing all identity now and
15:46
not their stuff. But yeah, it's never too late.
15:49
I would say to come into identity and folks from
15:53
different backgrounds and walks of life, we can bring in a lot
15:57
of knowledge and experience into the space.
16:01
So it it, it sort of helps, you know, from, from all different
16:05
aspects. So I'm learning lots of new
16:08
things and one of my passions is sharing that.
16:11
And I feel because I, I've not grown in identity, like the way
16:17
I talk about things is in simple layman term, like I don't even
16:21
know, you know, the, the complex words for these things.
16:24
So it sort of helped me connect with all the lots of the other
16:27
folks are coming into identity, maybe when they don't even
16:31
realise they're in identity. But you just accidentally fall
16:34
into that floor, right? You might be doing firewall
16:37
rules and things in the past and now you're like creating
16:40
conditional access policies and thinking how identity and
16:44
networking, all of that flowing together.
16:46
So yeah, like I would say it's, it's a very coming space usually
16:52
just for me. Identity found me and I've never
16:56
been the happiest than I've been like right now I tell everyone
17:01
like, look, I feel like I'm retired, like I love what I'm
17:04
doing and I get paid for it and there's there's absolutely no
17:09
stress and I love to come and talk about things about identity
17:13
with work. So yeah, I'm, I'm enjoying life
17:17
and enjoying work at working at Microsoft.
17:20
Well, that's great. It's, it's, I always find
17:21
interesting you talk about people's backgrounds because I
17:23
think a lot of people think that identity is a technical role or
17:28
technical job. And that might be true.
17:30
There are certainly roles with an identity that are technical.
17:32
There's a lot of roles that aren't right.
17:34
They're more focused on the business or communications.
17:36
You mentioned, you know, really kind of speaking plain English,
17:40
right to people to explaining it.
17:41
I feel like sometimes there should be in your Duolingo app
17:45
or Google Translate, while the option should be identity to
17:48
English, right? Or whatever your neighbor
17:50
language is, because we get stuck in this world of acronyms.
17:54
And, you know, if you're talking with other people who are fluent
17:57
in identity, that's one thing. But we have to be able to
18:00
communicate this stuff to, you know, real people who aren't,
18:03
you know, identity people. And that art of communication
18:06
and being able to translate is, is sorely needed.
18:09
I find a lot of organizations really struggle with, you know,
18:12
being able to articulate in a in a way that makes sense for
18:15
people like, oh, we're going to introduce SAML.
18:19
Cool. What does that mean?
18:21
You know, what does that mean to the end user?
18:23
They don't care, they go. You mentioned the working log on
18:25
boxes. Remember how you have like 50
18:27
different log on boxes? Well, guess what, What if
18:29
there's only one and they all work the same and you had a very
18:31
consistent experience. Would that make sense?
18:34
Oh, OK, that makes sense. Let's do that.
18:38
You are now a product manager with Microsoft.
18:42
I guess. Talk me through what does that
18:44
mean? What does a product manager at
18:46
Microsoft mean for a role perspective?
18:49
Talk to you about your day-to-day and and and how that
18:51
works. Yes, yeah.
18:53
So the team that I'm in is called the customer experience
18:56
Product manager. And my team sort of like a
19:00
global team, we spread out across the globe from folks in
19:04
the UK, in Germany, in Japan, Singapore and like all across
19:10
the globe. We do have the feature PMS who
19:15
actually build out, write the specs, meet with customers and
19:20
or it could be standards related stuff that they're working on.
19:24
So they focus on the specific feature that they're building
19:28
and like how it ties in with the rest of the, the capabilities
19:32
that intro has. So it's sort of like the, I try
19:36
to think of it as like there are three parts to the whole story.
19:39
So we have the engineering leads and the teams that actually are
19:42
the like the brains of it and who write the code, make sure it
19:46
all fits in with the overall architecture and it's built run
19:49
at cloud scale. We have like billions of sign
19:52
insurance happening, trillions of signals coming in every
19:56
single day. So they think of all of that.
20:00
We have the feature PMS to write the specs and they ask for
20:03
feedback from everyone. And we, I, I work with a few
20:07
large customers over here in Australia and we sort of give
20:11
our feedback into like when there are specs written early
20:15
feedback into sharing of, of, you know, the reviews of the
20:19
specs. And have you thought about this?
20:21
Have you thought about how something happens in Australia,
20:25
like the various government rules or the different
20:28
challenges we have in in different countries and the
20:32
enterprise customers have different needs as well.
20:35
Things work in one way which might be very different to other
20:39
countries. For example, in Australia we
20:40
have this whole idea of contractors and contracting.
20:43
So in any organization you might find like maybe sometimes even
20:47
half or more might be contractors who are working, you
20:51
know, from other companies and you'd have the full timers being
20:56
like a smaller percentage. So which is very interesting.
20:59
Different dynamic, right? Like that not everyone has a
21:02
work laptop from same company. They might be bringing their own
21:05
laptops. And when you build the product,
21:07
you need to make sure that you don't make assumptions about how
21:11
it might be in, you know, different countries and so on.
21:14
So giving that sort of customer specific feedback into those
21:20
reviews. And we also connect the feature
21:23
PMS with the different customers.
21:24
So we usually measure a lot at Microsoft with everything.
21:29
And we also speak a lot with customers and hear what they're
21:33
saying, hear their feedback. And we run these things called
21:38
private previews. So before the world sees
21:40
anything, we basically work a lot with those, some of the key
21:45
very large customers and also the smaller customers to hear
21:49
their feedback on a new feature that we're building.
