Latest / Identity at the Center / #241 - Authenticate 2023: Standards & Entra with Pam Dingle of Microsoft

Transcript

#241 - Authenticate 2023: Standards & Entra with Pam Dingle of Microsoft · Identity at the Center

0:05
This is identity at the center. If it has anything to do with
0:10
IAM, this is the go to podcast now your hosts Jim McDonald and
0:17
Jeff Stedman. Welcome to the Identity at the
0:23
Center podcast. I'm Jeff and that's Jim.
0:25
Hey, Jim. Hey, Jeff.
0:26
How are you? Not so bad yourself.
0:28
Good. I mean, we're here at
0:29
Authenticate Fantastic conference.
0:32
The Expo hall has been really nice to have gotten an
0:35
opportunity to drop by a few booths, including the four truck
0:39
booth. And you know, I got that.
0:40
I said what I said to them was how many people have stopped by
0:44
and asked what's happening with four Truck and Pain.
0:47
It's like, yeah, pretty much everybody so.
0:49
What'd they say? I don't want to go into the
0:52
whole thing here, you know, but it was it was good.
0:55
And I think we have commitment to have some people come back
0:59
and talk to us. So we will do that when they're
1:02
ready to do that. That's always appreciated.
1:04
How's the swag game in there? You know, I'm not my early days
1:09
are going to IT conferences. I wanted everything like I would
1:13
go around with like. The shopping carts and trick or
1:17
treat, you know, can I have my whatever T-shirt or stress ball?
1:22
Sliding camera cover, which I hate.
1:24
Oh, the slide camera covers. Yeah, hey, let's put this thing
1:27
that ruins you your ability to close your laptop.
1:30
That's a great idea. Yeah, they're fantastic.
1:33
And then there was the the dongle for charging any type of
1:37
phone, even though most people just have one type of phone.
1:40
I find that actually handy, 'cause I have so many different
1:42
devices I'm travelling with. But yes, that was over.
1:45
But you don't need each of them though.
1:47
So swag game, we're not sure yet.
1:49
I have to go through. I haven't really taken a walk
1:51
through yet other than to get to our little room.
1:53
We're we're behind. Because you ever notice as you
1:56
walk the conference hall floor, some of the booths have
2:00
different levels of swag. So I think if it's like you just
2:03
want the entry level swag, it's like you pop one balloon with a
2:06
dart. But if you want the next level,
2:08
you've got to pop three balloons with the dart.
2:11
And then there's like the major SWAG, which really means that
2:14
you're going to spend $1,000,000 with them.
2:17
I don't know what are you talking about.
2:20
Go out there and I'll, I'll point it out.
2:22
Is there like a specific vendor that's doing that?
2:23
Well, I did see one vendor that had like a top level swag which.
2:29
Was like a packing bag, one of those, like fancy bags where you
2:33
put your clothes in and then put it in your luggage so you
2:38
couldn't. I like, I was like, well, what
2:39
do you have to do to get that one?
2:41
Because other over here you have these camera covers.
2:43
I think they're for everybody, right?
2:46
Well they let you scan your badge and you trade up your
2:48
e-mail in exchange for 1000 emails from from BD person to
2:52
you get the camera to get on the door.
2:54
Yeah, but one thing I've noticed also.
2:55
Now I'm not out here telling people not to let them scan your
2:59
badge, but some places some vendors will scan your badge and
3:04
then they will call you on the phone.
3:07
Let's start getting these personal phone calls and like.
3:09
Never call me on the phone. Do not call me on my.
3:11
Phone is not for phone calls. You're not my father or my
3:14
mother. I do not want phone calls from
3:16
you. You can send something to my
3:18
e-mail, hopefully my personal e-mail, hopefully my Hotmail
3:22
account that I opened 25 years. Yeah.
3:25
That's that's that's good. That's good.
3:27
Yeah. So I gotta go.
3:28
I'm judging conferences, as you know, based on two things, swag
3:32
and the quality of cookies. I've yet to see cookies, but we
3:34
did have custom doughnuts last night we talked about in
3:37
previous episode. We'll see what the swag
3:39
situation looks like. Do you want to talk about
3:42
Microsoft? We thought we were going to talk
3:44
about dessert the whole time, but.
3:45
OK, let's do it. We probably shouldn't talk about
3:48
them behind their backs, so why don't we invite Pam Dingell,
3:51
director of identity standards at Microsoft, to the show?
3:54
Welcome Pam. Well.
3:55
Hello, thank you for having me. This is a conversation that has
3:58
been a long time coming. I feel like we've been like 2
4:00
ships in the night passing through conferences.
4:02
Never actually don't think met until behind stage.
4:06
Last night as you were coming off, we were going up and it's
4:10
great to have you here. I know that you've been in the
4:13
space for a while, but one of the things we do as ritual for
4:17
first time guests is understand the origin story of our identity
4:21
superheroes. Like how I did that.
4:23
Can you tell us, how did you get into the identity space?
4:26
Is it something that you chose or did it choose you?
4:28
Yes, how many hours do we have? We have 5 1/2, OK.
4:32
No problem. No problem.
4:33
You might want to speed me up like the little chipmunk
4:36
chipmunk you know. No, I got into identity quite a
4:39
long time ago. I started off.
4:42
So I I was born in Canada, I am a Canadian, and I went to, you
4:47
know, a local university, got a computer science degree there.
4:50
And so I was working right out of school as a System
4:53
Administrator for an oil company in Calgary, Canada and ended up
5:01
getting snapped up by a.com Darling.
5:04
So that tells you how long ago this was.
5:06
So it was 1999 and they actually sent me to.
5:10
California for the first time in my entire life to do training
5:13
with Netscape. Again, with the ageing, you
5:17
know, metaphors. But but I ended up training up
5:21
in Directory Services then and I started to work in what they
5:25
call middleware, which at the time was mail servers, web
5:29
servers and directory servers. And it was just, you know, we
5:32
were the imported Canadian talent because it was the.com
5:37
boom and you could not get. Anyone to do anything.
5:41
Everyone was all taken, shall we say.
