Lesson Learned - General Motors Road to Modern Consumer Identity
summary
General Motors migrates its multi‑brand login to a single consumer identity platform on Azure B2C/Entra, keeps a dedicated on‑prem profile service, and moves apps off authentication so they only call one control plane. Implementation uses OAuth2.1 with PKCE, FIDO/passkeys, WAF/CDN bot defenses, SIEM/SOAR telemetry and risk‑based adaptive access. An observed IRSF phone‑fraud wave triggers automated phone‑number blocking and temporal throttling, and progressive opt‑out to phishing‑resistant authenticators raises usable MFA while rooting out ROPC and legacy flows. Results: centralized control, fewer app changes, and measurable reductions in fraud noise.
AI-written summary · about
chapters (10)
- 0:00GM and Microsoft identity journey
- 1:07Consumer vs workforce identity
- 7:05Modern auth protocols and tools
- 12:13Balancing security and UX
- 15:07From product to customer focus
- 21:34Entra demo and identity proofing
- 26:32Defending against bots and fraud
- 36:31Orchestration and monitoring in identity
- 41:33Key takeaways and steps
- 47:15Q&A on federation and compliance
related talks
37mCustomer Identity for Modern Apps and APIs
31mLog In Through the Front Door: Automating Defense Against...
15mTransforming security and experience with digital identity
50mManaging Enterprise and Consumer Identity with Azure Active Directory
19mAdvanced Authentication Framework
21mEarning Trust in Identity at Scale
28mLessons on the Road to Complete Customer MFA
26mIntegrating Identity and Fraud