21:52
And that's how we make sure that we are building the right thing,
21:56
that it's something that customers want and it's not
22:00
something, you know, that that would be where we would need to
22:03
go back and rework a lot of things.
22:06
So we have these two different rings of releases called the
22:09
private previews. It's all done under NDA, so they
22:13
won't really share about it externally, but they do guide us
22:16
quite a lot. And then we get to the public
22:18
preview stage where we share it with everyone, but it's still in
22:21
a state where we can make changes.
22:23
The APIs can change, the feature itself can change.
22:26
Sometimes it gets to that stage and we realise we need to go
22:29
back to the drawing board. It happens, but it very rarely.
22:33
And then after it's baked in, that's when we hit this phase
22:38
called general availability and it becomes fully supported and
22:41
usable. So, yeah, so my day job is spent
22:44
on work, part of it with customers hearing their
22:50
challenges about features that we already have and then feeding
22:53
that into what they're doing. Then the other part is spending
22:58
time on the internals that we are building on new features and
23:02
capabilities and, and then also working and sharing on docs and
23:08
you know, the external documentation and things.
23:11
And each of us have the special sort of area we specialize in
23:16
and different things that we do. But yeah, that's sort of like
23:20
how we build stuff at Microsoft in the identity space.
23:25
One of our leaders, the leadership team is resolved was
23:30
we want to make and try the sort of the most connect customer
23:33
connected product at Microsoft. And so it speaks volumes to like
23:38
my role and like the number of people we have who are like
23:42
being with customers and driving that feedback into the product.
23:46
So yeah. I'm sorry, I thought you were.
23:49
No, I don't know. You know, I think that, well,
23:54
your job title is product Manager, but if I was to come up
23:58
with a title for you, it would be developer advocate, right?
24:02
This is such an area of passion for you.
24:05
You said your background was development Entra ID.
24:08
You're you're kind of looking at Entra ID through the lens of a
24:12
developer, right? We all have whatever our
24:14
background is, we can, we all have a place in identity, but we
24:18
all come to it with a perspective based on where we
24:21
come from. So that's an area of passion for
24:25
you, right, Is really trying to look at the entry ID platform
24:29
from that developer perspective and make sure that as the
24:34
product continues to evolve, it evolves so that developers want
24:38
to work with it. Is that right?
24:40
Yes, absolutely that it's developer friendly and developer
24:44
1st and and also like for me it's I'm an admin, but I want to
24:49
manage it through code like DevOps and like it's because we
24:54
are sort of the gateway, right. Like Entra, the name is you're
24:57
entering in because you're going into the different application,
25:02
whatever it is that you're going to access.
25:04
And like the security of what we do is really important.
25:10
And I want to bring that maturity from the dev OPS and
25:14
the dev world into the identity and the security space so that
25:19
you're not just relying on click, click OPS, you click
25:22
things and then you have the configuration.
25:25
But you want to have that in code so it can be audited and
25:29
you know who changed what when and see all of that work, work
25:35
together, put together. Yeah, that's one of my passions.
25:38
And what like what I feel I'm bringing into the into the
25:41
identity space? Yeah, it's really cool.
25:45
I'm trying to wrap my brain around, So what is the scope of
25:51
DevOps when it comes to Entra? Because I think a lot of
25:54
platforms that scope is, you know, rather than click OPS for
26:00
migrating configurations that were maybe tested in an earlier
26:04
environment and pushing those to production and you know, kind of
26:09
a package way or in a more predictable way, you're not
26:12
going to forget a configuration etcetera.
26:15
Is that kind of the scope or is it much more than that?
26:18
It's much more that. So Dev OPS includes a lot of
26:21
different things. Testing is a big part.
26:23
So right now I've been working with some folks in the open
26:27
source world on a product that will help you, a framework that
26:33
will help you write tests for your configuration.
26:36
Because a lot of the times we like there's this, the Microsoft
26:39
threat Defence report that said 9095% large amount of the, the
26:46
attacks that we've seen or they, they resulted because of some
26:50
misconfiguration, right? So it was not turned on.
26:54
Some sort of security issue happened because the admins
26:58
hadn't configured it properly. And I've seen this happen with
27:01
some of my customers as well. Like they thought they had one
27:04
setting, but then over the course something had changed and
27:08
no one realized that it had changed.
27:11
And maybe they didn't think about the bigger picture of when
27:14
they were making that change. So you end up in a like in your
27:19
mind, you have this setting and this config, but in reality,
27:24
it's not that. And it's, it's allowing folks to
27:27
come in to your tenant. Maybe, you know, a simple thing
27:31
like one customer had a policy that said anyone who's coming in
27:35
as a guest or an external identity should be signing out
27:39
every single day, like their sessions should be killed.
27:42
They shouldn't be allowed to come in with that same token the
27:45
next day because you don't know what endpoint they're coming
27:48
from, right? So the token could have been
27:50
stolen and, you know, you could be a different actor.
27:53
You can't enforce compliant device policies on them.
27:58
But what happened was somebody went and changed the group that
28:01
was scoping all the guests. So they didn't change the actual
28:05
policy itself. They made a change to the group,
28:07
the rules for the dynamic group, and suddenly the policy was
28:10
there, but it was like not doing anything.
28:12
And all those guests, their sessions were like long lived,
28:15
like for months on end. They had access.
28:18
No one prompted them to sign in. And so you could end up with
28:23
something like that. So one of the things I want to
28:26
introduce with DevOps is to be able to have like regression
28:29
tests for your config and setting.
28:32
We are not going to go and sit and look at it right.