5:43
And so they used to fly us in and we used to hang out in
5:48
computer rooms and install middleware.
5:51
And I didn't think of it, you know, the mail servers, web
5:53
servers, director, servers, whatever.
5:55
And then I ended up moving to a consulting firm that sent me to
6:01
a conference and this was 2001 and I went to the Burton Group
6:06
conference, the Catalyst Conference.
6:08
Which, you know, some of your listeners might have I've been
6:11
to. Catalyst the highlight for me
6:13
was it's it's on the Bay in San Diego.
6:16
Location is perfect. That will get me to a
6:18
conference. Oh, yes, yes.
6:19
Well, this one was in San Francisco.
6:20
It was at the Hilton in San Francisco, and it changed my
6:25
life. I mean, it was people who were
6:30
debating why things happened and talking about the consequences
6:35
of these implementations and and.
6:37
You know, why would it was important for people to have
6:39
good experiences logging in? And for whatever reason, I got
6:44
there and I did not like what people were saying on the stage.
6:48
And so I stood up and asked questions in the conference and
6:52
I asked question after question. And at the end of that
6:56
conference, Jamie Lewis, who ran Burton Group at the time, said,
7:00
hey, you should present a talk, you should apply to talk next
7:05
year. And for me, that was the light
7:07
bulb going off. You know, I had loved the
7:09
experience. I got invested in what identity
7:12
management even was at that conference.
7:15
But the idea that I could be part of that community just lit
7:18
me up like a, you know, like a firework.
7:20
And so I spent the whole year excited and already and I
7:24
applied to speak at the conference and they rejected me.
7:27
They rejected me and then please.
7:29
Submit this so we can say no. Exactly.
7:32
No, no, it was. I mean, it wasn't funny at the
7:34
time. I was devastated, but four years
7:36
straight, they rejected me. So just for anyone who is
7:41
listening, who wants to speak at one of these identity
7:44
conferences, just know that the people you see up there who are
7:48
doing, you know, who just look like it's a piece of cake, and
7:52
they were born to it. They they weren't they.
7:55
Had to get rejected and they had to work their way through all of
7:59
those same issues. And so that really kicked me
8:02
off. I ended up moving from Calgary,
8:05
Canada to go work for Ping Identity and in the office of
8:09
the CTO. And that's what got me really
8:11
connecting to customers specializing in federation.
8:15
Got me into the standards world and of course that's where I am
8:18
now. So I you know, I worked in the
8:20
office of the CTO there and then transitioned to Microsoft as
8:23
Director of Identity Standards. So what does that mean?
8:26
Director of Identity Standards. It's the best job ever.
8:30
Absolutely the best job ever. So I have a highly skilled team
8:35
of folks who work in various different standards bodies,
8:38
including i.e. T, FW3C, the Decentralized
8:41
Identity Foundation, you name it.
8:44
We go in and we try to write the standards in conjunction with
8:48
our engineering teams that we think will power our platform
8:53
for the next 10 years. And so that can involve
8:57
standards like Oauth, Open ID Connect.
9:01
Right now we're working on Open ID for BC, which is the sort of
9:06
the umbrella for a lot of the decentralized integrations with
9:09
Open ID Connect. So that's a really big one.
9:12
We're working in the international standards
9:13
organization on ISO18O13-5. Do you like how I can just
9:19
rattle that up, which is mobile driver's licenses, which we
9:22
think is going to have a huge impact?
9:24
Going forward in the future, and yeah, the, you know, the goal is
9:28
to understand in advance how the world will need to connect and
9:33
then find the ways to do that securely.
9:35
And of course, we collaborate with everyone else in the
9:38
industry. So Microsoft is in there.
9:41
But also all of the other big identity players are trying to
9:45
accomplish the same thing. You should see my notes that I
9:48
just made as you're talking. So my first identity conference
9:52
was O6 digital ID world right and it was Kim Cameron on stage
9:57
talking about the the laws of identity, right.
10:01
And I was like revolutionary. And that's where I got sucked
10:04
in. I was like whoa, this isn't
10:06
just, you know plug this into there.
10:09
It this is like philosophical layered on top of technology and
10:14
these guys are trying to solve the problems of the world with.
10:17
So anyway, I see how you got sucked in.
10:20
One thing I noticed in that conference there, and this is
10:23
2006, right? You said you ain't no one, there
10:26
are very few women. You're kind of that triggered to
10:31
me. You're kind of a trailblazer.
10:34
You know, I don't want to make you feel weird by saying that,
10:36
but it's the truth. I mean, there were less than 5%
10:39
of the audience. I mean, I still think it's
10:42
pretty lopsided when you go to conferences, but I mean, night
10:46
and day difference now versus 20 years ago, right?
10:49
It really is a night and day difference.
10:51
I mean, I. Yeah, there were often ten women
10:55
and I knew all their names. We all knew each other, still
10:57
know each other. For that matter, a lot of them
11:00
are still in identity. Doesn't matter.
11:01
Like once you're in, you stick. And now you're right.
11:05
It's much, much more balanced. And I love that I do work, do a
11:11
lot of volunteer work for the Women in Identity organization.
11:15
Of which we are members. Yes, that's fantastic.
11:18
And yeah, it's really fun to see.
11:20
I mean, there's a lot more opportunity.
11:22
But the thing that I was lacking at that time, I really did feel
11:26
isolated. I was almost always the only
11:28
woman in the room. And you, you get used to that.
11:30
I mean, part of my consulting background, which was that sort
11:35
of first job, beats it into you. You have to be the authoritative
11:39
voice in a room. And so you figure out how to do
11:43
that. But I don't know.
11:47
I mean. Right now at Microsoft, the
11:51
identity division at Microsoft has an amazing amount of
11:55
diversity to it. And so I am almost never the
11:58
only woman in any meeting I attend.
12:00
And I never knew that to be grateful for that until I had
12:04
it, well, proper to you because somebody had to be, you know,
12:09
the first, right? Or I'm not even saying you're
12:11
the first, but Trail Blazers, like the role that you play like
12:15
yourself, so important to what's happened.
