Identity and Access Management Implementation Best Practices

Best Practices Guide

Best Practices From the Field

A Framework for Modern Identity and Access Management Success

Drawing from decades of successfully implementing identity and access management (IAM) solutions for global enterprises, Bravura Security has developed a proven approach to IAM deployment and operations. Our experience with complex, large-scale implementations has shown that success depends on strategic planning and methodical execution.

A common pitfall in IAM implementations is attempting to deliver all functionality in a single phase. This approach often leads to scope creep, extended timelines, and escalating costs - ultimately risking both business buy-in and team morale. Instead, follow these field-tested best practices.

Defining Identity and Access Management

Identity management and access governance isn't just a technical process—it's how help you understand and control who has access to your digital resources. Think of it as a smart, centralized system that answers three critical questions: Who are your users? How do they prove they are who they say they are? And what can they actually access?

Enterprise Identity and Access Management (IAM) is a way of making complex user management look simple. It help organizations with hundreds or thousands of users seamlessly manage access across multiple systems—without the headache of manual processes. In this definition, there are typically significantly fewer than a million users, but users typically have access to multiple systems and applications.

Typical enterprise identity and access management scenarios include tackle real-world challenges:

Password synchronization and self-service password reset.

Identity and access management (IAM), including identity synchronization, auto-provisioning and automatic access deactivation, self-service access requests, approvals workflow and consolidated reporting.

Enterprise single sign-on – automatically filling login prompts on client applications.

Cloud single sign-on – consolidating authentication and authorization processes across multiple cloud applications.

Don't just manage identities—transform how your organization thinks about digital access. This approach is about giving you control, improving security, and making technology work for you, not the other way around.

3 Component Project Execution Framework

For any given milestone in an identity management project, it makes sense to have a structured sequence of steps, that takes that feature or integration from conception through end user adoption. This battle-tested project execution framework ensures successful IAM implementations through three core components:

Proven project management methodology tailored to IAM initiatives
Clear milestone-based delivery approach
Realistic timelines based on extensive implementation experience

5 Key Success Factors

Commit to Long-Term Evolution Identity management is not a one-time project but a transformative journey affecting both IT operations and business processes. Plan for continuous evolution as your organization's needs grow and change.
Prioritize Business Value With IAM being a long-term investment, focus initial efforts on addressing your most pressing business challenges. This ensures immediate value delivery while building momentum for future phases.
Embrace Incremental Delivery Minimize risk and demonstrate ROI by delivering tangible results early and consistently. Each phase should bring clear, measurable benefits to your organization.
Center on User Experience Success hinges on user adoption. Since IAM directly impacts how users interact with your systems, prioritize intuitive interfaces and streamlined workflows that enhance rather than hinder productivity.
Navigate Dependencies Strategically Understanding and managing technical and operational dependencies is crucial. Our implementation framework helps identify and address these interconnections early to maintain project momentum.

Long Term Commitment On Your Identity Management Journey

Identity management isn't a one-time project—it's an evolving journey that grows with your organization. Think of it like building a living, breathing infrastructure that continuously adapts to your changing business landscape. Organizations go through both business and infrastructure changes: reorganizations, hardware upgrades, new operating systems, new applications, etc. These changes trigger matching requirements in the identity management infrastructure and consequently lead to implementation and maintenance effort over the life of the system.

Why Continuous Optimization Matters:

Business transformations happen constantly

Technology landscapes shift rapidly

Your security needs are always changing

This means that organizations like yours don't just implement identity management and walk away. You're creating a dynamic system that:

Responds to reorganizations

Supports hardware upgrades

Integrates with new applications

Evolves with your operational needs

Don't worry – we're not talking about complex, never-ending projects. Our identity management solutions can be implemented quickly and cost-effectively. But here's the exciting part: when you see the first feature in action, it sparks curiosity. Your team will start imagining new possibilities, new integrations, and ways to transform your security landscape.

Think of identity management as a living, breathing strategy – not a one-and-done project. It's a continuous journey of optimization, with a dedicated team always looking for ways to make your security smarter and more efficient.

Success starts with alignment. We work closely with your team and vendor to create a clear roadmap: defining scope, setting expectations, and ensuring everyone is committed to the vision. This upfront collaboration prevents project derailment and keeps us focused on delivering real, meaningful results.