28:34
So when you introduce a new change, how do you write a small
28:37
test for it in in the in the dev world, we used we write test in
28:42
Python in like you have pester J unit and all of that.
28:46
So how do you write a test that checks those settings?
28:51
And then you can be having like overtime, hundreds of tests and
28:55
they can be running every day. So the moment something changes,
28:57
you know, hey, my someone changed the security policy, but
29:02
they could be, you know, someone inadvertently doing it or it
29:05
could be some real threat that, you know, could have changed.
29:09
And do you, you might need to go and re like update your test if
29:13
it's a valid change or not. So that that told DevOps
29:17
practice and bringing that rigor to the identity space is one of
29:21
my passions. So, so it's really a mile wide,
29:25
you know, in terms of the the scope, but I did want to hone in
29:30
a little bit on that. So I was setting setting up an
29:33
angler. I was hopeful that you're going
29:34
to say, Jim, that's exactly what it is because I would something
29:39
I see with my clients all the time is a great, a great
29:47
variance in terms of how they do pre production and testing.
29:52
And I will say when I see the most, even in larger
29:55
organizations that are, and in some cases maybe it's more in
30:01
large organizations where they have some type of QA version of
30:07
ENTRA or Active Directory, but it's a far cry from a copy of
30:13
production, OK. And so they can't do you know,
30:18
So say you're rolling out an IGA system or some other identity
30:23
tool. When you get to the QA version
30:27
of your identity tool, you're not interfacing with the QA
30:33
Active Directory or Enter ID because it's so far from
30:36
production as to be almost useless.
30:40
And I guess the the the question I have for you is where does
30:45
Microsoft stand in terms of best practice or kind of advice to to
30:52
your customers in terms of what, where should they be on the QA
30:58
spectrum? Should they be using production
31:00
for QA or should they have AQA environment and how closely does
31:04
it need to match production? Yes, and that's one of the
31:08
things about being working at Microsoft out with customers we
31:11
work with are so vast, right. You will have the small mom and
31:14
pop shops having Microsoft tenant and they're like the two
31:18
or three people in that with their mail mailbox and they have
31:22
access to that. And then we have these large
31:24
enterprises which might have like half a million users in the
31:28
tenant, like an entire nation of school students, like signing
31:35
into like one tenant with millions of users in there.
31:39
So it, it varies quite a lot in terms of our audience.
31:42
It's very hard for us to say like this is the one way go and
31:46
do it. So we, we give a lot of guidance
31:48
and it all boils down to the maturity of each organization
31:53
and how much they focus on the, the, the, the security and you
31:59
know what pains they go through and then they realise, OK, we
32:01
need to do this. In the past where I've worked
32:05
before, it's, you always need to have a dev test pro tenant.
32:10
And it depends on who gets to work in those spaces, right?
32:14
Like there are things in, in the Entra tenant that are like
32:17
tenant level specific settings. So you can't really test them
32:21
anywhere else other than in a different tenant, right?
32:24
You can't change like the core conditional access policies or
32:28
you know the authentication methods for some of the signing
32:30
into the tenant. You can play around with those
32:34
in the production environment. You might, if you like, you
32:37
know, block out fighter two keys, you put the wrong a GUID,
32:40
then say block these. You might not allow anyone to
32:43
sign into the tenant. Even the admin themselves might
32:46
get locked out. Yeah.
32:49
Yeah, yourself, right, which we've we've learnt in the last
32:53
few weeks you know how it you can basically block everyone out
32:59
and as the identity person, it's your responsibility, right like
33:02
you are, you're not wanting to do any changes that could, you
33:06
know, impact the entire org and no one can do their work for the
33:09
day and you lose 1,000,000 as a result of, you know that action.
33:15
So if for those sorts of things you would ideally want to, you
33:20
would want to have a different tenant, at least one or two,
33:24
like a dev test prod. I've shared, I'll share on the
33:27
link in maybe the notes you can share like model that we have
33:32
for dev OPS to have dev test prod behind the dev environment.
33:35
You do a lot of innovative changes, try new things.
33:39
The public preview features that I spoke about, you would try
33:43
them on like right now pass keys are in public preview phase in
33:48
enter ID. So that's where you would be
33:49
trying out these new arc methods and different conflict to see
33:53
how things work. You might not be trying it out
33:56
in prod right now, right? Some of those public preview
34:00
features and then as those features get into GA or you're
34:05
pushing out a new change, that's when you would, you know, move
34:09
those changes out into, you know, your pre production and
34:13
then into the actual production environment.
34:16
So you depending on the type of change, you can do that.
34:20
But when it comes to things like governance and packages and
34:25
access to things, it's again a hard thing, right?
34:27
Like you ideally, if you in an ideal world, you would have like
34:31
a sales force environment for production, you'd also have a
34:34
sales force environment for, you know, the like your development
34:38
or pre production. But you might not always have
34:41
the luxury of having two versions of every single app in
34:46
your organization. So you would try to make the
34:49
best of what you can, or at least you know, the core big
34:53
applications like your HR application, like those, the
34:57
things that provision identity through and so on.
35:00
You would ideally want to have, you know, the depth test and
35:04
prod instances of those because those are things you cannot just
35:09
change in production immediately, right?
35:11
You need to test them through those changes.
35:15
Yeah, definitely. And I've always, you know,
35:17
that's one thing I've found frustrating is I think a lot of
35:22
SAS platforms and applications now, they just say you get a
35:27
production and a sandbox. And what is the sandbox sandbox?
35:32
QA is a dev. I need more predictability.
