Identity and access management at small scale is straightforward: pick an identity provider, federate to the apps, done. At enterprise scale across two or more cloud providers, IAM becomes the most operationally expensive component of the security stack. Most teams underestimate this until the audit findings start piling up.
What "at scale" actually means
The scale problem in IAM is not user count. Five thousand users with simple SSO is manageable. Five hundred users across three cloud accounts, two SaaS-with-API-keys vendors, and a legacy on-prem app with local accounts is the actual problem.
Scale shows up in three dimensions: the number of identity sources you have to reconcile, the number of policy engines you have to maintain consistency across, and the number of audit trails you have to correlate to answer a single question like "who has access to customer PII as of right now?"
The federation pattern that works
Anchor the architecture on one identity source of truth. For most organizations in 2026, that means Microsoft Entra ID, Okta Workforce Identity, or Google Workspace as the central IdP. Choose one. The cost of running two IdPs in parallel is higher than the cost of migrating to one.
From the central IdP, federate outward using SAML 2.0 or OIDC for everything that supports it. For AWS, this means IAM Identity Center connected to your IdP, federating into accounts via permission sets. For Azure, this means Entra ID as the directory tenant. For Google Cloud, this means Workforce Identity Federation. SCIM provisioning runs the other direction so user lifecycle stays consistent.
For SaaS that does not support SAML or OIDC (still common), wrap it behind a privileged access management tool or an identity-aware proxy. Never let credentials for those apps sit in user-managed password vaults; they leak.
Policy boundaries that survive audit
The audit-trail problem at scale is solved by the policy boundary, not by the policy itself. A policy boundary is the set of permissions that nothing inside a context can exceed, regardless of attached policies.
In AWS, this means permissions boundaries on every developer-creatable role, Service Control Policies at the Organization level for the strongest constraints, and resource-based policies on sensitive resources. In Azure, this means Conditional Access policies as the outer layer and RBAC as the inner layer, with Privileged Identity Management for just-in-time elevation. In Google Cloud, this means IAM Conditions and Organization Policies as the boundary.
The pattern: a policy boundary defines what is theoretically allowed, an attached policy defines what is currently allowed, and the actual permission is the intersection. Auditors care about the boundary because that is the maximum exposure; engineers care about the attached policy because that is what they actually have. Both reads need to be cheap.
The audit trail that answers real questions
Centralize all identity events in one place. CloudTrail, Azure Monitor activity logs, Google Cloud audit logs, IdP sign-in logs, SaaS audit feeds. The destination is less important than the consolidation; pick a SIEM, a data lake, or a security analytics platform and put everything there.
Practice answering three questions on cohort day 3 and you will be ready for the CAS-005 exam and for an actual audit: who has access to this resource right now, who accessed this resource in the last 90 days, and what would happen if this identity were compromised.
What CAS-005 tests on IAM
The exam tests judgment about IAM design across all four domains. Governance asks about audit obligations and identity lifecycle. Architecture asks about federation patterns. Engineering asks about policy implementation. Operations asks about detecting and responding to identity-based threats. Multi-cloud scenarios appear directly in question stems.
The bootcamp Day 3 includes a hands-on lab where you federate three cloud accounts to a single IdP and configure cross-account access with permission boundaries. That single lab covers the IAM material that appears on roughly 12 to 15 percent of recent CAS-005 question pools.
Leave a Reply