Securing access across a global workforce

The starting point

Identity ran through Google Workspace. There was no single sign-on, and each of the 45 applications managed its own access. New starters had their accounts built by hand. When someone left, their access stayed live until the right person remembered to remove it.

Nobody had a reliable picture of who held access to what.

The risk

Former employees could stay active in production apps, and there was no audit trail across the estate. Acquisition talks were already under way, so this was a due diligence risk as well as a security one.

What we built

We deployed Okta with Terraform and mapped it into the existing Google Workspace organisational units, so the directory stayed intact and nothing had to migrate. We onboarded each of the 45 applications one at a time, documenting and governing its permissions as it came in.

We then connected HiBob as the HR source of truth. New starters, role changes and departures flow straight through to access and app entitlements. That removed the tickets, the manual handoffs and the gap between someone leaving and their access being revoked.

In the same engagement we rolled out Iru to the Mac fleet and tied it to Okta, so a Mac is checked before it signs in. That rollout has its own case study.

The result

After three weeks of engineering, the access lifecycle runs on its own. HR makes a change in HiBob and access follows, granted on arrival and removed on departure. The queue of access requests cleared, and the IT team spends that time on project work.