35:37
It's always been like a a point for me, but that's another topic
35:42
for another day. I guess one last thing in this
35:45
DevOps area is, you know, all the attention in the world right
35:50
now seems to be on machine IDs and the importance of machine
35:54
IDs. And when it comes to DevOps, I
35:57
mean, it's a major consumer of machine IDs.
36:01
What are some of your perspectives there when it comes
36:03
to machine IDs? Yeah, so non human identities,
36:07
they're very powerful and it's a wave.
36:11
A lot of attackers get into environments because you leave
36:14
your secrets lying around emailing them to people.
36:18
And when the attackers get access to the e-mail, they can
36:21
then access, you know, the secrets or you check it into
36:25
GitHub accidentally. And those things live forever,
36:29
right, Unless you know how to go in and prune them out.
36:34
Even if you delete the file and do a new commit, it's still
36:36
there in history and people can get to those secrets and you
36:40
know, having hygiene around rotating it.
36:42
So I really love the whole identity industry moving and
36:47
working cross across the board, coming up with the standards and
36:51
like we have the identity workload identity Federation now
36:55
where you can use completely possible as identities in AWS
37:00
and Azure and work across the different clouds without any
37:05
secrets or certificates involved.
37:08
You don't need to worry then about rotation.
37:10
So those are the things I think we as an industry need to move
37:15
towards getting rid of all these secrets and certificates and
37:19
moving to more using the platform and those signals.
37:23
But then that opens up a new channel, right?
37:25
Like someone can add in a new identity and if you're not
37:29
carefully monitoring who added that in, now suddenly someone
37:32
has standing access to whatever that service principal can do.
37:36
And when you do dev OPS, you usually give a lot of
37:38
permissions to these service principal because they need to
37:41
go in and maybe configure your key policies, security settings
37:46
in the tenant. So you need a lot of monitoring
37:49
and visibility into what is happening with that identity.
37:54
What API is it calling? Is it suddenly doing something
37:57
different from what it was supposed to be doing?
38:00
So it is becoming like you're, you're fixing one thing, but
38:04
then there are other aspects now that you need to worry about.
38:07
So you get rid of certificates and secrets and move away from
38:11
them. But then you need to start
38:13
thinking of how you manage these identities.
38:16
Do you have a good list of, you know, all the identities in your
38:20
in your tenant and what do, what are the permissions they have?
38:24
What do they do? And just like we review
38:28
governance for humans, we need to review these non human
38:31
identities as well, right? Like does this, is this app
38:35
still being used? Is this script still being used?
38:38
Does it need this permission? Usually what happens is someone
38:41
that's a big migration project and they create these identities
38:45
and they do all and they have a lot of permissions, right?
38:47
Because they're creating, moving mailboxes, creating packages and
38:52
and so on. And then the project always runs
38:55
over time, right? It, it goes over and no one does
38:59
the cleaner. So you have these really
39:01
powerful identities that suddenly have, they can read
39:03
everyone's emails and no one did the work to finish, close off
39:07
the project and remove the identity.
39:09
So in entry, we, we've been working on adding access reviews
39:14
for machine identities and making sure there's an owner who
39:18
actually comes in and says, yes, I still need this identity, it
39:22
still needs this permission. And they close it off and like,
39:26
you know, have the governance in place for those.
39:28
So yeah, it's it's really important.
39:31
Yeah, that's always doing. My perspective is that it always
39:34
eventually boils back down to some human being saying whether
39:38
or not this non human account. Should.
39:41
Be or should not be. So yeah, it's a big problem to
39:46
solve and I'm glad this industry is paying attention to it,
39:50
probably more now than ever. Just a point of clarification,
39:54
you mentioned service principles.
39:56
What are service? Principles, sorry.
39:58
So it's Microsoft terminology. So we have these user
40:02
principles, users, user accounts and in in when we were in on
40:07
Prem AD, we basically took the same user identity with the
40:10
username and password and we use that for automation as well.
40:15
So when we moved to the cloud and intra.
40:19
We didn't want to take that approach at Microsoft, so we
40:22
actually wanted to treat this separately as non human entities
40:28
and we gave it a name as a service principal.
40:30
So you have the user principle where the authentication method,
40:34
you do an interactive sign in and it's what you see in the
40:37
login screen and people sign in in interview also have the
40:41
service principles, which is only meant for non human
40:45
identities. They call into APIs and there's
40:49
a different permission model that you have, right?
40:52
Just you don't give it like a global admin or an overall use
40:56
admin role. It needs to be very explicit
40:59
based on what like you know, this, it can only read people's
41:04
mailboxes, so you can scope it down.
41:06
And so the permission model and how you manage it is different
41:09
between user and service. The, we've been on a journey for
41:14
a while educating our vendors and all of them to move to this
41:18
whole model of using service principles.
41:21
But a lot of people, a lot of devs, unfortunately, from the
41:25
field that I come in, they take the easiest way, right?
41:27
Give me a username and a password, and then I just
41:30
automate with that. But a big change that Microsoft
41:35
is rolling out is enforcing MFA for all user principles for
41:38
Azure. So that as we speak right now,
41:41
there's this roll out that's happening.
41:43
We've told everyone that we're going to enforce.
41:45
There's no way for them to turn it off.
41:47
It's going to be enforced. So guess what?
41:49
A lot of the vendors, others who did this shortcut of using user
41:53
identities for their automation and their applications, now they
41:58
will need to fix those to use service principles, you know,
42:01
the right way of doing it, instead of using the user
42:04
identities because you won't be able to bypass the MFA for
42:09
those. Yeah.
42:11
That's cool, that's cool. I really love that.
