Real troubleshooting stories from higher ed IT - IAM, Active Directory, MFA lockouts, help desk lessons, and home lab builds - written by Timothy Hoag (TJ).
Every post here comes from a real ticket, a real build, or a real mistake. I'm Timothy Hoag (TJ), an IAM & IT Operations Specialist supporting 30+ higher education institutions, and these are the problems I actually work on.
How accounts get created, why access lingers longer than it should, and what happens when authentication succeeds but authorization fails. Start with OAuth Token Forbidden: IAM Lessons from SEO for a hands-on look at tokens, scopes, and least privilege, The Guest Account Nobody Remembered for why guest access needs an owner, or Shared Accounts: IAM Compliance Risks for the compliance risk hiding in department logins.
Most enterprise lockouts trace back to the gap between on-prem Active Directory and cloud identity in Entra ID or Okta. Hybrid Identity Lockout on the Road shows what happens when a travel laptop misses a password sync, and Credential Manager Invalid Password Fix covers the Windows Credential Manager replay problem that quietly re-locks accounts after a successful reset.
Multi-factor authentication protects accounts and occasionally traps their owners. New Phone MFA Lockout: The Wi-Fi Loop breaks down the chicken-and-egg problem of a new phone that needs Wi-Fi to receive the MFA push that the Wi-Fi login requires.
Front-line support lessons from healthcare and higher ed. The Ticket That Changed My Support Mindset is about the context users leave out, Why Clearing Browser Cache Fixes Tickets explains the fix that resolves a third of web complaints, FERPA Help Desk Verification covers what an agent can and cannot confirm on a call, and Healthcare vs Higher-Ed IT Support compares what a failure costs under HIPAA versus FERPA.
The lab where I test everything before it touches production advice. How I Organized 31 Docker Containers walks through stacks, secrets, and monitoring, and Weekly Wins tracks the smaller improvements. Full step-by-step builds live on the Labs page.
The blog covers real IAM and identity issues from supporting 30+ higher ed institutions: Active Directory and hybrid identity failures like sync gaps with Entra ID and Okta, MFA lockouts including the new-phone Wi-Fi loop, and Windows Credential Manager problems that quietly re-lock accounts after a password reset. It also covers FERPA and HIPAA compliance for help desk identity verification, and governance gaps like forgotten shared or guest accounts.
Recent posts have published roughly weekly since spring 2026, drawn from real tickets, builds, and mistakes rather than theory - recent examples include posts on OAuth token errors, shared account compliance risk, and FERPA help desk verification published from June through July 2026. Every post is written by Timothy Hoag (TJ), an IAM & IT Operations Specialist.