Identity Team - Q2 Roadmap

Yeah, sorry, I was just finishing up a Slack thread with the Detect team about the post-mortem follow-ups.

Yep, recording is on. Okay so — Q2 roadmap planning for Identity. I'm really excited about this one honestly, I think we have a genuinely strong quarter ahead of us.

Same, and I feel like Q1 kind of lit the fire a little bit? Like, the Comply v2 launch last week showed what we can do when we're really coordinated, and I want that energy for Identity.

Totally agree with that. Comply v2 was a good moment for the org. And honestly, Identity has been in a bit of a holding pattern, so I think customers are ready to see some movement from us.

Yeah, I've been looking at the support ticket volume and there's a pretty clear cluster around SSO configuration — specifically around just-in-time provisioning. Like, that's coming up again and again.

Okay so — three big themes for Q2. First is JIT provisioning and SCIM improvements, second is adaptive MFA policies, and third is what I'm calling the Identity audit trail, which ties into the Comply integration story.

Oh, I love that the audit trail piece connects to Comply. That feels like a really natural cross-module story and honestly something we should be talking about in sales materials too.

A hundred percent, and that was actually a direct ask from — I think it was the Fortiguard Pro competitive deal we almost lost last quarter? The customer specifically said they wanted IAM events surfaced in their compliance reports.

Yeah I remember that one. That was painful. But it's good that it's shaping actual roadmap items rather than just becoming a post-deal retrospective that nobody reads.

Sure, yeah. So the current state is that JIT provisioning exists but it's kind of half-baked — you can provision users on first login but there's no good story around attribute mapping or role assignment from the IdP side. So what I'm proposing is we build out a proper attribute mapping UI, add support for group-based role assignment, and fix the SCIM endpoint inconsistencies that have been causing sync failures.

Yeah so there are basically three distinct failure modes. One is race conditions when you have concurrent provisioning requests, two is the SCIM patch operation not handling partial updates correctly, and three is just some gnarly edge cases around deprovisioning when a user is in multiple groups. None of them are insurmountable but they're all kind of annoying in their own way.

If Mike and I take it together I'd say four to five weeks? We'd want to do it properly with good test coverage because the last thing we need is a reliability issue on top of everything the Detect outage already stirred up in terms of customer trust.

Yeah that's a fair point. The March outage definitely put everyone a bit more on edge about stability. I think that's actually — it's a good forcing function for us to be really disciplined about testing this quarter.

Agreed. And I think the customers who were affected by Detect are going to be watching us closely, so any Identity work we ship needs to feel rock solid.

I have, yeah, and honestly it's — it's not terrible but it's also not great. The configuration screens feel like they were designed for an engineer rather than an IT admin, which is probably accurate. I've started sketching out a redesigned attribute mapping flow that uses a more visual drag-and-drop approach and gives you inline validation so you can see if your mappings are going to work before you save.

Right, exactly! And it generates a disproportionate number of support tickets because people just — they don't know what they did wrong. So if we can surface that feedback in the moment it should meaningfully reduce support load too.

Yeah so the vision here is moving away from static MFA rules — like, everyone in this role gets MFA — toward something that's context-aware. So you'd factor in things like login location, device posture, time of day, whether it's an unusual access pattern. And based on that you can either prompt for MFA, step up authentication, or in low-risk scenarios maybe let it through without friction.

Definitely first iteration. I'm thinking we start with location and device posture as the two signal inputs, build the policy engine to be extensible so we can add more signals later, and ship that as a beta in Q2. Full GA with more signals would be Q3.

Yeah and honestly from a competitive standpoint this is overdue. SentinelShield has had something like this for a while and we keep getting asked about it in enterprise deals.

Ugh, yeah. Every time SentinelShield comes up in a deal it's like — okay, what's their talking point this time. But I do think our implementation can be more tightly integrated with the rest of the platform, which is a real differentiator.

That's exactly the angle. Like, the fact that adaptive MFA signals can feed into the Identity audit trail and then surface in Comply reports — that's something SentinelShield can't do because they don't have the compliance layer.

Okay so then the audit trail — this is the one I'm most excited about personally. Can we talk through what the data model looks like? Because I want to make sure we're designing this in a way that Comply can actually consume it cleanly.

Yeah absolutely. So the idea is that every significant Identity event — login, logout, MFA challenge, provisioning change, role assignment, policy update — gets written to a structured event log with a consistent schema. And then we expose that via an internal API that Comply can query when it's generating reports.

And the Comply team is on board with this? Like, have you guys talked to them?

I had a quick chat with Priya on the Comply team last week, yeah. She was really enthusiastic about it. Apparently identity access events are one of the biggest gaps in what they can currently include in SOC 2 reports, so this would actually unlock a lot for their customers too.

Yeah I can do that by end of week. I'll also flag any dependencies I see on shared infrastructure so we can get those on the radar early.

Absolutely, I'll post the link in the Identity channel tomorrow morning. I'm really happy with where it's heading and I want everyone's eyes on it before I get too attached to any particular direction.