Engineering Successful IAM Projects to Support Digital Business

IAM initiatives often stall or underdeliver because Identity & Access Management is inherently complex, cross-divisional, and touches nearly every person and system in an organization. It must interface with IT security, HR, infrastructure, SAP or other business applications, procurement, and countless application owners, while also shaping everyday experiences such as authentication, access approvals, and managers’ access reviews. IAM’s scope has expanded beyond workforce needs to include partners, customers, consumers, and non-human identities (services, robots, devices), making it a foundational capability for secure digital business.

Success requires disciplined execution across ten intertwined practices. First, thorough requirements analysis must look beyond current pain points to future organizational change, market trends, SaaS evolution, and regulatory shifts—often requiring external input—and then translate into a structured, prioritized requirements set with very few “must” items and a clear out-of-scope definition. Second, stakeholder and expectation management must avoid overpromising by mapping all stakeholders early, communicating realistically, and defining both early quick wins and major big wins. Third, broad buy-in is earned through dialogue and listening, not broadcasting, and helps projects withstand inevitable turbulence.

Operationally, IAM projects must transition cleanly into a strong line organization, ideally a dedicated IAM department at eye-level with other IT functions, responsible for operations, governance, business interfacing, and ongoing evolution. External experts are necessary, but organizations must retain flexibility by transferring product and service skills in-house to avoid vendor or integrator dependency. Programs should start with a vision and blueprint—supported by policies, guidelines, and processes—rather than selecting tools prematurely. Because IAM continuously evolves, strong change management, regular plan updates, and future-proof, modular architectures are essential. Finally, focus and pragmatism matter: keep IAM scoped to IAM, run programs as a sequence of small deliverable projects, and secure stable, long-term budget to “think IAM big enough” for the organization’s digital journey.

• IAM interfaces with IT security, HR, IT infrastructure, SAP or business applications, and application owners across the organization.
• IAM affects everyday activities such as authentication, access request approvals, and managers’ reviews and recertification of entitlements.
• IAM scope includes identities of business partners, customers, and consumers.
• IAM scope includes non-human identities such as services, software robots, devices, and things.
• Requirements prioritization should use very few “must” criteria.
• Many IAM projects run for more than a year, and some take up to three years or more.
• Recertification is perceived as challenging and cumbersome by virtually all organizations globally.
• Role management projects tend to stall.
• Modern IAM architecture is described as modular, API-based, and designed to isolate customizations from vendor code.
• A final recommendation calls for sufficient, stable budget not only for individual projects but for longer-term program planning.

• “The time taken for planning and for gathering requirements always pays off in the project, by less trouble, less failure, and less delays.”
• “It's not only about the Quick Wins. Also define the Big Wins you want to achieve.”
• “IAM projects are complex. Buy-in of all stakeholders will help in weathering the storms that will come sooner or later in the project.”
• “Ensure that an IAM organization is in place – at eye-level with other IT departments, and sufficiently staffed.”
• “There always must be a good set of skills on the products and services in place in an organization.”
• “You don't build a house without an architect and a plan. Why should you run your IAM projects without architecture and plan, though?”
• “IAM projects will cause change in the way people work. Have a strong change management in place.”
• “Understand what is in-scope for IAM and what not - and work with the other departments on agreements about responsibilities, processes, and interfaces.”
• “Many IAM projects run long. Plan for being modern when the project is delivered, not for being already outdated when it starts.”
• “For a small project, quick wins are easier to define and big wins of the overall project are faster and easier to achieve.”