12:20
Let's kind of get into some of the, you know, what's going on
12:23
with Microsoft today. I think I've been a Microsoft
12:26
person since my original IT certification was in Windows NT4
12:31
desktop, right. So I've kind of been a Microsoft
12:34
person, but I've kind of gotten away from that with being in
12:37
identity management because Microsoft solutions
12:41
traditionally and been the leading ones and I think a lot
12:46
of them, a lot of it was around very proprietary solutions for
12:51
like Access management for example.
12:52
Just think of WS Fed right and but it seems like there's been a
12:59
major shift, major shift at Microsoft and towards its stance
13:05
on standards. Specifically, the ones I have my
13:07
eye on are the identity standards.
13:10
But to you what? What's the story behind that?
13:14
Yeah, I agree. And I will say that I've only
13:17
worked for Microsoft for five years.
13:19
So I kind of came in in the the golden days, right, where where
13:23
that stance had changed and there was investment.
13:26
I do think the fact that they hired a director of identity
13:28
standards was in part of an expression of the fact that they
13:34
could see that this was a a serious requirement.
13:37
So I can't really speak about, you know.
13:39
Why that change occurred because I came in after.
13:41
But it is certainly the case now that we very much recognize that
13:47
nobody wants to be locked in. That is the bottom line.
13:51
Nobody wants to be locked in. And so knowing that you can
13:57
bring in the tools you need at the time you want and connect
14:01
them all together is the reason why people feel comfortable
14:05
signing up for some of these technologies.
14:08
One of the things, the thoughts I have is moving or violating
14:12
standards, if you will, is not just coming up with a new
14:15
standard or ignoring a standard. It's changing a standard.
14:18
Let's just add an attribute to SAML.
14:21
Let's just make it a little like tweak it a little bit.
14:25
Do you talk to us about how it works at Microsoft?
14:27
Is the are you like the traffic cop?
14:29
Like, no, no, no, no no. Well if anyone tries to suggest
14:33
we change SAML then I mean there is no changing SAML.
14:38
You can absolutely try. I mean the the real truth is
14:41
that the the forces that are applied are almost immutable
14:46
forces. For example, Saml's a perfect
14:48
example that that stuff is old. It works so well.
14:55
But nobody's going to go in and tweak those implementations
14:57
unless there's a real business reason to do it.
15:00
And so you know, there's a there's almost a time to value.
15:07
Back and forth that you have to do.
15:08
I mean, can you try to change SAML?
15:10
Yes. Will you get adoption in any
15:14
kind of size or anytime soon? No.
15:19
And so, So what we can do versus what we can do and gain adoption
15:22
is really that that's the metric that my team often talks through
15:27
and it's easier with newer things, for example, the the
15:31
decentralized world right now we have a lot of flexibility.
15:34
And or or for example another one is proof of Possession.
15:38
So that's a specification that just ratified and one of my team
15:43
members was very heavily involved in that and they it was
15:48
actually incredibly valuable. We took all of our knowledge of
15:51
what we're doing in our in our token protection work right.
15:56
So token protection is a feature of of the intra suite but but
16:02
the Depop spec. Utilized a bunch of those
16:06
learnings right from when the engineers realized something
16:10
couldn't work right. So there is this, there's if you
16:13
do it right, you're helping all of this knowledge make its way
16:19
to the public world. But yeah, if you do it wrong,
16:23
you end up making things that no one will adopt or making things
16:26
that that you know come out after your product has already
16:30
put something in. And and that's the big thing,
16:32
right? You have to know that.
16:35
These things happen on cycles. You release it once, so you're
16:37
not going to go in back and tune it six months later.
16:40
So there's a huge problem there because the standards come out
16:44
in advance. But if they don't, if you're,
16:47
you know, developing the standards at the same time
16:48
you're developing the software, right, you really do have to
16:52
have a tight, tight coupling. How do you make the decision of
16:55
which standards to throw support behind and which ones are?
16:59
Maybe it's not the right time yet.
17:01
Right. That's an excellent question.
17:04
A lot of it is product alignment.
17:06
So you know, you can create a standard for something that you
17:09
have no plans to implement. But yeah, it's and it's a lovely
17:14
idea and it certainly has happened.
17:16
Sometimes you're so far ahead in your vision.
17:19
But yeah, you, you need to be able to justify what you do and
17:22
why you do it. We certainly do.
17:25
My boss is Alex Simons, who, by the way, should really come on
17:29
this show. You need to.
17:30
Open invite. Come on, Alex.
17:33
But you know, it's really in many ways Alex's vision because
17:36
he he runs the product management office, so he's, you
17:41
know, he's working with the rest of our executive team to decide
17:44
where our, our large priorities are.
17:47
But the other thing is we can't just, we can't just lead.
17:53
Just because it's convenient for us doesn't mean that anyone else
17:56
cares. And so there.
17:57
So the real judgement is what kind of momentum exists.
18:01
Is there community momentum? Because if there's community
18:04
momentum and we're not ready, we will likely still participate
18:09
because otherwise otherwise the standard gets developed and we
18:11
don't have input, right. So that momentum piece is what's
18:15
a really interesting question, Like for example, right now,
18:19
authorization huge, so big, right.
18:22
It's, you know, everyone's interested suddenly.
18:26
And I for anyone who's been in the industry for a while, I mean
18:29
authorization. Has had its ups and downs, shall
18:33
we say. You know, I don't know if either
18:34
of you remember DSML. Yeah, very vaguely.
18:39
I think it came out on parchment.
18:41
Yeah, it might have, it might have and of course exact MO and
18:44
so. So that's an example of
18:46
something where you know we have interest, but there's also
18:51
momentum and that momentum may grow faster than what we would
18:55
normally try to push it into being.
18:58
But you you got to run with it. You got to roll with the flow
19:01
over here at the Fido Authenticate conference.
19:04
So passkeys. What's Microsoft's stance on
19:08
passkeys? We are huge supporters of
19:10
passkeys. We have been working, you know,
19:14
for quite some time on the ideas.
19:17
You know, we're working in all of this in that technical
19:19
working group and within the web auth and working group in W3C on
19:23
that. Tim Capelli is is the team
19:26
member on our team who's really shepherding that.
