ISPSS & Cloud
For teams moving privileged access into cloud and DevOps pipelines.
ISPSS & Cloud
Covers the Idira Identity Security Platform Shared Services estate — Identity, Secrets Hub, Secrets Manager SaaS and Secure Cloud Access — and how they connect to existing PAM.
What you will be able to do
- Onboard a Privilege Cloud tenant and connect it to on-prem targets
- Roll out Secure Cloud Access, SIA and SWS for zero standing privilege
- Deploy EPM policies and Workforce Password Management
- Wire Secrets Hub and CCP into cloud and pipeline workloads
- Read ITDR and PTA signals and act on them
How the programme runs
Each day pairs concepts with hands-on work. Sessions run two to eight hours a day, scheduled in your time zone.
| Day | Focus | Topics |
|---|---|---|
| Day 1 | ISPSS platform | Shared services, identity administration, tenant roles, connector architecture |
| Day 2 | Privilege Cloud onboarding | Connector servers, Secure Tunnel, platforms, discovery, migration path |
| Day 3 | Secure Cloud Access | JIT roles in AWS and Azure, approvals, session capture, entitlement lifecycle |
| Day 4 | SIA & SWS | Ephemeral infrastructure access, Kubernetes brokering, recorded web sessions, Secure Browser |
| Day 5 | EPM | Least privilege policies, elevation with justification, application control, ransomware protection |
| Day 6 | Identity & WPM | SSO, adaptive MFA, passkeys, Workforce Password Management rollout |
| Day 7 | Secrets Hub & CCP | Sync to AWS, Azure and GCP, CCP for apps, pipeline retrieval, Conjur basics |
| Day 8 | ITDR, PTA & practical | Signals and response, SIEM correlation, end-to-end JIT exercise |
What the programme covers
Tenant structure, connector servers, Secure Tunnel and day-to-day administration.
Syncing vault-managed secrets into cloud-native secret stores without duplicating ownership.
Policy model, authenticators, and retrieving secrets from build pipelines and containers.
Just-in-time elevation into cloud consoles and the session controls around it.
Idira Identity SSO and MFA, with directory integration to Entra ID and on-premises AD, and federation to third-party identity providers.
A reference architecture connecting Self-Hosted PAM, Privilege Cloud and ISPSS in one estate.
Who, what you need, and how it is assessed
Who should attend
- Teams moving from Self-Hosted to Privilege Cloud
- Cloud and platform engineers
- Identity teams adopting ISPSS modules
- Managed service staff supporting tenants
Prerequisites
- PAM Foundation or equivalent
- Working knowledge of AWS or Azure IAM
- Basic Kubernetes and CI/CD concepts helpful
Lab environment
- Privilege Cloud tenant per cohort with connector servers
- AWS and Azure sandbox accounts for SCA and SIA
- EPM agents on Windows and Mac VMs
- Pipeline runner for Secrets Hub and CCP exercises
Assessment & certification
- Module checkpoints with tenant tasks
- End-of-programme: bring a new cloud account under JIT access end to end
Delivery formats
- Live instructor-led, remote or on-site
- 2 to 8 hours per day, scheduled in your time zone
- Open cohort per seat or private batch
Commercial
- Per seat or per corporate batch
- 8 days
- Syllabus and quote on request
Labs, not slides
Privileged access in cloud environments fails differently from the data centre. Secrets end up duplicated across three stores, nobody owns rotation, and pipelines hold static credentials because that was the fastest thing to ship.
The lab
Participants work in a real AWS account with a Secrets Manager SaaS tenant, a running pipeline and cloud workloads to secure — not a simulated environment.
Ready to build the team you need?
Corporate batches are scoped to your deployment and scheduled in your time zone. Open cohorts run for individual engineers.
These principles guide every engagement
They define how we design, deliver and operate identity security for our customers.
Certified, not just familiar
Guardian-led, with CDE credentials across PAM, Privilege Cloud, EPM and Secrets Manager, kept current on every release.
Architect-led delivery
Design is reviewed and signed off before anything is built, so what goes live is what was agreed.
Written scope, fixed price
Deliverables, timeline and price in writing before work starts. No open-ended retainers.
Enablement built in
Your team is trained during delivery, so what we build does not depend on us to keep running.
Sound familiar?
The situations that start most of our engagements — in the words we hear them.
Need identity security you can trust?
Talk to a certified architect about protecting privileged access, identities and critical systems. The first call is technical, not a sales pitch.