Modernizing Identity Governance for a Multi-Cloud Technology Services Company

Overview

Ask a growing company who has access to what and you get a pause, then a spreadsheet, then a caveat about the spreadsheet.

That was the state of it here. Three cloud platforms, more than twenty enterprise SaaS applications, a workforce across two countries, and no single place that could answer the question. Access had been granted correctly, one request at a time, for years. What nobody had was the whole picture — and without the whole picture, you cannot certify access, cannot prove least privilege to an auditor, and cannot tell which of your licensed seats belong to people who left in March.

The company was already solving this, or believed it was. Engineers had been building an internal account reconciliation tool for a long stretch. It was well intentioned and it was not going to get there.

I stopped it. Then I ran the evaluation, made the business case, and led the implementation of CyberArk Identity Governance and Administration across the estate.

Organization

A global technology consulting and managed services provider, more than 200 employees across the United States and India. The infrastructure runs on Amazon Web Services, Microsoft Azure, and Google Cloud Platform at the same time — not a migration in progress, three production clouds.

On top of that sits the application estate that a modern consultancy accumulates: Microsoft 365, Google Workspace, Salesforce, SentinelOne, Paylocity, Jira, Slack, Zoom, HubSpot, FreeIPA, and a long tail of other commercial services.

Every one of those is a place a person can have access. Every one keeps its own list. The lists disagree.

Challenge

The cloud investment had been serious. Identity governance had not kept pace with it.

Provisioning, entitlement visibility, and access review were spread across dozens of systems with nothing joining them up. There was no governance model for identity across cloud and SaaS, and no automated certification process at all — which means that in practice access was reviewed when somebody remembered, or when an auditor asked.

That produced a familiar set of problems:

• Fragmented visibility into identities and entitlements.
• Inconsistent access controls between cloud platforms and SaaS applications.
• No standard access review or certification process.
• Audit preparation done by hand, every time.
• Orphaned accounts and accumulated privilege that nobody was watching for.
• Licensing costs for inactive accounts and unused subscriptions, paid quietly, month after month.

Underneath all of it sat the in-house build. Engineering effort was going into reinventing identity correlation — one of the hardest and most thoroughly solved problems in enterprise security — while the actual governance gap stayed open.

What the company needed was a governance capability that would hold as the estate kept growing: one source of truth for who has access to what, certifications that run whether or not anybody remembers, least privilege enforced by policy rather than by good intentions, and audits that take hours instead of weeks.

Strategy and Vendor Evaluation

My first job was the uncomfortable one: recommending that a long-running internal project be shut down.

I looked at where it had got to, what it would take to finish, and what it would cost to maintain once finished. The conclusion was not close. Identity correlation, entitlement mapping, certification workflow, and audit reporting are four hard problems, and the market has spent years refining all four. Building them in-house meant funding that refinement again, alone, forever.

Making that argument stick required framing it as a business decision rather than a technical opinion. Not “the tool is wrong” — that invites a debate about the tool. Instead: here is the security exposure while this remains unfinished, here is the audit effort it does not remove, here is the engineering time it consumes every quarter, and here is what a purpose-built platform costs against all three.

With approval to change direction, I evaluated the IGA market against:

• Multi-cloud compatibility.
• SaaS integration coverage.
• Identity correlation and entitlement management.
• Access certification functionality.
• Scalability.
• Administrative overhead.
• Long-term operational value.

CyberArk Identity Governance and Administration was the strongest fit for the estate we actually had and the governance model we wanted to run.

Implementation

I led the rollout across the cloud infrastructure and the application estate.

Identity and entitlement data came in from AWS, Azure, Google Cloud Platform, Microsoft 365, Google Workspace, Salesforce, SentinelOne, Paylocity, Slack, Zoom, FreeIPA, and the rest of the SaaS portfolio. Where a native integration existed, I used it. Where one did not, I built the connector and the normalization that made the data match everything else — which is the unglamorous majority of an IGA project, and the part that decides whether the platform tells the truth.

What the estate gained:

• Centralized identity visibility across cloud and SaaS.
• Automated onboarding of identities and entitlements.
• Policy-driven governance controls.
• Role-based access models enforcing least privilege.
• Automated quarterly access certification campaigns.
• Detection and remediation of orphaned accounts.
• Centralized reporting for audit and compliance.

One source of truth for access, and the end of reconciling dozens of independent systems by hand.

Results

The question that used to get a spreadsheet and a caveat now gets one answer.

• Identity governance centralized across AWS, Azure, GCP, and more than 20 enterprise SaaS platforms.
• Quarterly access certification campaigns running automatically, replacing reviews that were manual or simply absent.
• Clear visibility into entitlements and policy compliance.
• Least privilege enforced through role-based governance rather than case-by-case judgment.
• Audit preparation shortened by centralized reporting and access records.
• More than $30,000 a year in licensing recovered from inactive accounts and unused subscriptions.
• Engineering time returned from maintaining a build to running a platform.

The technical work was the second-hardest part. The hardest was arguing that a project the company had already invested in should be stopped, and being right about it in a way that people could check.

That meant identifying an operational risk before it produced an incident, challenging an existing engineering strategy without making it personal, building executive consensus around a different direction, running the evaluation, and then delivering the thing I had promised. Security, operations, compliance, and cost all had to point the same way — and once they did, identity governance stopped sounding like a security project and started sounding like a business capability, which is what it is.

Key Technologies

• CyberArk Identity Governance and Administration (IGA)
• Amazon Web Services (AWS)
• Microsoft Azure
• Google Cloud Platform (GCP)
• Microsoft 365
• Google Workspace
• Salesforce
• SentinelOne
• Paylocity
• Slack
• Zoom
• Jira
• HubSpot
• FreeIPA
• Identity and Access Management (IAM)
• Role-Based Access Control (RBAC)
• Access Certification
• Identity Lifecycle Management
• Least Privilege

Lessons Learned

Identity governance is infrastructure, not a security initiative. Treat it as an initiative and it gets funded once, done once, and left to rot; treat it as infrastructure and it gets maintained like the network.

The harder lesson is about build versus buy, and about sunk cost. Custom development is the right answer for problems nobody else has. Identity correlation is not one of those problems — it is a problem thousands of organizations have, which is why mature platforms exist and why their edge cases have already been found by somebody else. The engineering time spent rediscovering those edge cases is the real cost of the in-house option, and it never appears in the comparison unless you put it there.

And nothing moves without the business case. Framed as risk reduction, less audit effort, and recovered licensing spend, this was an easy decision. Framed as a security team’s preference for a different tool, it would still be a debate.