Open cardosec

Case B02118 · Identity & AD · L4 Advanced

The Identity Provider Went Down

Practise as: Incident drill · InterviewLevel: L4 Advanced

Live alertYour single sign-on provider had a six-hour outage. Nobody could sign in to anything, including the cloud console, the ticketing system and the incident chat. One admin finally got in through an old local account nobody knew still existed.

Interview questionAn identity provider outage locked everyone out, including your incident team. What do you change in the design?

  1. 01 What happened?
  2. 02 What is the impact?
  3. 03 What do you do?
Practise this card As Interview
What a strong answer covers

Try it out loud first. Then check yourself:

  1. Break-glass: at least two emergency accounts per critical platform, with phishing-resistant MFA, kept offline, alerted on every use.
  2. Map dependencies: which systems need SSO to sign in, and which incident and recovery tools must work without it.
  3. Out-of-band communications and runbooks that do not rely on the same identity provider.
  4. Remove forgotten local accounts like the one that worked; unmanaged backdoors are a risk even when they save the day.

If the interviewer pushes back

  • Longer session lifetimes would have kept people signed in during the outage. Why might you still not do that?

Go deeper

More Identity & AD cards

All Identity & AD cards →

cardosec draws a security topic and gives you a clock: explain it out loud with no notes, then see what you covered and what you missed. Free during early access.

Reviewed 2026-10-09