Identity Change Management Lab

A browser-based training lab where you act as change manager for a fictional freight company. Over three identity changes you classify the change, assess risk, choose approvers, plan testing, rollback, the window, communications and verification, and then see a seeded outcome of what happened. It trains judgement about process weight, not product configuration.

Because a conditional access policy that requires a security key will lock out any admin who has not enrolled one, and any script that signs in as an admin. Report-only mode lists who would fail without affecting anyone, so enrolment and automation can be fixed first. A tested break-glass sign-in and a one-step disable are the way back.

In ITIL change enablement terms, a standard change is pre-authorised, low risk and follows a documented procedure. A rotation with two custodians, a test sign-in before the old credential is retired, and a heads-up to the SOC fits that. The process weight goes into following the template exactly, not into a board vote.

An emergency is for active or imminent harm that cannot wait for the normal path. A certificate expiry is certain and, in this case, still thirteen days away, so there is time for partner notice, a staging test and an overlap period. A requester who discovers a date late is a scheduling problem. Calling it an emergency is a penalised mistake.

Publishing the new certificate beside the old one gives an overlap period. Applications that read metadata pick up the new one, pinned applications can be updated at their own pace, and you can switch back until the overlap ends. Removing the old certificate first leaves no way back.

When a change can affect many services or people, one signature cannot cover the technical owner, the owners of the affected services and the partner relationship. Any change with a large blast radius needs at least two approvers, and the right ones.

Each change hides a few risks, such as unenrolled admins, pinned fingerprints or a mistyped envelope. The seed fixes the dice. Choosing tests, approvals, windows and rollbacks that address a risk makes it much less likely to fire, and a good rollback or verification limits the damage if it does. The same seed, level and plan give the same outcome.

Rookie shows a hint at each step and a "watch for" list of hidden dependencies and has the lowest chance that an unmitigated risk fires. Pro hides the hints, but a good test plan reveals a hidden dependency as you choose it. Elite hides everything until the outcome and raises the chance that an unmitigated risk fires.

A Markdown change record per change and a CSV register of all three; downloading documents is Pro, and the same records can be read on the debrief page. The terms follow ITIL change enablement, and the controls echo NIST SP 800-53 CM-3, CM-4 and CM-5, ISO/IEC 27001 Annex A 8.32 and CIS Controls. It is a training exercise, not a compliance checklist.

No. Aldermoor Freight, its people and the aldermoor.example domain are invented, and every outcome is simulated in your browser. Nothing here connects to a real identity provider or directory.