Wisdom is hard won from experience over time - through quiet victories and painful losses. Since starting Microsoft's identity protection team in 2012, Alex has collected that experience and wants to share his insights. His team, the defenses they built, and the techniques they developed evolved side by side with cloud identity systems and the attacks and attackers which prey on them. Customers from xbox gamers to the most security sensitive enterprises, and threat actors from script kiddies to highly funded nation state actors all provided key, real time feedback on what works - and what doesn't - when defending identity at scale. In this talk he distills the most important - if not the most comfortable - lessons from his tenure in this role for practitioners and industry.