19:29
Yeah, we think it's really important.
19:30
We still completely support 5O2 credentials of all kinds, right?
19:35
So it's not like we have shifted our interest.
19:38
We are expanding our interest to make sure that synced pass keys
19:42
are something that can work, security keys are something that
19:45
can work, you know, platform authenticators or something that
19:48
can work. So we see those three channels.
19:51
As being a way that we can cover a ton of the population and have
19:55
them have a fishing resistant credential.
19:58
Is it easier or harder having such a huge install base to do
20:02
stuff like that? Oh, it's harder.
20:05
It's absolutely harder. I mean that because the platform
20:09
is so critical like the platform is what make passkeys a fishing
20:14
resistant credential, you have to have that proximity element
20:17
to be able to, to prevent secrets from being copied,
20:22
right. So, So yes, changing the
20:25
platform is a non trivial thing and and it's expensive and it's
20:31
it takes a lot of cross company commitment to do that.
20:35
But the great thing is that our Windows team, I'm not on the
20:38
Windows team, I'm in the IDNA group, the Identity and Network
20:41
Access group. But you know, we have very
20:44
strong commitment from the Windows 11 team on all sorts of
20:48
security related pieces. And we also have a huge amount
20:52
of support from our internal IT group, right, which of course is
20:58
on the front lines of protecting, you know, not just
21:02
Microsoft as a company, but Microsoft as a product and the
21:04
platform that we represent. And so, yeah, so there's sort of
21:08
a virtuous cycle there of needing needing phishing
21:13
resistant authentication just for ourselves, but also wanting
21:16
to enable it for everyone else. We're a customer.
21:19
I think one of the interesting factors is that Microsoft is so
21:25
global, so many product lines. It's like it has to work for
21:29
everyone. So you have cultural challenges.
21:33
You also have like disability challenges.
21:35
I mean, it's like the government's problem, but even
21:39
larger. Yeah, I agree.
21:41
And This is why I really strongly believe that security
21:44
keys are absolutely critical for the passkey ecosystem.
21:48
Because the security keys are the pluggable piece, right?
21:53
If you platform authenticators like Windows Hello and Face ID
21:57
on Apple, those things are what are going to enable the massive
22:01
part of the distribution curve to be successful.
22:05
But there is no reason why you can't create a security key that
22:08
addresses a certain disability, right, or a security key that
22:12
innovates incredibly and takes us to the next level.
22:15
So without that plug ability and that ability to to not have to
22:21
completely depend on the interface of the platform, I
22:25
think we would be limited in how we could innovate in the future.
22:30
Can you give an example of what an alternative security key
22:33
might look like? Because I know Microsoft has
22:35
spent a lot of time on hardware and things like that, like Xbox
22:37
has. Specific controllers for
22:39
example, that are built with that population in mind.
22:42
What would a security key look like in that?
22:45
Well, I can only tell you personally I, you know, I'm not
22:47
aware of of the different projects that are actually
22:50
officially going on. But I will say I did buy an Xbox
22:53
Adaptive controller and the little button kit, and I do have
22:57
this dream that one day you could actually, for example, you
23:01
know, click a certain set of buttons in a certain certain
23:03
sequence to unlock your security key hardware in it and send a
23:08
secure credential. But you know, I'm not aware of
23:12
anything official, but wouldn't. It be cool but if anyone wants
23:16
to you know try it let me know. Yeah, Microsoft has made a lot
23:19
of, a lot of investment in those adoptions of those adaptable
23:26
methods. The Surface Line has been with
23:28
that. I have a new Surface Book or
23:30
sorry Surface Laptop Studio Two at home.
23:33
Right. The haptic feedback and being
23:34
able to change the mouse pad based on your own ability to
23:38
sense the touches, it's like a duh, right?
23:42
Like, why didn't we think about that before?
23:45
Yeah, that's so true. And I find it impressive.
23:47
I want to switch over to Microsoft Intra because every
23:50
time I hear the word Microsoft Intra, it's always some news
23:54
announcement of OK, what do they do now?
23:57
There was some recent, you know, announcements made and
24:00
rebranding or name changes. I'm never, I'm never quite sure
24:04
what the announcement is, so please take this with all the
24:07
love in my heart. What is Microsoft Entra doing?
24:10
Who's this for? All right, so Microsoft Entra is
24:14
is the identity product portfolio that we own.
24:18
So we we basically got into an issue where Azure Active
24:21
Directory was our brand but directory was in the name.
24:26
And the problem is we have expanded so much farther out
24:30
from directories that we needed a way to sort of start
24:35
differentiating between the different things within the
24:37
identity portfolio that we delivered.
24:39
And So what we ended up doing is Entra is the is the umbrella
24:45
portfolio and within that we have Entra ID which is the
24:49
original Azure Active Directory. So that's where users are stored
24:53
and groups and all the amazing things that happen in any
24:56
directory. And then we have expanded into
24:59
the the set of other products which are the things you're
25:02
hearing about. So for example, there's intra ID
25:06
governance. So that's your IGA tool.
25:10
I don't want to list them all because you all would have your
25:12
eyes rolled back in your head and you'd fall asleep.
25:15
However, the you know things like team, so we have a cloud
25:20
entitlement management piece, we have intra verified ID which is
25:24
our decentralized identity offering.
25:27
And so the idea is that these things can now have their own
25:30
identities, they can grow and have features added, and people
25:33
can easily differentiate, but also have the the sense that we
25:39
are integrating everything, that it is all part of a family.
25:43
So my experience with Microsoft's interest so far has
25:47
been if you're in the Microsoft ecosystems are great.
25:50
Tool, right. There's a lot of capabilities
25:52
when you start to go away from the Microsoft ecosystem that
25:55
there are some gaps there. Is that a fair criticism of
25:59
Microsoft's intra as a whole? Is that something that's being
26:02
addressed or are there things that I'm just not aware of that
26:05
maybe it's just a bad rap and it's not warranted?
26:08
Well, we're definitely working hard.
26:09
I mean, we have heard that criticism before.
