THE ONLY FLAGSHIP IN THIS COURSE WHERE THE WRONG DECISION DOES NOT FEEL LIKE A DECISION AT ALL. Nobody chooses per-user assignment. They just start. And then they have five hundred users.
Five environments. Five hundred users. An average of two roles each. Five thousand grants. Every joiner is ten actions. Every leaver is ten actions — all of which must happen, none of which anyone will verify.
What the group model does instead. Roles are assigned to groups. People are added to groups. A joiner is one action. A leaver is one action. And an access review reads a group membership list rather than five thousand grants.
Why retrofitting is expensive. You cannot simply switch. You must map existing grants, design the groups, assign roles to them, add members, verify equivalence, then remove the individual grants. On a live estate that is weeks, and it needs a security sign-off.
DECIDE BEFORE THE ELEVENTH USER. AFTER THAT THE COST ONLY RISES.
Three questions. Groups or individuals? Groups. This is not close. How many groups? Lesson 7 — fewer than the org chart suggests. Local groups, or synchronized from the corporate directory? Module 7 — and the answer depends on the identity team's capacity, which is the question you asked in Module 3's workshop and are now cashing in.