--- title: "Identity and Access Management" description: "Entra ID and Okta deployments with single sign-on, phishing-resistant MFA, privileged access control and joiner-mover-leaver processes that work." url: "https://nixit.io/services/identity-access-management/" lang: "en" --- # Identity and Access Management We consolidate identity into one source of truth, with SSO, strong MFA and real control over privileged accounts. In a company of a hundred and fifty people we once found active accounts belonging to eleven former employees, one of them holding domain administrator rights. This was not negligence. It was the natural outcome of an offboarding process that depended on somebody remembering every system a person had access to. With twenty applications and no central directory, nobody remembers every system. Identity management exists to remove that dependency on memory. ## Consolidating identity The first step is establishing a single source of truth for accounts and group membership. In Microsoft-centric environments that is usually Entra ID, often synchronised with an existing on-premises Active Directory. In mixed environments, Okta fits well, and Keycloak is a strong option where you prefer open source running on your own infrastructure inside the EU. A single source does not mean one system for everything. It means one place where accounts are created, modified and disabled, with other applications synchronising from it. The practical difference shows up when someone leaves: disabling in one place closes access everywhere, instead of relying on a checklist nobody has updated since the last reorganisation. ## Single sign-on and MFA We integrate business applications through SAML or OpenID Connect. The benefit is not only user convenience but that authentication policy is applied at one point and can be verified. Without SSO, every application maintains its own password store, its own rules and its own set of accounts that quietly stay active after people move on. Multi-factor authentication is deployed in stages, beginning with administrative accounts and remote access. For those we recommend FIDO2 security keys or passkeys, because they are bound to the legitimate domain and cannot be relayed through a phishing proxy. App-based codes remain acceptable for general staff, but they are not sufficient where a compromise does the most damage. Conditional access policies add context, applying different requirements based on location, device posture and application sensitivity. The aim is to raise assurance where risk is genuinely higher without turning routine daily sign-in into an obstacle that pushes people toward workarounds. ## Privileged access Administrative accounts need separate handling. We implement privileged access management so that credentials are vaulted, checked out for a limited period against a stated reason, rotated automatically after use and recorded at session level. The shared local administrator password, identical across every server and known to seven people, remains one of the most common findings in the audits we run. Access reviews complete the picture. Quarterly or twice yearly, system owners confirm who should retain access to what. Permissions accumulate over time, particularly through promotions and role changes, and without a formal review nothing is ever removed. Automating the review's evidence collection is what makes it survive past the first cycle. ## Who this is for Identity work becomes worthwhile from around fifty employees, earlier if you run many SaaS applications or have frequent staff movement. It is equally relevant for organisations that must demonstrate access control for NIS2 or ISO 27001, and for any company that has experienced an incident that began with a compromised credential. For EU clients there is an additional consideration: identity data is personal data, and where the directory is hosted matters for GDPR. We can design around EU-region tenants or self-hosted Keycloak where data residency is a firm requirement, and we document processing locations rather than leaving them to be discovered during an audit. ## Outcomes A new employee has correct access on their first morning. A departing one loses everything the same day, automatically and verifiably. When an auditor asks who has access to what, the answer takes minutes to produce rather than a week of spreadsheet work across a dozen system owners. ## What you get - Consolidated identity directory acting as the single source for accounts and groups - Single sign-on across business applications via SAML or OpenID Connect - Phishing-resistant MFA rolled out in stages, starting with administrative accounts - Documented joiner, mover and leaver process with automated access revocation - Privileged access management with vaulted credentials, rotation and session logging ## Technologies Microsoft Entra ID, Okta, Keycloak, SAML, OpenID Connect, FIDO2, YubiKey, HashiCorp Vault ## Frequently asked questions ### Is SMS good enough as a second factor? It is better than nothing but can be defeated through SIM swapping or by a phishing page that relays the code in real time. For administrative accounts we recommend FIDO2 security keys or passkeys, which are cryptographically bound to the real domain and cannot be replayed against a fake one. Authenticator apps with number matching are a reasonable middle ground for general staff. ### How long does an SSO rollout take? The directory and the first applications typically take two to four weeks. The rest depends on how many applications need integrating and how well they support modern standards. Older applications without SAML or OIDC support are usually what consumes most of the project timeline, and sometimes need a proxy in front of them. ### What if the identity provider goes down? It is a genuine risk and we address it explicitly. We maintain break-glass accounts with direct access, held under physical control with monitored usage, plus written procedures for operating when central authentication is unavailable. Consolidating identity without planning for this creates a single point of failure across every system at once. ### How does this support NIS2 compliance? Access control and privileged account management are explicit requirements. A consolidated directory with enforced MFA, periodic access reviews and logged privileged sessions covers a significant portion of the technical measures assessors examine, and produces the evidence they ask for without a manual evidence-gathering exercise.