26:12
We are definitely working hard to make sure that it isn't
26:16
actually true. So you know we are obviously
26:19
standards forward as standards forward as we can be.
26:22
So we integrate via federation, we integrate provisioning via
26:26
skim, we integrate and you know we're working on shared signals
26:30
right now. So you know we're we're making
26:33
sure that we are modular and and that goes a long way towards
26:37
that and we are a stand alone identity product but we also are
26:42
the backbone for the entire Microsoft platform.
26:45
So we serve identity for Azure and for Office and for Dynamics,
26:52
all of that as well. So there, there's a balance
26:54
there, but the way that we're really working on expanding, you
26:59
know we can already federate to any application up there.
27:02
So that piece is done. We can have folks federate into
27:05
us. So we have you know folks like
27:07
Duo and Okta and Ping have always been able to federate
27:11
into the platform and then the the interesting piece right now
27:17
where we're heavily expanding is in the multi cloud area, right.
27:21
So we can now govern GCP right or Google cloud resources,
27:27
Amazon resources and that sort of stuff.
27:29
So yes, we are. You know, we are moving in many
27:32
directions. Yeah.
27:34
So you're taking on the identity, governance and
27:37
administration. That is a big nut to crack.
27:42
Do you guys have a road map? Are you planning to kind of
27:47
build it with the existing tools?
27:48
I'm assuming you wouldn't be able to tell me even if you were
27:51
going out to acquire something, but I mean that's all a multi
27:55
year road map to get to kind of best of breed.
27:59
Yeah it is. It's definitely a multi year
28:01
road map. You know we what we're trying to
28:04
do is begin or center ourselves I guess is the right way to say
28:10
with things being built in and inherent.
28:13
So for example historically in governance there were concepts
28:20
of access certifications and access reviews and so we are
28:24
working more on the self-service side of the house.
28:27
We have a concept called access packages, which I think is
28:30
really a useful concept, not not just for Microsoft, but for
28:33
anyone, right? Which is groupings of resources
28:36
that people can self-service request so that we can then
28:39
manage and we can also do machine learning, anomaly
28:43
detection on right. So you know, the way that we
28:47
think this is going to work is, is to be able to, to keep that
28:50
governance centralized, be able to tell what's happening no
28:56
matter how far out your governance world goes, but do it
29:01
with simple concepts. So you know, we aren't to my
29:05
knowledge. Am I going to get fired for
29:06
saying this? Maybe.
29:07
I don't think so, you know. I'll.
29:10
Beat this out. If we need to delete this, no,
29:13
you know, to my knowledge, it isn't our plan to go and make
29:17
sure we're doing role mining in every single part.
29:19
We have partners who are really good at that and we love our
29:23
partners. And so, yeah, what we're trying
29:25
to do is make sure that there is an intuitive way for people to
29:29
perform anomaly detection, which is really what governance is.
29:32
We never talk about it that way and we talk about governance as
29:35
it's as if it's this sort of salty outside thing, right, like
29:42
reports and and all that. But it's not, It's anomaly
29:45
detection, it's finding risk in your organization.
29:48
And so, you know, we think that there's just a ton to do there
29:53
that is maybe great value. I love what you said there about
29:58
we love our partners, the idea that be a platform people.
30:03
Companies can build solutions that plug in.
30:06
To me, that's the fastest way to provide a solution and to expand
30:11
the platform, you know, said Octane 2 weeks ago.
30:16
They're talking a lot about the road map for Workforce Identity
30:20
Cloud and it's just a very big road map.
30:26
And can it be achieved by developing it themselves?
30:29
I think so, since they get a lot of R&D dollars though and.
30:33
You know, I think it was kind of platform focus and people could
30:37
build the solutions. The customer still gets what
30:40
they need, right? And the nice thing is then you
30:43
can build things that are specific to your verticals,
30:45
specific to your needs, right. If if your success is dependent
30:50
on us adding a bespoke feature, that's not a good way to go,
30:54
right? This just isn't how a platform
30:56
generally works. And so yes, I mean our partner
30:59
ecosystem is how we managed to, to have everyone get what they
31:04
need without that, without the massive backlog of, you know,
31:08
tiny features for this or for that.
31:10
Yeah. For this industry or for that
31:12
industry, I mean when you start breaking down what an IGA can do
31:16
and for each different industry, it can be enormous now.
31:20
You and I were talking about this, I think a few episodes ago
31:23
where we would start if we were going to build an IM product.
31:26
I think we settled on IGA. Is like that's where we would
31:29
start, because it feels like that's the hardest thing to do
31:32
because we already have standards for authentication.
31:35
We already have, you know, ideas around how to do authorizations
31:38
and things like that. But IGA is just this big hairy
31:42
beast. Yeah, and I honestly feel like
31:46
I'm not trying to dictate what your road map should be, but
31:49
it's just please. Tell Microsoft what they should
31:51
be doing here's. What Microsoft should do now, I
31:55
think the. Identity administration, like
31:57
the request approve workflow, it's like, you know, there's so
32:02
much already there in traditional Azure AD that does
32:08
what people need. But the ability to kind of like
32:10
go through and either self-service request or manage
32:13
your request access, to me that's one of the areas that
32:18
people want the most. Yeah, I completely agree.
32:20
I I mean, I think this is where the machine learning comes in of
32:26
trying to understand what people are trying to do and give them
32:30
whatever ceremony they need to be successful, right, And
32:34
understand it in advance. I think that's, you know, one of
32:37
the ways that this industry is going to innovate in the next
32:41
three years. I would say though to me the
32:44
most difficult thing for our for the industry's future right now
32:47
is actually ITDR, the identity threat detection and response
32:53
because you have to have signal, you have to signal to operate on
32:57
and there is and that that signal can be extremely low
33:01
level signal right have. A ton of data to work with.
33:05
We have so much, but we we do and and we're working very hard
33:10
on leveraging it. I mean, you know, the number
33:11
that I think we're giving is 65 trillion signals or something
33:17
insane like that. That's it, That's it.
33:19
But a trillion? I don't even know what comes
33:22
after a trillion. Do you know quadrillion?
