Marcus L.
Sample Non human identities section is valuable
We found dozens of long lived API keys after the inventory exercise. Now replacing them with workload identity.
Identity and access management: MFA, SSO and passkeys
Protect accounts and access across an organisation with single sign on, phishing resistant MFA, passkeys, conditional access and clean lifecycles
Created by Levan Kapanadze
- Updated September 2026
- English
- Intermediate
What you will learn
- Explain authentication and authorisation concepts and common protocols
- Configure single sign on with OIDC and SAML in a lab identity provider
- Choose MFA methods by risk and plan a passkey rollout
- Design conditional access policies that balance security and usability
- Automate account lifecycles and run access reviews
- Protect privileged accounts and respond to session hijacking
Course content
Identity foundations
Conditional access and device trust
- Video: Designing conditional access policies 11 min
- Video: Device health and managed devices 10 min
- Article: Risk based sign in and impossible travel 9 min
- Video: Session lifetime and continuous evaluation 9 min
Lifecycle and access governance
- Video: Joiners, movers and leavers 10 min
- Article: Automated provisioning with SCIM 11 min
- Video: Role and group design 9 min
- Video: Access reviews that people actually complete 9 min
Privileged and non human identities
- Article: Separate admin accounts and just in time access 10 min
- Video: Service accounts and workload identity 10 min
- Video: Secrets management basics 9 min
- Article: OAuth consent and third party app risk 9 min
Identity for application developers
- Video: Adding SSO to your own application 11 min
- Video: Supporting passkeys with WebAuthn 10 min
- Article: Authorisation inside the application 9 min
Detection and response
- Video: Identity logs worth watching 10 min
- Video: Adversary in the middle phishing and token theft 11 min
- Article: Responding to a compromised account 10 min
- Video: An identity roadmap for your organisation 8 min
- Quiz: Final check 6 min
Requirements
- Basic IT administration or development experience
- Comfort with web concepts such as URLs, cookies and redirects
- Docker installed to run the Keycloak lab
Description
Identity is the new perimeter. When employees work from anywhere and applications live in the cloud, the question "who is this, and should they have access?" decides most security outcomes. Attackers know it: stolen credentials, phished MFA codes and hijacked sessions are behind a large share of modern breaches.
What you will learn
- The difference between identification, authentication and authorisation
- Single sign on with SAML and OpenID Connect, explained without the jargon
- MFA methods compared, and why phishing resistant methods matter
- Passkeys and WebAuthn: how they work and how to roll them out
- Conditional access based on device, location and risk
- Joiner, mover and leaver processes with SCIM provisioning
- Privileged access, service accounts and secrets
- Session and token theft, and how to detect and respond to it
Who this course is for
IT administrators, security engineers and developers who integrate login into applications. Examples use common identity providers such as Microsoft Entra ID, Okta and Google Workspace in general terms, and the open source Keycloak for hands on labs, so you can practise without a paid tenant.
You will finish with a practical identity roadmap for an organisation of any size, ordered by impact.
Who this course is for
- IT and identity administrators
- Security engineers building an identity programme
- Developers adding SSO and MFA to applications
Instructor
Levan Kapanadze
Security engineer teaching security fundamentals, identity and network defence in plain language
- 4.3 instructor rating
- 21 reviews
- 7,370 students
- 3 courses
- Sample
I work on security for engineering organisations: access control, network design reviews, incident response and a lot of patient explaining. I believe most security problems are solved by clear habits rather than expensive tools.
My courses are for developers, IT staff and curious beginners who want to understand how attacks really happen and which controls actually reduce risk. We cover passwords and passkeys, MFA, least privilege, segmentation, logging and how to respond when something goes wrong.
I avoid fear based teaching. You will leave each course with a short list of concrete changes you can make at work or at home this week.
Student reviews
Helga S.
Sample Passkey rollout plan was exactly right
We followed the order from the course: admins with hardware keys, then a pilot, then everyone. Smooth so far.
Bongani M.
Sample Finally understand OIDC
Running Keycloak locally and reading a real ID token made the protocol click after years of confusion.
Rashid A.
Sample Clear on token theft
The explanation of adversary in the middle phishing was the clearest I have found. Practical detections too.
Lea F.
Sample Strong on conditional access
Report only mode advice saved us from locking out a whole department. Wanted more Entra specifics.
Joanna K.
Sample Good overview, vendor neutral
Accurate content. Being vendor neutral means you still need your IdP's docs for the exact clicks.
Keep exploring
All Security Fundamentals courses
More in Security Fundamentals
$39.99
Enroll now