Stress-test an identity provider cutover by proving that each cutover window and hold rule can place identities inside the planned lane, survive override pressure, and avoid trapping operators inside a green identity slide that hides long-lived dual writes.
Identity provider cutovers often list a calendar while leaving restore behavior, override authority, and abort ownership implicit. Those edges decide whether a late dual-write ask stops inside the cutover packet or leaves a broken exception live under production load. The exercise should follow actual identity tools, revoke exports, and on-call paths rather than a clean IT deck.
Inventory the identity path
List every identity class with its cutover window, waive rule, override behavior, owners, and notification channels. Mark paths that cannot reverse without a manual directory edit. Attach the last three identity incidents with raw timelines and any waivers. Include the source of truth for open dual-write counts during the observation window.
Define the phases for detect, hold, cut over, abort, and communicate. Each phase needs an owner and an exit condition. Write the point after which a stuck dual write would require a different procedure, then review whether that action is still permitted. Capture maximum acceptable login friction in measurable units, including which cohorts are excluded from the cutover and why.
Include the calendar of known events for the next two quarters: access review peaks, secrets rotations, and vendor cutovers that shrink the usable change window. An identity budget that ignores those dates will look calm until the week they land.
Failure drills
- A minority high-volume app keeps a side-channel while the aggregate identity dashboard stays green.
- A restore has already left a partner surface without a trusted identity state.
- The primary identity dashboard lags beyond the planned observation window.
- An operator skips a hold gate because a board date is close.
- Automated and human cutovers collide under the new waive rule.
- Abort authority is unclear at week end and the page lands on the wrong directory.
For each drill, identify detection time, access impact, containment, and the authority to force an identity rollback. Require commands and dashboard links in the runbook. A statement that monitoring will catch it does not establish which alert fires or who receives it.
Prove identity changes are timed and owned
Run the package in Pingpong with IT, identity, security, and platform seats. Ask security which access decision becomes unsafe first if dual writes still stick after the claimed window. Ask platform whether capacity can absorb a forced override. Ask IT to show the exact identity version or revoke export used as the exit condition.
Related reviews include the IT ops lead seat, the identity ops lead seat, a device refresh cycle review, a secrets rotation drill, and an access review cadence. Browse the war-game decisions hub for adjacent controls.
Authorize the published identity response only after a timed drill restores usable revoke hygiene inside the documented budget without an undocumented manual step.