Your first month of IAM preparation should aim for one safe, accurate piece of work someone else can inspect.
That can be a small fictional access-control example, not a large environment or a polished website. Choose the deliverable early so your learning has a visible finish line.
Public output is a goal, not permission to expose sensitive information or publish unsupported claims. Build and test first; share only what is ready and appropriate.
Sketch the portfolio page before expanding the lab
Start with the question the page will answer. For example:
“Can I demonstrate that one fictional user has read access to a resource while another does not?”
That suggests a small lab and a specific set of evidence. Draft the page outline:
- Requirement: Who should access what?
- Diagram: Which identities, groups, and resources are involved?
- Configuration: Which settings matter to the claim?
- Tests: What happened in the allowed and denied cases?
- Limitations: What did the exercise not establish?
The outline helps you collect useful evidence while working instead of discovering afterward that you never recorded a key test.
It also limits unnecessary infrastructure. Add a component because the question requires it, not because a larger diagram looks more impressive.
Use the first week to narrow the target
Read suitable role descriptions and choose one responsibility the project can demonstrate.
Then inspect your available equipment, time, and knowledge. Select a scope you can reasonably complete rather than copying the largest environment you have seen online.
Record what the project will not cover. For a directory access exercise, you might exclude application SSO and cloud synchronization. Those can be later projects. A clear exclusion protects the first month's finish line from becoming a moving target.
Build and test before polishing the presentation
Spend the next sessions establishing the fictional environment and running the expected tests.
Keep notes on the requirement, changes, and observations. Save only the evidence that helps explain the result. If a test fails, investigate and document the actual cause you established rather than inventing a dramatic troubleshooting story.
Do not spend the first two weeks choosing badges, colors, or a portfolio theme.
Presentation matters after there is a result to present. A beautiful page with no clear test is still missing the most important part.
Make publication conditional on safety and accuracy
Public does not mean every file belongs online.
Use synthetic identities and sample data. Inspect screenshots, configuration exports, scripts, and repository history for secrets or private details. Keep employer material out of the project unless there is explicit authorization and a suitable reason to share it.
Label the work as a lab and explain its limits.
If the artifact isn't safe to publish yet, keep it private and fix that first. The month-end target should encourage completion, not pressure you into careless disclosure.
Give a new reader enough context to understand it
The opening should state the problem and result without requiring a deep technical read.
Then provide the relevant design and evidence for someone who wants more detail. A short test table is often easier to understand than a long sequence of uncaptained screenshots.
Use a portfolio section that can be skimmed quickly to make the page useful to a reader who has not followed your entire learning journey.
The artifact is a communication exercise as well as a technical exercise.
Use the result in the next career action
Once the page is accurate and safe, connect it to an application, a conversation, or your own gap review.
Practice explaining what it proves in two minutes. Identify the next question you couldn't answer and use that to choose the following project.
Don't let publishing become another end point that replaces the job search.
The Six-Figure IAM Career Playbook includes three IAM lab directions, portfolio guidance, and a 90-day action plan. The $9 guide helps connect each project to a career purpose rather than a growing pile of private notes.
At the end of the month, aim for one clear piece of evidence. It doesn't need to look like a company's entire identity environment to be useful.