Capstone
Zero Trust IAM for 40,000 Identities
100% Conditional Access policy enforcement across the validation set, with zero failed policy evaluations.
- Zero Trust
- Microsoft Entra ID
- MFA
- Conditional Access
- NIST CSF 2.0
- ISO 27001
- PowerShell
Context
The capstone scoped a centralized Identity and Access Management solution for a university environment of 40,000+ students. The constraint was Zero Trust — never trust, continuously verify — rather than a perimeter model, with alignment to NIST CSF 2.0, ISO/IEC 27001:2022, and NIST SP 800-207.
Approach
Microsoft Entra ID was the identity plane. I deployed 25 simulated identities to exercise join, group, and privilege paths, then configured four Conditional Access policies that required MFA before access. A PowerShell bulk-provisioning template covered the path from the lab set to a full-scale rollout so the design was not stuck at a handful of test users.
Outcome
Every Conditional Access policy evaluated as expected across the test scenarios — 100% enforcement, zero failures. The published repository holds the architecture notes, policy intent, and provisioning template.
Scope and caveats
- Validation used simulated identities, not production student accounts.
- Findings are described as control categories and policy outcomes — no tenant identifiers or exploit detail.
- The work is a design-and-validate capstone, not an engagement report.