Identity management automation can impact a wide range of stakeholders, so it is important to understand who they are and engage them early. This reduces the risk that an important decision maker learns about the project later and disrupts it because he or she was not consulted earlier.

When multiple stakeholders come together, differing opinions are inevitable. That's why strong leadership is crucial – someone who can inspire collaboration and keep the project on track, even when tough decisions challenge individual perspectives.

BEST PRACTICE: Engage all stakeholders from the project's inception and clearly articulate project deliverables, timeline and cost. Engage executive-level sponsorship to resolve conflicts between stakeholders.

Stakeholders

Stakeholder Examples	Impact
The IdM Infrastructure owner(s)	Someone must be responsible for acquiring, deploying and maintaining infrastructure such as directories, user provisioning automation, password management, single sign-on, etc.
End User Support	Impacts range from reduced password reset call volume to a need for user education, support and training for new processes.
System Administrators	Identity data will be modified on their systems. They will be asked to hand out administrator-level credentials, and may be asked to install software on their systems.
Cyber/Information Security	They will have to set policies for the new automation, as well as define policies for the management of Personal Identifiable Information (PII), as well as define how access requests should require approval.
Audit	The new automation will enforce rules regarding internal controls and also enable audits of user privileges and change history.
IT Infrastructure	Need to know about where servers will be racked (if self-hosted on physical servers, or where virtualised servers will be hosted (if self or cloud hosted), what hardware resources will be made available (Storage, RAM, Processor Speed), what bandwidth will be consumed, etc.
Human Resources	May be asked to provide a data feed from systems of record. May receive updates asking them to correct errors in their system. Are likely the first point of contact for new hires and the last point of contact for terminated users.

Identity management automation involves complex technology, and the implementation process can be intricate. It's practical to assign a dedicated technical resource who can:

Handle system deployment

Manage ongoing technical maintenance

Add new integrations

Adjust business logic

Customize user interfaces

Perform system upgrades

Troubleshoot technical issues

By dedicating a full-time expert to these responsibilities, organizations can reduce project costs, streamline implementation timelines, and maintain more consistent service levels.

The technical professional managing the implementation and maintenance of the identity management infrastructure needs a robust skill set with deep expertise across:

Operating systems

Directory services

HTML markup

At least one programming language (Python, JavaScript, C++, C#, Java)

While this professional will naturally focus on practical concerns like deployment efficiency and system maintenance, their perspective differs from security officers and architects. That's why it is recommend to take a collaborative approach: involve the business owner directly in product selection and evaluation.

BEST PRACTICE: From the project's inception, dedicate a full-time technical expert who will guide your identity management implementation. This specialist will be your strategic partner, ensuring smooth deployment and ongoing system management.

BEST PRACTICE: Don't just hand off a pre-determined solution. Engage your technical resource early in the product selection process, ensuring they're a key decision-maker who can anticipate and resolve potential implementation challenges.

Focus on Business Drivers

The business drivers for deploying an IAM system include:

Internal controls and regulatory compliance:

Reliable access deactivation when users leave the organization

Ensure that new access is granted in accordance with business need and in compliance with policy.

Enforce segregation of duties policies.

Periodically review security entitlements and eliminate any that are no longer business-appropriate.

Control access to privileged accounts and elevated privileges more generally.

Eliminate weak passwords and other credentials. – Require strong authentication wherever possible.

IT support cost:

Lower IT support call volume and help desk staffing.

Reduce the volume and cost of manual access administration.

Reduce the burden placed by auditors on system administrators.

User service:

Provision required access promptly.

Simplify access requests.

Reduce the number of passwords users must manage and enter.

Since implementing every business driver takes time, smart prioritization is key. We believe in a strategic approach that focuses on your most critical needs first. Consider these prioritization scenarios:

Reducing Help Desk Calls: If minimizing support burden is your top priority, start with password synchronization and self-service password reset. These solutions can quickly lighten your team's workload.

Addressing Security Risks: Worried about orphan and dormant accounts? Prioritize automated access termination and access certification to close potential security gaps.

