The 4 essential Domain 1 (complex org design, 26%) topics for Pro are Organizations · SCP · Control Tower · IAM Identity Center. We've separated these over the week; today we tackle Pro scenarios where all 4 operate simultaneously.
Domain 1 is hard not because single-service knowledge matters, but because it's layered on top of each other. One "region restriction isn't working" problem might involve SCP's NotAction exceptions, OU inheritance, IDC Permission Set inline policies, and RCP's external Principal blocking all tangled together. Today we revisit each service not by re-explaining, but by showing how one service's decision creates blast radius in another.