33:25
I guess a quadrillion. I'll just ask Bing with ChatGPT
33:29
or Open AI integration, right. How's that for a plug or?
33:32
Bing, right? Who is intra for?
33:38
And more importantly, that sets me up for my follow up question
33:41
is who is Intra not for? That's a really good question.
33:45
Also possibly a question that could get me fired, but I'm
33:47
going to go for it. What the heck.
33:49
So I think Intra Intra has a really interesting dual role in
33:55
my opinion, right. The great thing about Intra is
33:59
that you can stand it up with almost nothing else.
34:04
If you're a small company, you can stand up Intra that you know
34:08
there's a free tier that you can stand up that is going to get
34:11
you single sign on. It's going to get you managing
34:13
your users. And so, you know, so I think
34:16
that if you're someone who's willing to embrace that idea,
34:22
who wants some of this rigor, you can have that rigor even if
34:25
you're a tiny customer. And of course if you want
34:28
premium features, you still have to pay for premium features,
34:31
right. However, what you don't have to
34:34
be as a big customer because it's a platform and everything
34:38
is generally self-service. So and there's a lot of
34:41
community and you can go in and learn what's going on.
34:44
So there's I think the accessibility for a smaller
34:47
company is great. I do think that the there's a
34:52
lot of complexity to running any large scale identity management
34:58
enterprise. I mean I think you both know
35:00
you're both living that every single day.
35:02
It's difficult for anyone to understand how to deploy access
35:08
packages and access certifications and all of these
35:11
incredibly complex concepts. However, what Entra is very,
35:18
very good at is the top end, right.
35:21
We work a lot with large multinational companies.
35:26
We work a lot with companies who need to integrate their identity
35:31
world with their security world and that's you know that's
35:34
another place where intra can be extremely valuable.
35:37
But generally speaking you know we we are we suit those
35:43
professional you know cases if you if you have a see so and you
35:47
have a an identity management dedicated team then intro's a
35:51
really good option for. You so in my day job I and the
35:59
Identity strategies, but to stay sharp, one of the things I do is
36:02
I get heavily involved in a lot of our projects.
36:05
I got involved with AB to C Azure AD implementation over the
36:11
past year. Plus, the product's really good.
36:15
One thing, notice when Intra basically said OK, we're not
36:19
calling you Azure AD anymore, but the subtext to it was B to C
36:27
is not affected by this. So still B to C Azure AD or
36:31
Azure ADB to CI think is more rightly, but why is that?
36:36
Why didn't you just roll that in as well?
36:38
We so B to C is considered a legacy product at this time
36:43
because we actually have a new rolled out product in preview
36:48
called Intra external ID. So you know we are still
36:53
supporting B to C obviously we're still working a ton with
36:56
customers on it, but intra external ID will is our sort of
37:00
future direction in that case and it's you know they obviously
37:04
do much of the same thing, but we have changed some of our
37:08
fundamental architecture that we think is going to really benefit
37:13
people moving forward. One of the things, one of the, I
37:16
don't know if you would call it a feature because I think it's
37:17
core to the product is the Graph API and building that on top of
37:22
that. Building B to C on top of the
37:24
Graph API just opened it up to it can do whatever you want.
37:29
I thought that was really cool. I wanted to call that out.
37:32
Yeah, it's interesting that I mean what it's really good for
37:35
both entry ID, external ID and and B to C are amazing because
37:39
everything is programmatic. So you, you know you don't have
37:43
to be in heavily working with any UI if you don't want to.
37:47
You can automate everything because a lot of our largest
37:49
customers, they're not touching this thing with a 10 foot pole,
37:54
right. Without like there isn't,
37:56
there's no chance for typos. They have this thing regimented.
38:00
They do roll outs and you know and change management windows
38:03
and so you know so the automation piece is a huge value
38:06
for our customers and that you know that's that's a size thing
38:10
at some point, right. How how much of A machine is
38:14
your retail website? That kind of thing.
38:17
Can we talk a little bit about AI?
38:19
Because I feel like Microsoft has made a lot of investment
38:23
obviously from AAI perspective with Open AI.
38:27
I've been a big fan of it for a while now.
38:29
I think it's captured the minds and maybe the hearts of a lot of
38:33
people. Bing was very much early on in
38:37
adopting that. I don't want to get into like
38:39
product, but I'm just curious where do you see AI fitting into
38:44
what you do from an identity perspective for Microsoft,
38:48
right. Yeah, it's really exciting.
38:50
It's very exciting. I'm not the authority, so you
38:55
know, I what I say I believe is true.
38:57
Others may disagree, but where we're really excited in identity
39:02
about AI is that, you know, we've had machine learning for a
39:06
long time, I don't know, maybe as long as 10 years, something
39:10
like that. Where we're going in, we're
39:12
doing the trend analysis, we're doing the the detection of
39:15
anomalies. All of that stuff has been
39:17
around for a long time. Where the generative AI comes in
39:22
is being able in some sense to put a face on it.
39:25
So you know, sense making is a huge problem in the industry
39:29
right now. We're churning out the the
39:31
signals, we're churning out the data, but it doesn't help if we
39:34
can't make sense of it. And that's really where the Gen.
39:37
AI piece that you know that that you know we have generally
39:40
branded as Co pilot becomes really interesting because now
39:44
we can take all of that amazing trend analysis and use
39:49
interactive conversation and interactive questioning to help
39:53
people make use of it. So that's you know that's for me
39:57
at least that's the really exciting piece and of course Co
40:00
pilot is a very intentional branding decision not.
40:05
Not for selling stuff, but because it is not meant to
40:09
replace people. It is meant to help people.
40:11
And so it's really all about people working with the AI to
40:16
learn and to grow and to leverage rather than, you know,
40:19
the machine taking over. I do think that that is a rather
40:23
brilliant branding of Co pilot. Did your definition of AI
40:30
changed? Change when you saw what large
40:33
language models and generative? Could do or have you like yeah,
40:37
that's just sort of the next. Yeah, for me it was a
40:39
revelation. I had no idea like I I am
40:42
absolutely the person who would say AIML as if it was one, right
40:48
AIML. This, you're not alone.