Streamlining Onboarding: When rapid employee integration matters most, focus on automated user provisioning or self-service onboarding requests.

Prioritization is only half the battle. It is highly recommend to establish clear metrics for each business driver. Measure these key performance indicators before and after deployment to truly understand the impact of your identity management strategy.

BEST PRACTICE: Don't try to do everything at once. Identify and tackle your most urgent business drivers first.

BEST PRACTICE: Establish metrics to support each business driver and measure results both before and after deployment.

Sample Metrics

Driver	Sample Metrics	Measured as
Cost Reduction	HD password reset call volume	Password reset help desk calls per month (average and peak).
Cost Reduction	HD FTEs	Number of FTEs required to support peak password reset call volumes.
Cost Reduction	AD group admin workload	Group membership changes that hit the human service desk, monthly.
Cost Reduction	Admin FTEs	Number of FTEs required to support management of AD group membership.
Productivity	Employee setup authorization	Days from HR trigger to setup a new employee.
Productivity	Contractor setup authorization	Days from manager call to setup a new contractor.
Cost Reduction & Productivity	Setup time	Number of IT work hours required to setup a new user.
Security	Deactivation time	Days from HR/manager trigger to deactivate a departed user.
Cost Reduction & Security	Deactivation effort	Number of IT work hours required to terminate access for a departed user.
Security	Termination delay	On average, days from actual termination to when HR notifies IT.
Security	Weak passwords	Number of systems that do not enforce length, character set, history and dictionary rules.
Security	Standard caller authentication	Number of standardized questions asked to authenticate HD callers.
Security	Personalized caller authentication	Number of user-defined questions asked to authenticate HD callers.
Security	Standard caller auth (2)	Number of available standardized questions from which authentication process draws random questions.
Security	Personalized caller auth (2)	Number of available user-defined questions from which authentication process draws random questions.
Security	Non-expiring systems	Number of systems that currently do not enforce a password expiry policy.
Security	User password age	Enforceable maximum age of user passwords.
Security	Admin password age	Enforceable maximum age of administrator passwords.
Cost Reduction & Security	Orphan accounts	Per enterprise-wide system: number of user objects divided by the number of employees and contractors.
Cost Reduction & Security	Dormant accounts	Per system: number of accounts inactive for at least N days.
Cost Reduction & Security	Unassociated systems	Number of systems whose unique user identifiers are not mapped to a corporate-wide identifier.
Security	Admin password change interval	Per system: frequency of change of admin passwords (days).
Security	Password replication scope	Per system: number of other systems that share credentials with this one.
Security	Password sharing scope	Per system: number of IT users that know the admin credentials at any given time.
Cost Reduction & Productivity	New user request complexity	Number of different forms used to request new login IDs, on different systems, or for different locations, or for different classes of users.
Cost Reduction & Productivity	New access request complexity	Number of different forms used to request new security rights for an existing user.
Cost Reduction & Productivity	Identity change request complexity	Number of different forms used to request changes to user identity data (name, phone, address, department, location, etc.).
Cost Reduction & Productivity	Passwords per user	Average number of passwords a user must remember for corporation-owned systems.
Cost Reduction & Productivity	Login prompts per user per day	Average number of times per day that a user must sign into some corporate system.

In the table above, a “C” in the business driver column means cost reduction, “P” means user productivity and “S” means security.

Deliver Early and Often

Business needs are dynamic, and your processes evolve rapidly. A rigid, long-term project focused on a fixed set of deliverables becomes risky—not just technically, but strategically. Over extended timelines, stakeholders can lose momentum and potentially withdraw their critical support and funding. By the time you finish, the original requirements may no longer match your current business landscape.

To navigate these challenges, we recommend an agile approach: deliver tangible results early and consistently. Instead of attempting to implement everything at once, focus on releasing a minimal viable product that provides immediate value.

Given the fluid nature of business requirements and priorities, we suggest initiating your identity management project with a flexible, high-level roadmap. After every milestone or two, pause and re-evaluate your sequence of priorities. This adaptable strategy ensures your project remains aligned with your evolving business needs.

BEST PRACTICE: Aim to deliver business-relevant functionality every 3–6 months.

