CASE STUDY · IDENTITY & ACCESS MANAGEMENT (IAM)
Consolidating five identity systems into one IAM platform.
- 140140 dormant accounts removed
- 2 daysOnboarding time down from 2 days to 4 hours
01 · PROJECT OVERVIEW
The client and the brief.
An anonymised mid-market B2B services company. Name withheld under confidentiality.
Account mapping, migration and single sign-on. We merged the five directories into one platform and moved applications onto it.
- 1The company had 5 directories with inconsistent access rules.
- 2Years of growth and acquisitions had left each team with its own way to create and remove accounts.
- 3Nobody could say who had access to what.
- 4Onboarding a new hire meant tickets to several teams and took days.
02 · WHAT WENT WRONG
What went wrong, and how we fixed it.
Every engagement hits problems. These were the ones that mattered here, and what we changed so they did not come back.
- PROBLEM 01Two directories used different formats for the same people, and the first automatic match linked a few accounts to the wrong person
We caught it in the test list before cutover, because a manager flagged access that looked wrong. We stopped, moved to a stricter match rule with manual approval for any unsure case, and re-ran the mapping. It cost about a week but avoided giving anyone the wrong access.
- PROBLEM 02It cost about a week but avoided giving anyone the wrong access
- PROBLEM 03A second hurdle came from service accounts
The audit found a number of accounts used by scheduled jobs and integrations that no person owned. Disabling them as dormant would have broken reporting and file transfers. We tagged each one with the job it served, found a business owner, moved their secrets into a vault and put them on a rotation schedule.
- PROBLEM 04Accounts that nobody could explain were disabled in a monitored state first and removed only after a quiet period with no complaints
03 · THE PROCESS
How we ran it.
We worked in four stages with a weekly steering call.
- 01Step 1
Discovery: export every account from every directory, plus the apps that depended on each one.
- 02Step 2
Mapping: match people across directories, flag duplicates and orphans, and agree owners for each doubtful account.
- 03Step 3
Migration: move in waves, starting with low-risk apps. Each wave had a freeze window, a test list and a rollback plan.
- 04Step 4
Cutover and clean-up: switch applications to single sign-on, remove the old directories from use, and run the first access review.
04 · RESULTS
What changed.
Measured against the way the work ran before the engagement began.
- NOW 01
HR is the trigger for joiners and leavers, not email requests.
- NOW 02
Managers confirm access to their teams in a regular review.
- NOW 03
New apps are only approved if they connect to the central platform, and exceptions need a named owner and an end date.
- NOW 04
We handed over a mapping record, the role catalogue, the leaver and mover flows and a one-page procedure for adding a new application.
- 140
140 dormant accounts removed
- 2 days
Onboarding time down from 2 days to 4 hours
05 · WHAT WE BUILT
How it works.
- A mapping table linked every legacy account to one person record.Matches were by employee ID first, then email, then a manual check.
- Roles replaced one-off permissions.We defined a small set of roles per department.
- Applications connected over standard single sign-on protocols where supported.For others we used provisioning connectors or a managed exception list.
- Admin accounts were separated from daily accounts and given stronger authentication.
- Every change was logged, so the access review had evidence behind it.
06 · QUICK ANSWERS
The short version.
- What problem did the client have?
- The company had 5 directories with inconsistent access rules. Years of growth and acquisitions had left each team with its own way to create and remove accounts. Nobody could say who had access to what. Onboarding a new hire meant tickets to several teams and took days.
- What did Brandsmashers build?
- Account mapping, migration and single sign-on. We merged the five directories into one platform and moved applications onto it.
- How was the work run?
- We worked in four stages with a weekly steering call.
- What were the results?
- 140 dormant accounts removed; onboarding time down from 2 days to 4 hours.
YOUR TURN
Have a similar requirement?
Tell us what is stuck. We will come back with a plan and matched, pre-vetted engineers.
