Aegis / Crestline Wealth - Identity Module Deployment

Likewise, honestly. I've been looking forward to this one. We've had Protect and Detect running for a while now and the team's been happy, so adding Identity feels like a natural next step.

+1Derek reports his team has been happy with Protect and Detect and sees Identity as a natural next step. · product capability

That's great to hear, and yeah, that's — that's kind of the pattern we see with a lot of our financial services customers. They start with backup and threat monitoring and then once Identity is on the roadmap it sort of becomes a priority real fast, especially given the regulatory environment you're dealing with.

Exactly, yeah. We had our annual audit in February and the auditors flagged some gaps around privileged access management and MFA coverage across our admin accounts specifically. So that sort of lit a fire under us to get this moving.

Yeah, absolutely. So Derek, before I get into the actual deployment steps, can you give me a quick picture of your current identity landscape? Like, what are you using today for SSO or directory services, if anything?

Sure, so we're running Azure AD — or I guess it's Entra ID now, still getting used to that name — for our primary directory. We've got about 340 users total, around 40 of those are in elevated or admin roles. MFA right now is a mix of, uh, Nextera Authenticator and some legacy SMS-based auth that we've been meaning to deprecate for a while but just haven't gotten around to it.

Okay, great. And the SMS-based stuff — is that mostly for a specific group of users or is it kind of scattered across different departments?

Honestly it's a bit scattered. I think it's probably 20, maybe 25 users, a lot of them are in our wealth advisory group. Some of the senior advisors have been resistant to changing their auth flow, if I'm being honest.

Ha, yeah, that's — that's a very common story. We hear that a lot. The good news is Aegis Identity has some tooling around phased MFA policy rollout that makes that transition a lot smoother. You can essentially grandfather users into a migration window rather than doing a hard cutover, which tends to reduce the, uh, the pushback significantly.

Oh that's actually really good to know. My manager was asking about that specifically — like whether we'd have to do a big bang cutover. I was not looking forward to that conversation with the advisory team.

+1Derek is relieved that a phased rollout avoids the big-bang cutover he feared. · onboarding and implementation

You can tell your manager that's a hard no on the big bang approach. We've got you.

Yeah, definitely. So, at a high level we're looking at three phases for a deployment like yours. Phase one is directory sync and SSO configuration — basically getting Aegis Identity talking to your Entra ID environment, setting up the SAML or OIDC connectors, depending on what your apps support. Phase two is MFA policy configuration and enrollment, which is where we'd handle that phased migration you mentioned. And then phase three is privileged access management, which sounds like it's actually going to be really important for you given what the auditors flagged.

So it's quite a bit more than just session recording, which I think you'll find pretty compelling. Aegis Identity gives you just-in-time access provisioning for admin roles, so instead of users having standing admin privileges 24/7, they request elevated access for a specific window, it gets approved through a workflow, and then it auto-expires. You still get full session recording and audit logs, but the just-in-time piece is really what closes that standing privilege gap that auditors love to flag.

Okay, that's — yeah, that's exactly what we need. That's honestly the thing that's going to make my auditors happiest. We've had a few instances where terminated employees still had admin access longer than they should have because the offboarding process wasn't fully automated, and that's a conversation I don't want to have again.

+1Derek says JIT PAM and automated offboarding are exactly what his team needs and will please auditors. · compliance reporting

The automated deprovisioning is actually one of the things our financial services customers consistently call out as like a — a real pain point solved. We can tie it directly into your HR system or your ticketing system so the moment an offboarding ticket is triggered, access is revoked automatically. No manual steps, full audit trail.

Ha, I love to hear it. So Derek, just while we're talking timelines — you mentioned the audit flagged some gaps. Do you have a target date in mind for when you want to have the Identity module fully deployed? Like, is there a next audit or a compliance checkpoint you're working toward?

Yeah, so our next internal compliance review is in August, and I'd really love to have everything buttoned up by end of July at the latest so we have time to generate some reports and actually show progress. Is that — is that a realistic window?

End of July is very doable. If we can get the kickoff scheduled within the next week or two, we're looking at roughly ten to twelve weeks of deployment work depending on how complex the app integrations get, and that puts us comfortably in the early July range for full deployment.

That's — yeah, that's better than I was expecting honestly. I had budgeted for like a four month process in my head.

+1Derek is pleasantly surprised that the timeline is better than the four months he budgeted. · onboarding and implementation

I mean, it can get longer if there are a lot of custom app integrations or if there's a lot of back and forth on MFA policy decisions, but for your environment as you've described it — 340 users, existing Entra ID foundation — we've got a really solid baseline to work from. Sofia's done probably a dozen of these in the financial services space at this point.

Ha, even better. Oh, one thing I did want to mention while I have you both — I saw the announcement about Aegis Comply v2 that went out earlier this month. We're not currently on the Comply module but the on-demand SOC 2 and the multi-framework reporting — that caught my eye. Is that something we could potentially layer in down the road?

Oh, absolutely. And honestly the timing is great because the Identity deployment is going to generate a ton of the underlying audit data that Comply v2 pulls into those reports. Like, all of the access logs, the privileged session records, the MFA enrollment status — that all feeds directly into the compliance reporting engine. So by the time you're ready to look at Comply, you'll already have months of clean data to work with.

Oh that's a really good point, I hadn't thought about it that way. So it's not like starting from scratch with Comply, we'd already have a head start.

+1Derek appreciates that Comply will have a head start because Identity generates the underlying audit data. · compliance reporting

Exactly. And just so you know, Comply v2 has SOC 2, PCI DSS, HIPAA, and ISO 27001 all supported now as of the April launch. I know financial services customers often need to juggle multiple frameworks, so having all of that in one place on demand — no more waiting for quarterly report runs — it's pretty compelling.

Yeah, I'm going to bring that up with our Chief Compliance Officer. She's been asking about the SOC 2 reporting specifically. But let's — let's get Identity locked in first and then circle back on Comply. One thing at a time.

Totally, that's the right approach. Okay so in terms of next steps — I'm going to send over a deployment plan document after this call that Sofia will put together, it'll have the three phases laid out with rough timelines, the integration checklist for the Entra ID connector and ServiceNow, and what we'll need from your side to get started. Does that work?

Yeah, that's perfect. If you can also include the MFA migration framework stuff Sofia mentioned — the phased rollout approach — that would be great because I'm going to want to share that with my manager before the kickoff.

I'll include a section on that specifically, and I'll flag the just-in-time PAM stuff too since that sounds like it'll be an important talking point for your audit preparation.

Awesome. This has been — yeah, this has been really helpful. I feel a lot more confident about the timeline than I did going into this call. I'll loop my manager in on the doc once I get it and then let's get that kickoff on the calendar.

+1Derek says the call was really helpful and he feels more confident about the timeline. · onboarding and implementation

Sounds great. We'll aim to get the document to you by end of day Monday, and then we can do a quick kickoff call early next week if that works. Rachel, does that align with what you're thinking?

Yep, that works perfectly on our end. Derek, I'll send a calendar invite with a few options for early next week. And as always, if anything comes up before then, don't hesitate to reach out — you've got my direct line. We're really excited to get this moving with the Crestline team.