42:15
So that that's a topic we could go on for many more hours, but
42:20
that's not the format of our podcast.
42:22
So one area that Jeff and I are passionate about, and since we
42:27
have you here on the hot seat, we're going to ask you about it,
42:31
is identity governance and administration.
42:34
And it's something that Microsoft has teased, I think,
42:38
for a long time. So we want to understand what is
42:41
the current state of IGA for Microsoft and what can we kind
42:46
of expect to see here in the not too distant future?
42:49
Yes. So IGA with Microsoft has been
42:53
growing up. It was just part of Intra before
42:58
and last year we announced Microsoft Intra ID governance as
43:03
it's own product. So it's it's not just part of
43:07
intra part of AD that you get it's it's stand alone product.
43:11
So it's matured quite a lot and that's why we now have it as
43:15
it's as it's own thing. And there is something that you
43:19
would acquire separately to what you get with Microsoft 365 and
43:24
identity. So it is growing up and we've
43:27
added ton of new features from life cycle governance to
43:32
managing identities in different applications.
43:35
There's work we've been doing on the provisioning and opening out
43:40
how you could provision. We wanted to get it right.
43:43
So initially we worked with just a few cloud providers like work
43:48
day etcetera to provision identities directly into enter
43:52
ID. What we're really doing is we're
43:55
looking into the future. So when we're building at
43:58
Microsoft, it's always looking into the future of where things
44:01
are going to be. And so our initial vision was
44:04
working with all these cloud HR vendors.
44:07
And the world eventually now is moving, right?
44:09
You will see. And you would have been seeing
44:11
it first hand, right? Like all of the HR systems are
44:14
being revamped and people are moving to the cloud.
44:17
And we wanted to make all of them work in a cloud native way.
44:20
Like there's no point bringing identities back to on Prem and
44:23
then syncing them up again into the cloud when those HR system
44:28
can directly talk to your identity provider and provision
44:31
identities and they can then do things in real time, right?
44:34
So when someone is let go or they change roles within minutes
44:39
of the change when it should trigger, it can then be pushed
44:43
into the identity provider in the cloud.
44:45
And that can then control all the, you know, the access
44:48
packages they need, the birthright access and things
44:50
like that. So our focus has been building
44:52
on those fundamentals to get all those things right.
44:56
That was the initial focus. But now we are starting to focus
45:01
on like the overall workflows and we've added the life cycle
45:07
workflow capabilities. But one of the key things that
45:10
Microsoft does and as I mentioned too, right, like we
45:12
have customers from various scales, right?
45:15
Like folks might have 10 users, 100 users, which is and there
45:20
will be like millions of customers like that.
45:23
And then we go to the larger enterprises.
45:26
So we want to build a product that will actually work for a
45:29
wide range of these folks and for people who might not have
45:33
the luxury of having an IAM consultant come in and set
45:37
things up. So we'd worked a lot on
45:40
simplifying the experience of creating this service,
45:43
catalogues of applications and having maybe someone in the chat
45:48
team itself defining what the packages are for them.
45:51
So our goal has been to make it widely usable by like, you know,
45:57
larger scope of users and which is overall good for the overall
46:01
industry, right? Like it's not something that
46:03
only enterprises and folks who can afford it, who would be
46:07
doing it. We are bringing more people into
46:09
this more model of you really need to have governance and
46:13
least privilege. You know, the old school way
46:15
off, you get VPN and you sign in and you suddenly have access to
46:19
all the servers and the SharePoint sites and the teams
46:23
and the groups without any governance on it.
46:26
We want to change that. And so it takes a different sort
46:29
of approach to make it accessible to all of all of
46:35
those folks who are not really IAM experts to be able to go in
46:38
and say, OK, oh, I understand this.
46:41
I just need to set some of these in a simple way and be able to
46:44
get that going. So that's sort of the
46:47
foundations fundamentals we've been doing, but now we are
46:51
focusing on the enterprise and bringing all of the enterprise
46:54
capabilities as well into government.
46:57
So yes, it's a journey. We are still like getting to
47:01
that point, but we also want to bring in a new way of thinking
47:05
like we don't want this to be very complex where you need an
47:08
army of people and a three-year project to roll out identity,
47:13
you know, and do it right. So we want to democratise that
47:18
Microsoft. It's great to hear that it's
47:21
opening up because I think, you know, historically one of the
47:24
challenges has been, well, Microsoft products work great
47:28
for Microsoft things, but once you fall outside of Microsoft,
47:31
it struggles a little bit. I think open standards
47:33
definitely helps with that, right?
47:34
We see the turn around with entry supporting, you know, open
47:37
standards and not just proprietary or custom things,
47:40
which is great. I find that there's still a lot
47:43
of companies that are not yet fully cloud.
47:46
And so we're in this weird hybrid state where we've been
47:50
for a while. I'm anticipating we'll be for a
47:52
while. And so, you know, how do I
47:55
leverage something like Entra IGA capabilities when I have on
48:00
premise applications that may or may not be Microsoft?
48:05
I have cloud applications that may or may not be Microsoft,
48:09
right? I mean, you've got things all
48:10
kind of all over the place. Is there, I guess, is there a
48:14
plan for kind of pulling that all together now that you feel
48:17
like you've got sort of the the basic structure in place?
48:20
Absolutely. And that's what we are focusing
48:22
on right now, like with things like, you know, the meme
48:27
connectors and all of the things that we had that were great in
48:30
the on Prem world. We just wanted to make sure we
48:33
designed it right because it had to work at the cloud scale,
48:36
right? With millions of users, you're
48:38
not just running inside one server now at on Prem.