40:49
I think everybody was doing it. I was doing that, right?
40:53
And then I saw the demo from Open AI and I was like, what?
40:58
Right? Like that is going to change
41:00
things. And I think even Microsoft has
41:01
jumped into having, you know. Organizations be able to run
41:05
their own large language models in their own tenant so that
41:10
their data is not getting somewhere else, which I think is
41:12
brilliant because I do see this battle for dominance over who
41:17
has the best model and I don't think it's going to be A1 size
41:22
fits all. I think you'll have a general
41:24
model that is sort of like this, interfaced everything, and then
41:28
some sort of segregation of company data running within
41:32
another model. So I absolutely see the value
41:35
there. That's not the final level of
41:37
security then having a classification model that you
41:41
then enforce to say this data can't show up in Jeff's.
41:46
Yeah, I question. Yeah.
41:48
And his copilot, right. He doesn't need to know the
41:50
secret HR data. Yeah, and obviously identity
41:53
controls are going to be needed to separate what bits and which
41:58
model I can. Manipulator.
42:01
See. Yes.
42:02
Well, the other big investment we've been making for a very
42:04
long time is responsible AI. So it's not just a matter of,
42:09
you know, creating the robot robots and letting them March on
42:11
the village, right. We have for a very long time
42:14
been looking at where the guard guardrails need to be so that
42:18
this technology can be safely deployed.
42:21
And you know, oversight, you have to have oversight.
42:25
So all of those things have to work together before the
42:28
business tool becomes the accelerator we know it can be.
42:31
How often do you use AI? Well you know The funny thing is
42:35
I took a photography course a couple of weeks ago and so not
42:41
tech, not geeky anything and the instructor just on a whim opened
42:47
up Adobe Photoshop, highlighted a a circle on a top of building
42:51
and said remove the crane like that.
42:55
Yeah, Firefly and Sensei are pretty amazing.
42:58
Yeah. I mean that's I think that in
43:01
daily life that is that kind of value is going to change how
43:06
people use it. I certainly use it at work a
43:11
little bit and I think that will grow quite a bit.
43:15
Yeah, I think it's still, I mean, I use it quite a bit for a
43:17
variety of things every kind of everywhere, right.
43:19
It's a good starting point if you're starting something.
43:22
It still will hallucinate which is a friendly term for straight
43:25
up lie of information you know that comes through.
43:28
So I still think that there is you still need to know your
43:31
subject. I don't know if I would trust it
43:34
to really go down the path of learning something.
43:38
It's probably good to a certain degree and then it starts kind
43:41
of going off the rails. I'm sure that'll get better
43:42
overtime kind of figure that out.
43:44
But I use it for a variety of things.
43:45
I use it for work. I use it for this podcast that
43:48
helps with things like show notes and.
43:52
Audio editing and there's just so many different things that
43:55
it's gonna be interesting to see how this is gonna roll through
43:58
the next five years. I think it's gonna be crazy.
44:00
I mean, we have enough audio at this point where, you know, I've
44:03
toyed with making an episode with Jim and I using nothing,
44:07
just a script. I have enough audio to train,
44:10
you know, a voice to sound and all of our.
44:13
Subscribers start unsubscribing. Right.
44:16
But I think this is something you're gonna see is this.
44:18
It's almost like. You know, you see a lot of, like
44:21
articles that were like, it was generated by AI and they're of
44:25
varying quality. And big news organizations have
44:29
started to adopt this where they say, OK, well, we can't possibly
44:32
cover every high school sports game in the world.
44:34
So they have AI write some little blurb about some data
44:37
that was fed to it by something. I think you're going to see that
44:41
with video, with audio, where it's like, oh, I have this idea
44:45
for a thing, you know, create a YouTube video that talks about
44:48
this. And next thing you know you're
44:52
watching this thing, it's interesting I'm I'm on the
44:56
program committee for a couple of the different identity
44:58
conferences and at least right now and it may not last very
45:04
long, there are certain percentage of the abstracts that
45:09
might be wrong. I mean, I might be, it might be
45:11
that the that I'm only identifying a fraction of the
45:15
like, some of them might be so well written that I can't even
45:18
tell. And if so, more power to
45:21
everyone, right? But yeah, it's it's into a
45:24
certain thing where you get an abstract that talks about things
45:27
and uses all the right terms, but they're not actually related
45:31
to each other in a way that would make sense to a rational
45:34
human being. I like the keyword rational
45:37
human being. You spent a lot of time with us
45:40
here. We definitely appreciate it.
45:41
We hope you'll come back, but we want to end on a lighter note.
45:44
We kind of talked about some different ideas before we hit
45:46
record. You mentioned that you're in the
45:48
process of renovating A Victorian home, and it sounds
45:53
like you've been doing that for a while and maybe we'll be doing
45:56
that for a while. What is the thing that you
46:02
discovered that you just weren't prepared for when you started
46:06
this journey? Well, so yes, we have.
46:10
A San Francisco Victorian home was built in 1891, if I remember
46:17
correctly. 1891, yeah. And so I think the thing that
46:22
surprised me the most, which kind of tells what kind of IQ I
46:26
have, but I all of the trim in the house is Redwood first
46:30
growth Redwood. They were mowing down the
46:32
Redwood trees and to build these homes back then.
46:36
And I, it was my job to strip all the paint off of the trim.
46:42
And I had the worst time because they were, you know, it's a lot
46:46
of paint that you can apply to this stuff and it's all
46:48
different chemical makeups and all that kind of stuff.
46:50
And so I started with the Eco friendly paint, trim paint
46:55
dissolver. That did not work.
46:57
And I tried every single thing. And finally I figured out the
46:59
heat gun was the way to go. And so I spent two years, not
47:04
even kidding, two years stripping off.
47:06
Not once did I think that maybe there could be lead in that
47:10
paint. Not once until my husband's
47:15
daughter showed up one day and she said, you know, should you
47:19
check? And, and we were almost done.
47:22
I mean, I had been breathing those fumes for, for two years
47:25
at that time. And then we freaked out.