BEST PRACTICE: Launch your identity management project with a flexible, high-level roadmap that outlines key business priorities and milestones.

BEST PRACTICE: Pause and critically re-evaluate your project priorities after every one or two milestones.

In today's fast-moving business landscape, your processes and technical infrastructure are constantly evolving. The approach to deliver early and often recognizes this reality: capture detailed requirements and design solutions only when your implementation team is ready to begin work on a specific function. By deferring detailed design until just before implementation, we help you avoid two significant risks:

Spending time and resources on premature, potentially outdated solution designs
Implementing systems that no longer match your current business needs

This strategy isn't about delaying progress—it's about being strategically agile. We understand that what seems critical today might shift tomorrow. This method ensures your identity management solution remains responsive and aligned with your current business objectives. Identity management projects are complex journeys. By starting small and incrementally expanding your capabilities, you:

Reduce overall project risk
Ensure early return on investment
Build team confidence and expertise
Maintain flexibility as your business needs evolve
This method isn't about taking shortcuts—it's about being smart, strategic, and adaptable. You can construct a solution that grows with your organization, one thoughtful step at a time.

BEST PRACTICE: Defer detailed discovery and solution design for each phase until your team is ready to start implementing that specific phase.

BEST PRACTICE: Begin your identity management project with small, simple deliverables. Gradually build complexity as your team gains expertise and confidence.

Usability and Adoption to Drive Success Through User Engagement

An identity management system's core function is managing user data—identity attributes, authentication factors, and security privileges. Inevitably, these systems must interact directly with users to manage passwords, confirm and update identity attributes, request and approve privilege changes, and audit user data.

The business value of your identity management system critically depends on user adoption. Consider these scenarios:

A self-service password reset system only generates support cost savings if users actively use it instead of calling the help desk
A user provisioning system can only reduce security administrator workload if users submit security change requests through its workflow interface, rather than contacting administrators directly

To drive successful adoption, your identity management deployment team must strategically engage your user community.

BEST PRACTICE: Design your deployment plan to include:

Comprehensive user acceptance testing

Targeted pilot tests

Strategic user awareness programs thorough user education initiatives.

Don't just implement technology—create experiences that make security intuitive and seamless for your entire organization.

When driving user adoption for your identity management system, focus on more than just technical functionality. Create an engaging program that validates usability, builds awareness, and ensures users intuitively understand how to interact with the system.

An adoption strategy weaves together strategic incentives and thoughtful approaches to encourage system use. Educate users about the ease of synchronized passwords, simplified sign-on processes, and offer enticing rewards like prize draws or gift certificates. On the flip side, also implement measured disincentives such as reduced personalized help desk support or potential charge-backs for manual interventions.

BEST PRACTICE: Develop a comprehensive adoption strategy that touches every user-facing component of your identity management system.

When designing a usable system, think of it as a "one-stop shop". Imagine a world where users can complete tasks—like requesting a new login ID—through a single, intuitive interface, without navigating a maze of complex systems.

Not every integration makes sense. A pragmatic approach involves strategically deploying integrations, creating a unified change request interface, automating relevant processes, and intelligently routing complex changes to system administrators. This isn't about building a system; it's about crafting a solution that genuinely works for your organization.

Some applications may have too few users to justify extensive integration efforts. A system with just 20 users might not warrant integration work. So take a smart, flexible approach—automating what makes sense while providing a streamlined, user-friendly experience. It makes sense to provide users with a single change request user interface, to automate whatever actions possible, and to forward the remaining types of changes to human system administrators.

By focusing on user needs and organizational efficiency, you can transform identity management from a technical necessity into a strategic advantage.

BEST PRACTICE: Create a consolidated change request interface that intelligently routes changes, identifying the right people to handle tasks that can't be automated.

User communication is a delicate balance. We understand that system changes need to be communicated, but bombarding users with notifications can backfire. Too many emails quickly become background noise that users learn to ignore, ultimately undermining your user adoption efforts.

Take an approach that is strategic and user-centric. Instead of overwhelming users with frequent, fragmented updates, we recommend grouping system integrations into meaningful, periodic communications. For instance, a quarterly email summarizing five new integrated systems provides more value and maintains user engagement compared to weekly notifications about minor changes like a new directory organizational unit.

