System for Cross-domain Identity Management

EMU supports SAML or OpenID Connect for authentication.

It also supports SCIM provisioning.

Besides EntryID, you can also use Okta or PingFederate.

And I usually go for emu when I'm setting this up for clients because this enforces that everything that happens in GitHub goes through EntryID and conditional access policies.

But how does AWS know who is in the Entra ID group if Entra is over in Azure?

Through an incredible protocol called SSCM, the system for cross-domain identity management.

I always think of SCM as an automated, highly aggressive HR department for the cloud.

That's a great way to view it.

Got it.

And then SKIM, which stands for System for Cross-Domain Identity Management, is what dynamically controls what that person is actually allowed to see.

Oh, I see.

So if an employee moves from the M&A team to a different department, Eskim instantly revokes their AI's access to all the M&A data folders.

It allows for really easy onboarding and offboarding.

So you can even use single sign-on and SAML or SCIM for automated user provisioning.

you can just essentially define who in your organization has access to cloud.

I mean, it's very much like a platform, right? You're adding people to have seats and then you're managing their usage, which is also really important because it gives you the ability to monitor that variable cost, that consumption, that usage across the entire team.

I think for smaller firms, some of the governance features are less salient to them, less important.

Do they care about SSO provisioning and SCIM license provisioning through an API endpoint? No.

Do they care about budgets and how much you're spending? Absolutely they do.

And so those functions are available in there.

To your point, yes, more and more people are moving to Workday and SuccessFactors and PeopleSoft or whatever, but If not, we do have an API interface as well.

But I've also noticed, Tarek, even with moving to Workday and cloud-based things, because of so much of work that's gone into the on-prem with the MIMs and all the workflows that have been stood up and all the different apps before SCIM, what they were doing, there's a lot of legacy and processes involved.

and ceremony on-prem.

So even though companies move to workday, they still bring the identity back on-prem and then sync it back to

Competition remains strong from Microsoft, CyberArk, Cisco, and other security platforms.

For founders, the takeaway is to make products enterprise-ready with SSO, MFA, SAML slash OIDC, SCIM, passkeys, granular permissions, and audit logs.

As AI agents gain access to sensitive systems, strong identity controls will become increasingly important for security and compliance.

Thank you for listening to Gray Journal Daily.

...

SCIM infrastructure and all the stuff that I've done?" I got, uh, one of my favorite questions asked to a, a, a very experienced Active Directory domain administrator is, "How many times have you gone and looked at how many GPOs are still out there?"

Yeah.

Like, how many GPOs are in AD e- because you haven't cleaned them up.