47:28
We freaked out. We didn't touch it for four
47:30
months. We went in with hazmat suits to
47:33
finish the last pieces of it. So yeah, not my finest moment.
47:38
So there's a chance that you may actually glow in the dark.
47:40
It's possible. It is possible.
47:42
We did test it after the fact and there wasn't very much.
47:44
Left Well, one of the greatest things when you do an older
47:47
house. So my mother bought an older
47:49
house when I was a young teenager.
47:52
And you peel back the carpet like this Harvard floors there.
47:56
You're like, who put a carpet who for this.
47:59
But you just feel like you just discovered found gold.
48:03
Yeah, it's such a wonderful feeling.
48:05
We preserved as much as we could and we tried to stick with the
48:10
same feel, but now we're we've finished the inside and now
48:13
we're trying to do the outside and that involves recreating
48:16
corbels and recreating trim and it's really nerve wracking
48:20
because we don't know if we're going to do it justice.
48:24
Or not now Pam, I didn't know you were a Calgary native and I
48:30
was in Calgary last weekend and went to Bam for the weekend and.
48:36
One of the greatest places I've ever been.
48:39
But you know you must have some fond memories.
48:43
So what is your fondest Banff memory?
48:46
Oh gosh, yeah, I I misspent my youth in Banff.
48:50
I'm not sure it's my fondest memory, but one of my strongest
48:53
memories is actually probably the trip I had where I we were
48:58
mountain climbing, climbing a mountain called Mount Yamnuska.
49:01
I don't know if you saw that. It's on the way in, on the way
49:04
to Banff and I fell off and I broke my ankle in two places,
49:10
broke the tibia and wait tibia and yeah, something like that.
49:17
Anyways, I got helicoptered off the mountain and so I have this
49:20
huge memory that the helicopter couldn't land and you know we
49:25
had climbers came from all over the mountain.
49:27
It's an amazing thing that that whole community because was way
49:33
back, it's 1996, it was a long time ago and so there weren't
49:36
just cell phones you could call on.
49:37
And so and we didn't have cell service up on the mountain.
49:40
And so probably 20 different climbers gave up their climbs
49:44
that day because they ran a relay down the mountain.
49:49
So the people at the top turned around.
49:52
They were just coming to the top.
49:53
They turned around, they ran down till they met.
49:54
The next climbers said somebody's in trouble getting
49:57
ambulance and then those people turned around, they ran to the
50:00
next people and so they did this crazy relay down just to be able
50:04
to call the air ambulance to pick me up.
50:07
And then they couldn't land the the helicopter on the apron.
50:11
So they attached me to a stretcher that was hanging below
50:16
the helicopter. And on a beautiful, beautiful
50:19
day I got flown over the valley and that was great.
50:24
I, you know, I was a little preoccupied at the time, but my
50:27
climbing partner, they had to, you know, they sort of sent me
50:31
in a stretcher with one attendant, and there was another
50:34
attendant there. And so they actually let my
50:37
climbing partner clip his harness into the rope.
50:41
And so he flew over the valley suspended on his climbing
50:46
hardness, just underneath the helicopter.
50:49
And so he got to the hospital and I'm groggy and I'm in pain
50:52
and all of this, and he gets to the to the bedside.
50:55
He's like, damn, I'm so sorry this happened to me or to you,
50:58
but that was the best experience of my whole life.
51:01
His fondest memory? Not yours, exactly.
51:04
I was going to say like, people probably had Banff on their
51:07
bucket list. You just gave you that.
51:10
That is your fondest story. And they're just like there's so
51:14
much more. I mean Emerald Lake for example.
51:15
If you go a little bit farther past, Banff is something you'll
51:18
never forget if. You go Lake Louise, Lake Louise.
51:21
We got all the way up there and the parking lot was full.
51:25
But my funny story was we were going through the town, there's
51:28
a place that sold bear spray 1295, and we just thought, get
51:34
that. And we told we I was there with
51:38
my girlfriend Denise, and we started to say, yeah, if we get
51:41
killed by a bear, the story will go.
51:43
They're too cheap to buy 1295 worth of bear spray.
51:47
They kind of had a cup, right? Yeah, we did have definitely had
51:51
some bear encounters, but generally speaking, if you leave
51:54
them alone, they usually leave you alone.
51:56
We're. Talking about brown bears or
51:57
black bears, Oh yeah, very different.
51:59
So brown bear you can scare away unless it's really, really,
52:02
really, really hungry. And so if if a brown bear starts
52:05
to follow you, it probably wants to eat you.
52:08
So there's it is really important to know the
52:10
difference. Whereas a grizzly bear will
52:12
charge you if it feels threatened and you can play
52:14
dead, but if a brown bear charges you it, you know, if you
52:19
play dead, you're kind of just offering yourself a business.
52:22
Yeah, I saw Revenant. That didn't work.
52:25
Pam, you've been really just of your time and I'm really glad
52:27
we're able to get this conversation in long time coming
52:30
long overdue. I hope you'll come back.
52:34
Any final thoughts before we wrap up?
52:36
No, only that I'm really glad you exist in this industry.
52:40
It matters a lot. Thank you.
52:41
I'm happy I exist too, and I'm sure Jim is too.
52:45
We'll go and leave it there for this week.
52:47
You can find us on the web at idacpodcast.com.
52:50
We're on Twitter or X or whatever at IDAC Podcast.
52:54
We're on Mastodon at IDAC Podcast, at infosec dot
52:58
exchange. We'll have links in our show
53:00
notes. You can connect with Pam
53:03
ourselves, whoever you'd like, subscribe like thumbs up,
53:08
review, whatever it is. Yeah, that's that's all stuff
53:11
that helps us get great guests like Pam, and hopefully we get
53:16
more. So we'll leave it there.
53:18
Thanks everyone for listening and we'll talk with everyone in
53:20
the next. You've been listening to
53:22
Identity at the Center. We hope you've enjoyed the show.
53:27
Make sure to like, rate and review and we'll be back soon.
53:31
But in the meantime, hit the website at
53:33
identity@thecenter.com and find us on Twitter at IDAC Podcast.
53:41
See you next time on identity at the center.