48:42
So we wanted to get those right, but we are now working on
48:45
bringing all those different connectors to the cloud.
48:47
So we did start, we've been adding the ECMA connector
48:51
etcetera, where you can now provision identities and into on
48:55
Prem Oracle DBS, SQL DBS and so on.
48:59
And we've opened out the API. So it used to be just few HR
49:03
windows that we allowed to push into enter ID and now it's an
49:06
open out and our partners. So we leave a lot of room for
49:10
our partners to come in and be able to do that value add and
49:14
not Microsoft doing everything. So those just came out like last
49:18
year and we've been seeing an explosion of all of our partners
49:22
coming in and building all these connectors and it gives them a
49:25
way to provide that value add because it's not a
49:29
one-size-fits-all right. Like in Australia, we have our
49:31
own HR system that are really popular.
49:34
So each country has country specific apps and services that
49:38
they use and our partners have coming in and they're basically
49:43
bridging that gap and doing that sort of work to be able to build
49:48
those connectors into the various sorts of different
49:50
applications that are there. So that's it's the journey has
49:54
just started, but it is moving at a very rapid pace.
50:00
Yeah. The ability to leverage AP is if
50:02
they could be a game changer, being able to, you know,
50:06
leverage the power of that. One of the features that
50:09
Microsoft recently released was Security copilot, right?
50:12
We can't go, we can't go with an episode of Identity Center
50:14
without talking about AI. Where do you see things like
50:18
that, you know, impacting the way Entra approaches things?
50:21
They, you know, I know there's already some capability there,
50:23
but I guess where does Security Copilot really, really start to
50:29
gain steam, do you think, when it comes to identity?
50:31
Yes. So in the identity space, one
50:33
interesting thing is we have been tinkering with, we call it
50:37
machine learning and stuff before, right?
50:39
Like when it comes to things like identity protection, our
50:42
team has been because they get all these signals and there was
50:45
no other way to work with all of that than try to do machine
50:49
learning on, on all of this. So we talked about service
50:52
principal and workload identities before, right?
50:54
So there are detections that our team had built where if an app
50:58
is calling into someone's e-mail all the time and there's a
51:01
pattern of, you know, just checking the latest e-mail and
51:05
suddenly it starts reading, you know, other mailboxes or sending
51:09
emails, Our machine learning would pick it up as a detection
51:14
and say, like we're seeing some anomalous activity of this
51:17
service principal. So that is something we've been
51:21
doing for a long time in terms of using machine learning for
51:24
those detections. But Copilot has sort of opened
51:29
out things a lot, right? It's sort of brought it to the
51:31
front, not something you have just in the back end where we're
51:35
using it for the back end services.
51:37
You can now have users come in and interactively ask questions
51:41
and do things. So it's a huge area of
51:44
investment. What we've launched is sort of,
51:46
I would say like the version one where you can turn on Entrust
51:51
skills and there are lots of things you can do today with
51:54
Copilot, like ask questions about the sign in logs and
51:57
tracing through. Like when I work with the
52:00
customer and they have some issue.
52:01
We had to go through the different sign in log and the
52:04
token gets reused in different sessions and try to work out how
52:07
they did what and which policy kicked in.
52:11
And it takes, but like, you know, it takes kill and it it
52:15
you need time to go through and pass it all together.
52:18
But now you can just go into copilot and ask, OK, give me a
52:21
summary of how this session went and what they did.
52:24
And within, you know, within a few seconds, you get a nice
52:28
English readable format of what really happened, which is so
52:32
powerful when you're like, not an SME in that whole space.
52:36
And you need to know quickly and then decide whether you need to
52:40
block access till you, you know, fix that account, recover that
52:44
account if it's been compromised.
52:46
So yeah, that's what we've released.
52:48
And there's a lot the team is thinking about and building that
52:52
will be coming out soon. So it is definitely an exciting
52:57
space. And, and it's just evolving at
53:00
such a rapid space like the some people say like, you know, it's
53:04
costly, but then you can see with even GPT for the price,
53:07
like they just half the price for chat GPTI think last week
53:11
the APIs like the cost went down.
53:13
So we are tweaking and fine tuning all of that and making
53:19
them more efficient. So it's going to be something
53:21
that's going to be like leveraged and used in a lot of
53:24
contexts. Yeah, it's a, it's a huge game
53:28
changer for like every context. You know, I think about IGA and
53:33
I think about a business user being able to create an access
53:38
review ad hoc just by describing what they want to see in the
53:43
results, who has access to this certain role in my application
53:49
and has used it within the past 60 days.
53:53
And then, oh, you know, Jim McDonald comes back.
53:56
OK, tell me what Jim McDonald has done in my application over
54:00
the past sixty days. I think you know, being able to
54:05
query and quiz based on human, you know human language model so
54:12
powerful. Yeah, the voice.
54:13
As long as it's accurate. Yeah, that's true.
54:16
As long as it's not hallucinating, that's that's not
54:18
hallucinate. Right or anything like that the.
54:21
Hallucination part is the one where like copilot for security.
54:25
That's one of our big things, right?
54:26
Like it can't say the wrong thing.
54:28
It it better not say the thing than giving you the wrong
54:31
answer. So there's a lot they've been
54:33
working on that model to make sure that it is it's not sort of
54:37
the translation or, you know, the other sorts of models that
54:41
can be used. But I can't wait till the day
54:44
where you can just talk to it and ask questions and, you know,
54:47
get get a Jarvis like assistant with that.
54:51
But yeah. You know, I'm I'm bummed that
54:54
you guys want to wait for the Cortana branding, because I
54:57
think like this would have been perfect.
