Compete
Compete
Breach News Peg
Federal Student Aid published Technology Security Alert GENERAL-26-27 on May 12, and the remediation language landed squarely on the identity layer. FSA directed institutions to rotate API keys, SSO connectors, and LTI tool credentials. Review identity-provider and authentication logs for anomalous access between April 25 and May 8. Enforce MFA uniformly across all administrative, IT, cloud, and vendor platforms.
The trigger was the Instructure/Canvas breach. But FSA's remediation framework treats identity infrastructure as the exposure surface, not the LMS application. That framing is the news peg for every conversation that follows.
Competitor Scope Gaps
Entra Agent ID Covers Microsoft's Agents. Campus Runs More Than Microsoft.
Microsoft built something real with Entra Agent ID. Agents created in Azure AI Foundry and Copilot Studio now surface in the Entra admin center with full governance visibility. But Canvas runs on OpenAI. Research computing runs on LangGraph and HuggingFace. Ellucian is absent from the partnership announcements. Agent ID governs Microsoft-native agents automatically and everything else conditionally. The campus application stack is overwhelmingly not Microsoft-native where it matters most.
Federation Is Foundational. Lifecycle Governance Lives Somewhere Else.
Shibboleth is community-built infrastructure that campuses helped create, and InCommon federation solved cross-institutional trust before most enterprises understood why it mattered. Federation authenticates and releases attributes. Provisioning, role-lifecycle management, and non-human identity governance fall outside that scope. InCommon's own Futures2 strategy report names the gap explicitly. As the campus identity surface expands into AI agents and compliance-driven NHI governance, federation remains essential. The campus identity surface now includes provisioning, lifecycle, and NHI governance that federation was never built to handle.
Entra ID Battlecard — What "Identity Is Covered" Actually Covers
"We already have identity covered through our Microsoft agreement." You will hear this in nearly every Higher Ed deal where Entra is in play. The education pricing exemption from July 2026 commercial increases removes the cost trigger that might have forced re-evaluation. This card maps what "covered" actually covers, and where lifecycle automation, workload identity governance, and agent management fall outside the bundle. Maturity-state responses for Microsoft-dominant, mixed, and R1 research computing environments, calibrated so you don't overreach where Entra is genuinely winning.
Entra ID Battlecard — What "Identity Is Covered" Actually Covers
"We already have identity covered through our Microsoft agreement." You will hear this in nearly every Higher Ed deal where Entra is in play. The education pricing exemption from July 2026 commercial increases removes the cost trigger that might have forced re-evaluation. This card maps what "covered" actually covers, and where lifecycle automation, workload identity governance, and agent management fall outside the bundle. Maturity-state responses for Microsoft-dominant, mixed, and R1 research computing environments, calibrated so you don't overreach where Entra is genuinely winning.
NSPM-33's Staggered Deadlines and the Identity Architecture Gaps They Force Open
NSPM-33's cybersecurity controls are hitting covered institutions on different timelines depending on which agency funds the research. NSF's MFA mandate has been live since October 2024. DOE's training and Common Forms requirements passed in 2025. NIH's MFTRP restrictions took effect January 2026. DOD's certification clock has not started. Each deadline forces a specific identity infrastructure question — access lifecycle, entitlement evidence, non-human identity inventory — that Shibboleth and Entra each leave uncovered. What follows maps the closing windows, the controls they require, and the architectural gaps they expose, tiered by institutional maturity.
NSPM-33's Staggered Deadlines and the Identity Architecture Gaps They Force Open
NSPM-33's cybersecurity controls are hitting covered institutions on different timelines depending on which agency funds the research. NSF's MFA mandate has been live since October 2024. DOE's training and Common Forms requirements passed in 2025. NIH's MFTRP restrictions took effect January 2026. DOD's certification clock has not started. Each deadline forces a specific identity infrastructure question — access lifecycle, entitlement evidence, non-human identity inventory — that Shibboleth and Entra each leave uncovered. What follows maps the closing windows, the controls they require, and the architectural gaps they expose, tiered by institutional maturity.