Enterprise IAM, aligned onboarding and offboarding
A governed identity lifecycle for employees and external users across a 25,000-person organisation.
Business request
After the 2017 merger, identity management was left open by the IT rationalisation programme. The CIO raised it as a risk: there was no consistent governance, little transparency, and no clear ownership of identities. I was asked to define the target architecture and the roadmap to reach it.
Challenges
Regional SAP HR systems ran in parallel, with no single source of identity.
On-premise Active Directory, Azure AD, Microsoft Identity Manager and ServiceNow were all in use. The result was duplicate identities, inconsistent data and manual provisioning.
External users (consultants, contractors, students, technicians at wind farm sites) had no accountable owner.
The Workday rollout was a phased regional migration over several years. Old and new systems had to run side by side.
The work needed alignment between the CIO, Infrastructure, Cybersecurity and Enterprise Architecture. None of them reported to me.
Delivered solution
I treated this as a product problem before a technical one. I started with the current state and identified four user groups with different needs: employees, external users, IT administrators and HR. Employees and external users needed different lifecycles, not one generic process.
Internal employees
Workday is the source of truth and generates the unique identifier. Microsoft Identity Manager synchronises the identity into Azure AD, and access follows organisational rules. This is a standard joiner-mover-leaver lifecycle.
External users
An internal employee acts as sponsor and requests the identity in ServiceNow. After approval, the identity is created in Azure AD through Microsoft Identity Manager, with the identifier and ownership recorded.
Governance
Every identity has a named owner and sponsor. If a sponsor leaves the company, responsibility moves automatically to their management chain, so no external account exists without an accountable person. A golden-record matching approach checks whether a person already exists before a new identity is created.
Transition
Legacy SAP HR systems stayed synchronised with Azure AD during the migration. Their dependencies were decommissioned region by region as each completed the move to Workday.
I ran architecture reviews and weekly governance meetings on progress, budget, risks and decisions. I prepared the initial budget (consultants, internal resources, licences, technology) and handed it to the project manager for delivery. I was involved in selecting and onboarding Deloitte and governed Infosys’s ServiceNow development through architecture review.
Tech stack Workday, legacy SAP HR, on-premise Active Directory, Azure AD (Microsoft Entra), Microsoft Identity Manager, ServiceNow.
Outcome
The organisation moved from a fragmented, manual landscape to a centralised model across Workday, ServiceNow and Azure AD. The programme tracked these measures: provisioning cycle time, external request turnaround, duplicate identities, ownership coverage (target: 100% of identities with a responsible owner), dormant identity cleanup, and manual provisioning effort.
Lessons learned
Different identity types need different lifecycles. A single process either blocks employees or leaves external users unmanaged.
Accountability has to be built into the system. A policy alone does not survive people changing roles or leaving.
In a phased migration, the transition design is as important as the target state.
A job title does not limit the scope of the work. Discovery, prioritisation and roadmap sequencing were the same product skills, applied to an internal capability.