This approach serves two critical purposes: it keeps users informed without creating notification fatigue, and it ensures that each communication feels significant and worthy of attention. We're not just sharing information; we're creating meaningful touchpoints that reinforce the value of the identity management system.

By being thoughtful about how and when we communicate changes, we transform routine updates into opportunities to demonstrate the system's ongoing improvement and strategic importance.

BEST PRACTICE: Streamline your integration process by implementing multiple target systems together, reducing individual project milestones and minimizing disruption to your users.

When implementing identity management solutions, group multiple target systems together instead of treating each as a separate project milestone. Think of it like assembling a complex puzzle—strategically combine multiple pieces for a more comprehensive and less disruptive implementation.

Breaking down your project into weekly or monthly deliverables can overwhelm users and dilute the strategic value of your identity management transformation. Aim for broader project milestones every 3 to 6 months. By consolidating integrations and communications, you'll maintain user engagement and showcase the strategic impact of your initiative.

Critical Path and Common Interdependencies

When you're deploying an identity management system, some tasks are like dominos - they can't fall until others are set up first. These interdependencies can create bottlenecks that delay your high-priority deliverables, even when the prerequisite tasks might seem less critical at first glance.

Let's walk through crucial early-stage implementation tasks that lay the groundwork for your entire identity management strategy:

1. Integrate Profile ID Sources

Every user needs a unique, global identifier - think of it as their digital passport. These identifiers typically come from existing systems like Active Directory, email platforms, or HR data feeds. Integrating these profile ID sources isn't just a preliminary step - it's the foundation that supports all subsequent integrations.

2. Reconcile Login IDs

Most users have digital footprints across multiple systems. The core function of an identity management system is to bring order to this complexity. Before you can effectively manage user objects, you need to connect them - reconciling login IDs across different systems and linking them to global profile IDs.

This login ID reconciliation is a critical prerequisite for key functions like:

Password synchronization
Password reset
User deprovisioning
Access certification

By tackling these interdependencies early, we help you create a streamlined, efficient identity management ecosystem that works seamlessly across your organization.

3. Email Integration

An identity management system needs to communicate with users - sometimes to notify them of events or request specific actions. Users might receive emails about:

Completing a personal challenge/response profile
Alerts about failed login attempts
Requests from authorizers to approve security changes

Email integration is typically one of the first steps in deploying an identity management system. We understand that communication should be clear, timely, and purposeful - keeping you informed without overwhelming you.

4. Construct an Org-Chart

An identity management system thrives on understanding organizational relationships. It helps you map users to their direct managers, creating a powerful framework for several critical security processes:

Authorization When security changes need approval, workflows will ensure the right managers are in the loop with subordinates' access modifications going directly to managers for review.
Escalation If an authorizer isn't responding to change requests, they can be automatically routed to their manager as an escalated authorizer. No more bottlenecks or security gaps.
Certification Enable managers to periodically review their team's security rights. You'll quickly identify and remove any inappropriate access, keeping your organization's security tight and transparent.

Building a reliable organizational chart isn't just a project deliverable - it's a strategic approach to maintaining robust, intelligent access controls. Don't just map relationships; transform how you manage organizational security.

Authorization Workflow

Identity management systems ensure that every critical change goes through a robust authorization process. Whether you're creating new user accounts, deactivating existing users, adjusting security group memberships, or updating identity attributes, a defined framework that keeps your systems secure and your processes streamlined.

The authentication mechanism remains consistent across different change types - the only variable is who gets to approve or reject these changes. We understand that your business processes - from user onboarding and deactivation to access certification and privilege management - rely on a rock-solid authorization approach.

That's why we recommend implementing a comprehensive change approval framework early on. By doing so, you'll create a flexible, interconnected system that gives you control without complexity. We don't just manage identities; we empower your organization to make informed, secure decisions with confidence.

Project Management Methodology

An effective methodology for delivering IDM functions follows:

Project Startup

Identify the business driver and required integrations.
Engage the stake-holders.

Business Analysis

Identify core business drivers and project priorities.
Analyze existing business processes and policies, capturing at least their inputs, purpose and outputs.
Capture requirements for new / desired business processes.

