Case study: Identity & Access Management
Rebuilding identity at university scale.
More than 450,000 identities moved onto a modern platform with phishing-resistant, passwordless MFA, cohort by cohort around the academic calendar, with people keeping the passwords they already had. Sixteen years of identity infrastructure being replaced, with the same core team at the centre of it since 2024.
Client
A leading Australian university
Engagement
Multi-year identity and access management transformation
Move FWD role
Project Manager, Solution Architect, Business Analyst and Identity Technical Specialist, embedded in the program from the start
Status
In delivery
Delivery status across the program to date.
The challenge
Sixteen years of institutional knowledge, running in production.
Identity connects almost every part of university life. A student enrolling. A researcher collaborating across institutions. A staff member changing roles. Each depends on systems knowing who they are and giving them the right access on the right day, and none of it the day after they leave.
For sixteen years, the university's identity environment evolved alongside its people, applications and operational requirements. It decided who a person was, and it enforced what they could reach, and over time those two jobs had grown into each other. By the time the transformation began, it supported more than 450,000 identities and more than 300 applications, and much of what it did lived in people's heads. Modernising it meant bringing that knowledge together, mapping the dependencies and planning how each capability would transition.
This was never going to be a lift and shift. It was a multi-year program in an institution that never stops, with a lot of decisions that would only make sense to someone who had been there for all of them.
That was the decision that mattered most: one team, embedded from the start, staying to the end.
Delivered so far
What is already in production.
- A modern identity platform in production for more than 450,000 identities across staff, students, researchers, alumni, affiliates and external partners.
- Adaptive, phishing-resistant MFA for every cohort, with behaviour detection and risk scoring, rolled out around semester starts, census, exams, results and enrolment.
- Passwordless sign-in, device trust and an authenticator app in production, so people sign in without a password on a trusted device.
- Directory migration designed so people kept their existing passwords, with no forced resets as part of the move.
- Platform logs integrated into security operations.
- A target identity architecture endorsed by the university, and a transitional architecture that lets old and new run side by side.
- The identity lifecycle documented end to end, across every identity population, for the first time.
- The application estate analysed, with more than 300 applications identified for migration and grouped by integration pattern.
How it was done
Four phases since 2024.
Understand before you build
No technology was deployed in 2024. That was the method, not a delay. The year went into governance, procurement and discovery: executive governance for the program, an open market process that selected a Gartner Leader platform, and a full review of every dependency and every job the legacy platform had quietly taken on.
Two things came out of it. A target identity architecture, endorsed through the university's architecture governance, so every phase had a destination. And a transitional architecture that connected the new platform to the university's integration layer rather than to the system it would replace, so old and new could run side by side and the legacy platform could be retired on its own timeline.
Prove it small
The platform went into production on a deliberately small surface. A pilot staff cohort, a handful of applications, adaptive MFA with behaviour detection and risk scoring on from day one. Enough to validate the design in everyday conditions. Not enough to bet the institution on. Identity governance was scoped and deliberately sequenced later. Governance depends on lifecycle data being right.
Every cohort, one at a time
Extending the platform to more than 450,000 people was a scheduling exercise across an institution that is never idle. Staff, students and alumni each ran to their own schedule, and each schedule had the same four dates: awareness, when communications went out; activation, when people could enrol; enforcement, when the new MFA became mandatory; and go-live, when the cohort was fully across. The university's calendar set the boundaries: semester starts, census, exams, results, enrolment. Every cohort was planned into the gaps, with go and no-go points and fallback dates agreed in advance.
Between activation and enforcement the team tracked activations daily. That number told the program whether a cohort was ready to enforce, needed another round of communications, or needed its enforcement date moved before the freeze rather than after it. Migration was designed so people kept their existing passwords. No forced resets.
Lifecycle, migration and decommission
Phase three began with analysis. The team documented the identity lifecycle end to end, across every identity population, for the first time. Three workshops then asked what the old platform does that the new one cannot do natively. Four areas came out, including the architectural heart of the program: the boundary between person data and identity services. It is being designed now and tracked as a program-level dependency. For every named risk, the university either funds the mitigation or formally accepts it.
Analysis of the application estate is still under way. So far it points to more than 300 applications requiring migration, and the work is being grouped by integration pattern so that what looks like hundreds of separate projects becomes a small number of repeatable approaches. Self-service password reset is being implemented in this phase alongside the persona work. Joiner, mover and leaver automation follows: accounts ready before day one, role changes that drop old access as new access lands, and departures that run a defined sequence instead of a ticket. Staged decommission comes last, sequenced backwards from the retirement date.
Where it is now
Phase two is closing. Phase three is in design.
Migration tranches are defined, lifecycle processes documented and automation scoped.
Continuity has kept architectural decisions, business requirements and delivery knowledge connected across the phases. The people who set the foundations are still in the room as the work moves into production and across the university.
The program is also planning its own exit. Resourcing tapers as the platform matures, with knowledge moving into the university's operational teams. A transformation program that never ends is not a transformation. It is a dependency.
Move FWD's role
The program is the university's. Our people are in it.
The Project Manager, Solution Architect, Business Analyst and Identity Technical Specialist have been embedded since 2024: governance, procurement, architecture, process documentation, gap analysis, change and communications, executive reporting, and then the hands-on design, configuration and migration, with support from the platform vendor's professional services team. The Business Analyst's scope concluded with the lifecycle documentation, as the program moved into technical delivery.
The people who helped shape the transformation stayed to deliver it.
Contact
Planning an identity transformation?
Talk to the team working through one at university scale.
Book a conversation →