Identity Management, Security, Infrastructure Operations, Enterprise Architecture
Authentication has never been easier. A user can open an app or browse to a website and access content similar to the way they do at home. Keeping track of logins and passwords is becoming a thing of the past, thanks to modern identity platforms.
Modern identity platforms allow organizations to implement:
- Single Sign-On
- Multi-Factor Authentication
- Passwordless authentication
- Face recognition
- Token / security key access
Several organizations manage a growing collection of identity systems that accumulate over years of technology decisions.
Over time, identity becomes less about authentication and more about operational complexity. That complexity can have a large impact on the user experience.
Every Identity Product Solves One Problem and Creates Another
Identity products are typically purchased with good intentions.
A company purchases one solution to improve workforce authentication. Another to improve cloud integration. Another to improve customer identity management. Another arrives through a merger or acquisition.
Individually, each purchase makes sense. Collectively, they create a complex environment where several platforms may perform similar functions.
Eventually organizations find themselves asking:
- Which identity product should we use?
- Who owns it?
- Which applications should integrate with it?
- Which platform should new projects adopt?
What started as a technical solution becomes an architectural challenge.
Choosing an Identity Platform Becomes a Project of Its Own
One challenge rarely discussed is deciding which identity platform should support a new application. An architecture discussion that should take minutes can turn into weeks of meetings.
Questions emerge:
- Should the application authenticate against Active Directory?
- Should it integrate with a cloud identity provider?
- Should it use an existing federation platform?
- Does a business unit already have a preferred solution?
- Will security approve the design?
Different teams often advocate for the platform they own or support. Sometimes the technical decision becomes an organizational decision. This creates delays, confusion, and unnecessary complexity before a project even goes live.
Multiple Identity Teams Create Organizational Friction
Identity management often spans several departments: Each group may own different systems and have different priorities.
Infrastructure teams may prioritize reliability. Security teams may prioritize risk reduction. Application owners may prioritize simplicity. Cloud teams may prioritize modernization.
None of these objectives are wrong. However, competing priorities can create friction when multiple identity products must work together.
I’ve seen organizations where teams spend more time discussing ownership and responsibilities than solving the actual business problem. Technology complexity eventually becomes people complexity.
As I’ve discussed in previous articles about Platform Engineering and Volunteer Leadership, alignment between teams is often harder than implementing the technology itself.
The User Experience Often Suffers
End users rarely care which identity product is being used. They simply want access.
Unfortunately, multiple identity systems often create confusion. Users may need:
- Different passwords
- Different enrollment processes
- Different authentication methods
- Different support contacts
When access problems occur, employees frequently don’t know:
- Who owns the application
- Which team manages access
- Where access requests should be submitted
- Who can approve the request
This leads to:
- Frustration
- Ticket volume
- Lost productivity
- Slow onboarding
The organization may believe it has a modern identity architecture while users experience a confusing collection of disconnected processes.
Authorization Is Usually Harder Than Authentication
Authentication answers:
Who are you?
Authorization answers:
What are you allowed to do?
Authorization is where complexity explodes.
Every application may have:
- Different roles
- Different permissions
- Different approval workflows
- Different owners
- Different governance requirements
Two applications integrated with the same identity provider can still have completely different authorization models. This creates significant operational overhead.
Maintaining permissions frequently requires far more effort than authenticating users.
Automation Becomes Extremely Difficult
Modern IT organizations strive for automation. Identity management should be a perfect automation candidate. Unfortunately, multiple systems often make automation difficult.
Consider a new employee. Their access may require:
- HR approval
- Manager approval
- Security review
- Application owner approval
- Cloud team configuration
Each workflow may reside in a different platform. Each platform may have a different owner. Each integration introduces dependencies.
The more identity systems involved, the harder automation becomes.
Organizations frequently discover their identity workflows remain surprisingly manual despite years of investment.
Security Requirements Add Additional Complexity
Identity platforms are attractive targets for attackers.
A compromised identity system can expose an organization far beyond a single application. As a result, security teams often require identity systems to operate within tightly controlled environments. Examples include:
- Internal-only administration portals
- Restricted management interfaces
- Private network access
- VPN requirements
- Conditional access controls
These requirements improve security but can also impact usability. The challenge becomes balancing security and accessibility.
The HR System Problem
One of the most difficult identity decisions involves Human Resources applications. Employees expect to access from any device:
- Benefits information
- Payroll details
- Tax documents
- Leave requests
- Training platforms
Security teams must determine how to provide access to sensitive data outside the corporate network without exposing unnecessary risk.
Questions arise such as:
- Should access require VPN connectivity?
- Should cloud access be permitted?
- Should conditional access policies be enforced?
- Should unmanaged devices be allowed?
There is no universal answer. Each organization must balance:
- User convenience
- Employee expectations
- Regulatory requirements
- Security risk
This balancing act illustrates why identity architecture is often far more complicated than implementing a login page.
Identity Complexity Creates Technical Debt
The longer identity environments evolve, the more technical debt they accumulate. Examples include:
- Duplicate groups
- Legacy integrations
- Unused accounts
- Multiple approval processes
- Inconsistent role definitions
- Overlapping identity products
Like documentation debt or process debt, identity debt compounds over time. Organizations often discover these issues during:
- Migrations
- Audits
- Security reviews
- Modernization efforts
By then, cleanup becomes expensive and time-consuming.
What Successful Organizations Do Differently
The most successful organizations do not necessarily have fewer identity products. They have clearer governance. They typically establish:
- Clear ownership models
- Identity standards
- Defined onboarding processes
- Defined access request procedures
- Consistent authorization models
- Documented responsibilities
Most importantly, they make identity decisions based on business outcomes rather than organizational politics.
Final Thoughts
The biggest identity challenge facing many enterprises today is complexity. Every new identity product, integration, workflow, and ownership model adds another layer that must be maintained.
Users become confused.
Teams become siloed.
Automation becomes harder.
Operational costs increase.
Security requirements become more difficult to balance with usability.
Organizations often believe they are managing identities. In reality, they are managing a growing collection of identity products, processes, approvals, and ownership structures.
The organizations that succeed are not necessarily the ones with the newest identity platforms. They are the ones that create clarity.
Because in modern IT, identity is no longer just a security service. It’s an operational discipline.
Suggested Internal Links
Leave a Reply