An Architect's Map to Cloud-first Customer Identity