Enterprise IAM Lab: Hybrid Identity for a Regulated Bank
On-prem Active Directory with a tiered admin model, federated to Okta Workforce Identity and Microsoft Entra ID over SAML, OIDC and SWA, with network-aware conditional access and graduated MFA. Built to the regulatory drivers a real bank would have to satisfy.
The scenario
Biira Bank is a fictional state-chartered commercial bank: FDIC-insured, SEC-reporting, with the regulatory obligations that implies. Its identity architecture is not designed to a checklist of features but to the drivers a real bank would be examined against: GLBA safeguards, SOX separation of duties, PCI-DSS unique IDs and MFA for administrators, and the FFIEC’s 2021 authentication guidance on risk-based access. Every phase of the build names the regulation it answers.
The identity estate runs on the network documented in the sibling Enterprise Security Homelab; this project is the workload on top of it.
Architecture
Active Directory (ad.biira.online, on DC01, Windows Server 2025, VLAN 50) is the source of record for employee identity. Okta Workforce Identity is the primary identity provider that applications federate to, reached through the Okta AD Agent over outbound HTTPS only, so nothing on the internet can initiate a connection to the domain controller. Microsoft Entra ID is the second cloud directory, planned for hybrid synchronisation and Microsoft 365 in Phase 6.
Authentication is evaluated in two layers. First the request is classified by network zone: an IP zone for the corporate network, a dynamic geographic zone for allowed countries, and a threat zone that recognises Tor exit nodes. Then the authentication policies apply in priority order, and the first match decides the assurance required:
- Restricted countries: deny.
- Public network: hardware-protected MFA.
- Corporate network: standard MFA.
What is built
- Directory structure for a bank. Twenty organisational units, 27 employee accounts across six departments, 15 security groups, and a Microsoft-style tiered admin model (Tier 0 / 1 / 2) with seven hardened administrative accounts and the built-in Administrator disabled.
- AD to Okta synchronisation with attribute mapping, OU-scoped user and group sync, a dedicated service account, and administrative accounts deliberately excluded from the cloud directory.
- Application federation across protocol families. Dropbox Business over SAML 2.0 with automated provisioning and attribute mapping; Box over SWA with password vaulting; group-based assignment so access follows role, not individuals.
- Dynamic groups with Okta Expression Language, driven by the AD country attribute, so a change in the directory changes application access without a ticket.
- Network-based conditional access (Phase 5.1): three zones, three policy rules, tested with pilot users from both sides of the corporate boundary, with the flows recorded on video.
- Regulatory traceability. Each phase guide names the driver it satisfies, from FFIEC IT examination requirements in Phase 1 to BSA/AML geographic controls in Phase 5.
Decisions worth explaining
Okta is primary, not Entra. A bank of this profile typically federates to a best-of-breed IdP and keeps Microsoft as one of several relying parties. Making Okta primary also forces the harder integration work (agent, attribute mapping, protocol variety) rather than the path of least resistance.
Admin accounts do not sync to the cloud. Tier 0 identity stays on the domain. If the cloud IdP is compromised, the blast radius stops short of the directory that everything else depends on.
Where you are changes what you must prove. Graduated MFA by network zone is more honest than a blanket policy: it pushes hardware-backed factors to the risky context (public networks) without punishing every corporate login, and it makes a deny-by-geography rule a first-class control rather than an afterthought.
What is next
- Phase 5.2 to 5.5: adaptive, risk-based MFA; device trust and posture; privileged access management; behavioural analytics.
- Phase 6: Entra ID hybrid synchronisation, seamless SSO and Microsoft 365, with federation decisions between Okta and Entra documented as a decision record.
- Grow the endpoint estate on the homelab side so the identity policies have realistic workstations to protect.
What it looks like when it is actually configured.
Screenshots from the build, named and captioned so each one can be traced to the configuration it proves.
