Talent · Identity Security

Identity Security migration:
43,000 identities, zero gaps.

A financial-services firm had run SailPoint IdentityIQ on-premise for years, with around 43,000 identities and a connector estate that had grown with it. Incipient placed senior identity-governance capability that re-engineered the environment for a cloud-native model and moved it to Identity Security Cloud with zero provisioning gaps.

43,000
Identities migrated and validated
0
Provisioning gaps across a 12-hour cutover
21 → 6
Days to complete a certification campaign
SAILPOINT · IIQ TO IDENTITY SECURITY CLOUDBEFOREAFTERAccess certification campaign21 days6 daysMajor upgrade events per year40Open audit findings140Bars to scale within each row. Roughly 1,100 admin hours a year reclaimed.
Before and after on the metrics the identity team reported: certification time, upgrade events and audit findings.
Industry
Financial services
Focus
Identity and access
Model
Embedded IAM
Stack
SailPoint ISC
Read moreRead less
The Challenge

On-prem identity, four upgrade events a year.

The on-prem estate cost real money to maintain and made every upgrade an event, with four major ones a year. The firm wanted to move to Identity Security Cloud, but the connectors, custom workflows and certification processes were all tied to on-prem infrastructure.

It needed a partner to re-engineer them for a cloud-native model rather than recreate the constraints, and to do it without a single provisioning gap, because in an identity estate a gap is a security incident, not a delay.

  • 1Four upgrade events a yearEvery major upgrade on the on-prem estate was an event.
  • 2Connectors tied to on-prem214 connectors across 186 sources and applications depended on on-prem infrastructure.
  • 3Custom workflows168 custom workflows were built around the on-prem design.
  • 4A gap is an incidentAny provisioning or de-provisioning gap would be a security incident.
  • 5Slow certificationA certification campaign took 21 days, with 14 audit findings open.
What We Did

Re-engineered, not lifted and shifted.

Incipient placed senior identity-governance capability to lead the migration from on-premise SailPoint IdentityIQ to SailPoint Identity Security Cloud, rebuilding the pieces that were tied to on-prem rather than carrying them across.

  • Re-mapped 186 sources and applications across 214 connectors to cloud-native SaaS capability
  • Re-engineered 168 custom workflows and 22 certification campaigns rather than carrying the on-prem design across
  • Validated the migration of 43,000 identities with roles, entitlements and access history intact
  • Maintained provisioning and de-provisioning continuity through a 12-hour cutover with zero gaps
  • Strengthened audit readiness through cloud-native reporting and certification
SAILPOINT · ON-PREM TO CLOUD-NATIVERe-map186 sourcesRe-engineer168 workflowsValidate43,000 IDsCut over12 hoursCertify21 → 6 days214linksrebuiltfor cloudroles +accesscloud-nativethroughoutNo gapsde-provisioningBEFORE4 upgrade events a year · connectors tied to on-prem · 21-day certificationAFTER0 upgrade events · 0 provisioning gaps · 6-day certification
How the migration ran: connectors and workflows were rebuilt for the cloud rather than lifted, identities were validated with access history intact, and the cutover held provisioning continuity. Orange marks the rebuilt and cutover steps.
The Outcome

Cloud-native identity, no gaps, faster certs.

All 43,000 identities were migrated and validated with zero provisioning or de-provisioning gaps through the cutover.

Four annual upgrade events were eliminated, which reclaimed roughly 1,100 admin hours a year. The access-certification campaign dropped from 21 days to 6, and 14 open audit findings were closed.

43,000
Identities migrated and validated
0
Provisioning gaps across a 12-hour cutover
21 → 6
Days to complete a certification campaign
Verified Reference
"They refused to lift and shift. They rebuilt 168 workflows properly instead, and the certification numbers are why: 21 days down to 6. That only happens if somebody redesigns rather than migrates."
Director, Identity and Access Management · Financial services
Clutch verified reference →
Moving identity to the cloud without a gap?
Tell us what's holding you back, and we'll show you what it's costing you and fix it.