Technical Discovery

Identify all systems, applications and security databases that contain identities that will be managed.

Capture details for every system that will be integrated.

Map the flow of data attributes from source systems and stake-holders to a consolidated meta directory and from there back to target systems and other human participants.

Solution Design

Identify key metrics and record pre-implementation values. ii. Design a logical and physical architecture for the new system.

Map policies, such as login ID assignment and authorizer routing, to decision logic. iv. Develop a user adoption strategy and plan.

Finalize all integration details.

Get sign-off from all stake-holders.

Project Planning

Document and get sign off on a project plan.

Solution Delivery

Implement the solution design on development servers.

Unit test each function / component.

Stress test as required.

Carry out user acceptance testing.

Apply feedback from unit, stress and usability testing to the implementation. Repeat until results are acceptable.

Deployment

Migrate the solution from development to production.

Carry out pilot tests with early adopter user communities.

Apply feedback from pilot tests to the implementation. Repeat until results are acceptable.

Update deployment and user adoption plans.

Roll out to remaining users.

Training and User Adoption

Advertise the solution.

Develop and publish CBT materials.

Implement user awareness communication, education programs, incentives and disincentives to drive user adoption.

Carry out an impact analysis to gauge results on cost, security and user service.

Post Deployment

Monitor and report on system usage and user adoption.

Report on post-deployment metrics to project sponsors.

Periodically produce an impact report illustrating the change in metrics created by the system and estimating the business impact of this change.

Typical Timeline and Deliverables

Implementing an identity management solution isn't a one-size-fits-all process. Each organization has unique challenges, infrastructure, and goals. However, we've developed a flexible framework that guides you through the most critical stages of your identity management journey.

Month	Phase	Deliverables
14–16	Automated access termination	Implement technical access termination processes on core systems Automate mapping from authoritative data feeds to access termination on target systems
17–19	Automated onboarding	Implement default access setup for new users on core systems Automate mapping from authoritative data feeds to new user setup on target systems
20	Reprioritize	Refresh business priorities. Design and plan for the next set of milestones.
20–22	Self-service identity update workflow	Push updates to personal identity data to end users Advertise and educate users about this infrastructure
23–25	Access certification	Engage managers to periodically review their subordinates and identify inappropriate security rights Clean up orphan, dormant accounts and stale privileges
26	Reprioritize	Refresh business priorities Design and plan for the next set of milestones

Month	Phase	Deliverables
27–28	Enterprise single sign-on	Deploy SSO software to user workstations. Reduce frequency with which users are presented with login prompts.
29–30	Mobile user support	• Enable self-service password reset for mobile, disconnected users.
31–33	New target systems	Add 10 non-core target systems Add 100 implementer-style target systems
34	Application-centric certification	• Engage application and group owners to periodically certify user privileges within their scope of authority

Benefits of a Strategic Identity and Access Management Approach

More Than a Project, a Partnership

Your identity management journey isn't a short-term fix—it's a strategic transformation. By ensuring all stakeholders are invested and engaged over several years, you:

Create a sustainable solution that evolves with your business

Build a comprehensive approach that meets your organization's long-term needs

Maintain ongoing collaboration and continuous improvement

Driving Business Value from the Start

Don't just implement technology; solve real business challenges. By focusing on your critical organizational needs early in the project, you will:

Deliver immediate, tangible value

Increase stakeholder confidence and buy-in

Ensure even a partially completed system provides significant organizational benefit

Adaptive Delivery for Smaller Wins, Bigger Impact

An adaptive approach breaks down complex projects into strategic, manageable deliverables:

Faster time to value

Enhanced ability to respond to changing requirements

Improved engineering quality through frequent testing

Transparent progress tracking

Reduced implementation risk

User-Centric Implementation

Your users aren't an afterthought—they're the primary consideration:

Engage your user community throughout development

Conduct rigorous usability testing

Create awareness programs that drive adoption

Simplify access management for administrators and end-users

Reduce service desk workload through intuitive design

Strategic Planning for Navigating Complex Interdependencies

Meticulously map out your project's critical path ensuring:

Prerequisite deliverables are identified and sequenced

Potential roadblocks are anticipated and mitigated
A holistic, interconnected implementation strategy