54:58
Like, you know, it's it was like Cortana was what, a few years
55:01
ago. Like now it's like, oh, this is
55:03
actually could be Cortana. So I'm hopeful that there will
55:06
be a resurrection of that, because I think that's a way
55:07
better name. You know, no offense to whoever
55:09
created Security Copilot, but Cortana's way better from a,
55:12
from a, definitely. I think room for the Voice
55:15
Assistant to come in and be be doing that right.
55:18
So yeah, I like, I've seen people already doing that.
55:22
They're driving and then they're asking like you can be doing
55:25
this access review while you're driving in the car, right?
55:27
Like you have this voice integration and you're just
55:31
asking things. So you don't need to wait till
55:32
you get to a desk and click on all these things before you can
55:36
do your access reviews is. That a preview of like an
55:39
upcoming Microsoft commercial for Entra.
55:41
You can do your access review in your car, said.
55:45
Nobody wants that. Wait till you get to your desk
55:48
or something like that. All right, we're getting close
55:51
to an hour, so we want to try to wrap things up.
55:53
You're and it's very early for you, so we want to let you get
55:56
out with your day. Before we started talking, you
55:59
mentioned that one of the things you like to do to sort of
56:01
decompress and get out of conquering the IAM world is to
56:05
go hiking. So tell me about tell me about
56:09
hiking and for specifically, what's the longest or furthest
56:13
that you've ever gone? Let's just call it in a single
56:16
trip, like how long and how? Far I'm relatively new to hiking
56:21
and I love it as a way to sort of be compressed because if not
56:25
in the role that I mean I'm always like consuming learning
56:28
new things and things that are not yet out and like it's it's a
56:33
lot you take in and I found out that I need space to like just
56:39
spend time sort of a meditation, not think about work and those
56:43
things, but it's also the time that I get inspired like, hey, I
56:47
can do this I can and new thoughts come in.
56:51
If not, you're just sort of consumed with this thing.
56:53
So hiking has been a way for me to do that, to be able to walk
56:58
through and to really just not spend a lot of time connected
57:05
like others, like I'm a lot, I spend a lot of time on social
57:08
media as well replying and so on.
57:11
So it gives me a way to just put things away and just be in, in
57:16
sort of the zone, just walking on and the Australian, like when
57:21
I live in Melbourne, like you, that's a past time for many
57:24
folks like to take time out. And we have lots of walks that
57:30
we, we have like I have the luxury of just being able to
57:33
drive like 10 minutes and have like huge, vast areas of land
57:39
that I can go exploring, Bush hiking through the national
57:42
parks. The longest I've done I've, I've
57:46
just, I'm just relatively new to all of this.
57:48
So the longest I've done is about like I would say about
57:51
1515 hours, but I've walked about like maybe 20 days.
57:56
I guarantee anything you say is going to be impressive to me. 15
58:01
hours in one day. So that's a, is that a one day
58:05
or is that spread out over a couple of days?
58:06
It was like a one day, like a whole day thing that we went on
58:10
me and like a group of friends. And so we just talk random
58:14
things and from different walks of life.
58:17
So we just like it's, it's nice to be in nature and just go
58:23
through that. It's really quiet.
58:25
And the beautiful thing in Australia is you can you come
58:29
across Wallabies, Kangaroos in your walks and you see this like
58:35
the amazing nature that you have and it's.
58:38
I was going to ask if you have like any wildlife encounters
58:41
along the. Way something you.
58:43
Know what happens when you see a kangaroo?
58:45
Do you get to a boxing match? Like how does that work?
58:47
So yeah, we try to stay far away as much as possible, but the
58:50
Wallabies are quite harmless. Like they, they'll just stare at
58:54
you and you stare at them and like, figure out who's going to
58:57
move out of whose way. One of us decides to move and
59:02
then we walk on. But yeah, it's, it's really nice
59:07
way to, you know, decompress and do things.
59:10
So yeah, that's that's been one of my passions.
59:15
Jim, how are you? How far have you ever hiked?
59:17
I know you. I know you've hiked kind of all
59:19
over the place, but what's your distance?
59:22
Record. So Medista's record, I think was
59:25
when I did a nice stretch of the Appalachian Trail, did 100
59:29
miles, which is like 160 K. That was over five or six days.
59:36
So you're backpacking in a 20 LB pack on top of the fact, or I'm
59:40
sorry, like a 50 LB pack on top of the fact that you're, you
59:45
know, walking 20 miles a day. So it's not like a flat area,
59:49
right, You're going out it's. Very rocky in the Appalachian
59:54
Trail. So the part that I did was in
59:55
Pennsylvania and it's some of the most beautiful country.
59:59
It's like you're on like a a mountain Ridge and it's very
1:00:04
rocky, very hard. There is some up and down, but
1:00:08
like what you pointed out is it's not like walking 20 miles
1:00:12
on the sidewalk. I've also I've also hiked from
1:00:20
Tawalami area of Yosemite down to the valley.
1:00:26
In that hike, you go up to about 14,000 foot elevation.
1:00:31
At that level, the air is much thinner.
1:00:34
So you walk like from here, you start setting goals.
1:00:37
I'm going to walk from here to there and then I'll take a
1:00:39
break. I'm going to walk from here to
1:00:41
there and then I'll take a break, which is just catching
1:00:44
your breath. I mean it is exhausting when you
1:00:47
start hiking and I was Backcountry hiking.
1:00:49
So you have to be prepared for for bear and everything.
