Skip to content
View salamraghe's full-sized avatar
  • Washington State

Block or report salamraghe

Block user

Prevent this user from interacting with your repositories and sending you notifications. Learn more about blocking users.

You must be logged in to block users.

Content in all repositories owned by your account will be closed.
Maximum 250 characters. Please don’t include any personal information such as legal names or email addresses. This note will only be visible to you.
Report abuse

Contact GitHub support about this user’s behavior. Learn more about reporting abuse.

Report abuse
salamraghe/README.md

Abdisalam Abdirahman

I'm working toward IAM Support / IAM Engineer / PAM / Okta IAM roles. Every lab below has screenshots of the real work, what broke, and how I fixed it.

How I see the job: give people the access the ticket asks for, put MFA or an approver in front of it, and take it away when they're done.

Portfolio: https://salamraghe.github.io/

Labs (proof first)

Privileged access

  • CyberArk PAM 12.6 (Oct 2026): I put a Domain Admin account in a safe with dual control (requester asks with a ticket, approver signs off), had CPM rotate the password, recorded a PSM session, then removed the requester's access.
  • Entra PIM (Oct 2026): I made a user only eligible for User Administrator. To use it they needed MFA, a reason and my approval, and it expired after 1 hour. Every step is in the audit log.

Cloud identity (Microsoft Entra ID)

  • Entra IAM lab (Sep 2026): I set up users, groups and P2 licensing. In Entra I required MFA for a test group with Conditional Access and gave that group SSO to a SAML app and an OIDC app. For a leaver, I disabled the account, revoked sessions, and removed the license and groups.
  • Entra access review (Oct 2026): I reviewed a group, denied an inactive user with a reason, and auto-apply removed them.
  • Entra SCIM provisioning (Oct 2026): I assigned a user in Entra and Entra built their account in a SCIM test app by itself. Leaver step is partial: Entra shows IsActive False, but app-side deactivation isn't shown.
  • ServiceNow identity tickets (Oct 2026): I worked joiner, mover and leaver tickets in ServiceNow, did each change in Entra ID, and closed them with work notes and resolution notes.

SSO / MFA

  • Okta SSO / MFA (Sep 2026): I gave a test user a SAML app through a group, required MFA, proved SSO, then removed the group and the app disappeared.

On-prem directory

  • AD user lifecycle (Sep–Oct 2026): On a Windows Server 2022 DC, I created users, gave group access, moved a user to a new group, and disabled a leaver.
  • PowerShell joiner/mover/leaver (Oct 2026): My scripts build, move and disable AD users from CSV files, with every result checked in AD.
  • LLDAP least privilege (Sep 2026): I put an analyst in a read-only group and signed in as him to prove he had no admin rights.

Contact

Reach me here on GitHub.

Pinned Loading

  1. ad-user-lifecycle ad-user-lifecycle Public

    Active Directory user lifecycle lab (Windows Server 2022): create users, assign groups, disable leaver, document access

  2. cyberark-pam-lab cyberark-pam-lab Public

    CyberArk PAM Self-Hosted 12.6 home lab: onboard → dual-control request/approve → CPM rotation → PSM recorded session → revoke

  3. entra-iam-lab entra-iam-lab Public

    Microsoft Entra ID lab: users/groups, Conditional Access MFA, leaver offboard, SAML + OIDC SSO

  4. okta-sso-mfa okta-sso-mfa Public

    Okta lab: grant → MFA → SAML SSO → revoke (group-based app access)

  5. powershell-jml powershell-jml Public

    PowerShell joiner/mover/leaver automation for Active Directory (IAM lab)

    PowerShell

  6. servicenow-identity-tickets servicenow-identity-tickets Public

    ServiceNow joiner/mover/leaver identity tickets worked end to end in Entra ID