1:00:53
So they give you these bear canis, bear proof canisters, put
1:00:57
all your food, your deodorant, anything that a bear would want
1:01:01
to get to. And it looks like a mini keg.
1:01:05
It's. Rubber.
1:01:06
You throw it up over a tree branch or something.
1:01:07
You throw it up over a tree branch and then you know.
1:01:10
Like the bear will probably try to get it if they smell it, but
1:01:14
I actually wanted to see a bear. Well.
1:01:17
Come on over, I'll show you them because they come through my
1:01:19
property all the time. I know.
1:01:20
Well, you always show me, so that's, that's pretty cool.
1:01:24
But my big passion now is tracking my steps.
1:01:29
I shouldn't say it's a big passion.
1:01:30
It's something I got onto recently because I realized, you
1:01:33
know, the iphone's always tracking your steps and I've
1:01:38
been trying to hit like 8000 steps a day out of minimum.
1:01:42
That's a lot of steps. But I think if I hiked 20 miles
1:01:48
with my iPhone in my pocket, it probably would have been like,
1:01:51
yeah, 50,000 steps someday. I literally would have been off
1:01:55
the charts like. A watch or a ring or something
1:01:58
in that car like your, your phone is not like if you're
1:02:01
going to be that dedicated to it, you'd probably get
1:02:02
something. Look at me, I got the watch and
1:02:04
the ring. So.
1:02:05
I've been thinking about. And the only steps I'm taking
1:02:07
are like from my desk to the refrigerator.
1:02:11
What is they? What got me passionate about it
1:02:14
was it's just walking. The human body is made to walk
1:02:18
long distances and it's actually one of the best things you can
1:02:22
do for your health is just they said, they say your goal should
1:02:25
be 10,000 steps a day. If you get 10,000 steps a day
1:02:29
and then you drink a lot of water and stuff like your health
1:02:32
could improve dramatically just from doing those two things.
1:02:36
Now walking 10,000 steps a day when you're very sedentary is a
1:02:41
is hard to start, but you don't have to start at 10,000 steps.
1:02:44
Start where you're at and then just try to increase it and then
1:02:48
make it a, I don't know. Yeah, the the technology side of
1:02:53
tracking it is also right up my alley.
1:02:55
So I think Jeff, you should, you should give it a whirl.
1:03:00
I mean, I track it. I mean everything is tracked.
1:03:02
There's I'm just full of metrics.
1:03:05
I, I get most of my steps on travel days.
1:03:07
So airports, terminals, you know, all that type of stuff.
1:03:11
So I'm flying to Dallas tomorrow.
1:03:12
I'm sure I'll get my steps in. I'm flying back home from Dallas
1:03:16
on Sunday. I'll get steps there and then I
1:03:19
go to where do I go? Then I go to South Bend.
1:03:21
So the, the travel days are my step days because I definitely,
1:03:25
because for whatever reason, the travel, whoever always lands me
1:03:30
at the furthest, you know, gate farthest away from the exit.
1:03:35
And so, you know, it's like a good mile and a half, two miles
1:03:38
from landing to actually getting so.
1:03:41
Here's the tip. I was going to mention.
1:03:43
Here's the tip I have. I was going.
1:03:45
To mention that to you, I'm sorry, go.
1:03:47
Ahead so one tip for your audience right is to say just go
1:03:51
out for a walk put the podcast on and do your one hour walking
1:03:54
while you're listening to the podcast and like you know no
1:03:57
distractions you can just step out of the house and walk till
1:04:01
the podcast finishes and and come back so.
1:04:05
And a lot of people do that, like this podcast is good for
1:04:07
about a two mile walk roughly at a, you know, a relatively decent
1:04:12
pace, sometimes fast food, sometimes slower.
1:04:15
OK, why don't we go ahead and wrap it up there?
1:04:18
I'm not much of A hiker, you know, for me it's travel days
1:04:21
and, you know, going up and down the stairs to my refrigerator to
1:04:24
get another can of Coke 0 between meetings.
1:04:26
So we'll head go ahead and have links in our show notes.
1:04:30
So all of our discount codes will be there.
1:04:33
Put a link, Merrill, to your LinkedIn profile so that people
1:04:36
have questions or want to reach out and follow you.
1:04:37
They can find you there. And then also the Twitter link
1:04:41
that talked about the Entra DevOps tenant model.
1:04:44
So you're kind of sure that we'll have it on our show so
1:04:47
people can check that as well. So you can visit us on the web,
1:04:50
idacpodcast.com. We're on Twitter X whatever it's
1:04:54
called when you listen to this or watch it at IDAC Podcast, the
1:04:58
YouTube channel youtube.com slash at IDAC podcast or even
1:05:03
easier, just idacpodcast.tv take you straight to the YouTube
1:05:07
channel. We're still trying to grow that.
1:05:09
So give us a like and subscribe over there and show some support
1:05:12
for the show. We'd greatly appreciate it.
1:05:14
So all with connected Jim and I on LinkedIn send us ideas for
1:05:18
shows. Want to give a special shout out
1:05:19
to Pam Dingle for making this introduction and and bringing
1:05:22
Merrill into our lives. So thank you very much Pam for
1:05:25
that. And yeah, we'll go ahead and
1:05:28
leave it there. Thanks everyone for watching and
1:05:30
or listening and we'll talk with you all in the next one.
1:05:34
You've been listening to Identity at the Center.
1:05:38
We hope you've enjoyed the show. Make sure to like, rate and
1:05:42
review, and we'll be back soon. But in the meantime, hit the
1:05:46
website at identity@thecenter.com.
1:05:50
See you next time on Identity at the Center.