Lessons Learnt Rolling Out a B2B CIAM Program

Good morning everyone. This is my pleasure to be here one more year. So let's go. So I'm going to to speak today about our customer identity and program in quine. In our a agenda we have four main items. For one is to explain a little bit who we are.

Second, I will explain you the drivers and the requirements in our CM program in order to contextualize it a little bit just after I will go with the solution design and at the end we will cover the lesson learned part. So my idea is to not be too much at high level, to be as specific with some of the items that I'm going to share because one of the target for me today is that you guys will be able to, to get some takeaways and you will be able maybe to learn something about the problem that we had faces in the past. So who we are, Hal is the largest constitution material.

So we are circa 70,000 people working in worldwide in many countries around the world. We have always been producing cement, red, miss aggregates, and nowadays moving a little bit more in, in solutions to make the city screener and to be a much more sustainable company. So in Terra we have three digital center, one in America, Saudi another in, I'm managing the pi. So not too much to explain here, just a quick summary. So let's go with the driver. So which was our driver number one in order to implement a CM program in cost material company. So the third one it dis of you.

So we have multiple user link it with the same person. So each application has their own user database, no consolidation, no central management, nothing. So it was our starting point. Second driver use as well related with data privacy management. So we are subject to the gdpr. We are subject to other regulation in other countries, mainly in usa things like this. So it is obvious that nowaday it is important to adapt to the regulation and there is important penalties if you do not do so. What else? Maybe it is something different, something that you have not here too much.

It is something happening in our company, most likely in some of you as well. We have our internal employees sometimes accessing to the application that we are providing to business partner and it is happening for tourism. We have employees which are customer as well and in some cases we have people in sales marketing and this kind of department who need to be a able to access to the customer application in order to guide them to explain how the process were so on and so forth. And the last driver well is mainly related to the availability.

So something that our management is insisting us too much is that the solution for business partners has to be available 24 7. So there is no room for downtime. So there is no room for a scale maintenance because at the end you are losing, you are losing business and well if you have mainframes behind, if you have a bit more legacy infrastructure, you are more subject to to have downtime. It is crystal clear. So requirements. So once we have been able to understand the driver of the program, the obviousness is to define the requirements in order to select the product. So nothing fancy here.

So at the end one of our first requirements is unified the identity. Second is single sign on something more or less common in all the CM programs. User self service manage, give the user the opportunity to register themselves to have progress in profiling and and this kind of thing. Consent management abuse nowadays reporting and somehow business analytics on this regard and and user management such as lifecycle automation and this kind of stuff.

And last but not least, MFA software logging not that much but something that we included just in case because software logging is not so awfully use it in in b2b. Okay? So once we have understand the the requirement once we have understand the driver and the minus thing before go to the less or less is to serve with you the solution design. So this is the solution design that I did together with my team. I have preferred to put here what we this. So as you can see we have the sea and plot for in the middle. So it is a lot of APIs behind that.

Consume it by different interface in the topless corner you have or you can see the application. So we have application which are connected different using different approach. Could be out still sunnel script set integrated in the application APIs directly for login. This kind of start on the other side in red, in the top right corner we have our user management. So it is connecting through APIs with the platform as well. And and we are also using an integration layer because we have some middleware where we still need to manage the user.

So basically what we are doing in some cases is leveraging wet hook in order to have an integration between CM platform integration layer and q the we, the wet hook to take the in the backend system that we may have there and large but not least we have some surrounding tools which are also necessary. We have monitoring tools, we have reporting tool to tell a little bit more the reporting that the CM platform is providing itself.

And we have connected the CNA data platform which are based nowadays in different products because as I have commented before, we have internal employees who need to access to the application for customers. So we manage the life cycle process with the automatically if they leave the company and and this kind of thing. So solution design, it is ready. So let's go to my last part of the presentation, which I fully convinced that it will be the much more interesting for you.

And this is regarding to the lessons ladies, when I'm going to explain what we have learned doing this program, doing this kind of thing. So when I was preparing this presentation, the first question that I ask to myself is why not request guidance from the expert and who's the expert nowadays? Tino? So you can ask G, what are the less layer rolling out as so you see? So let's see what G is answering. So I am highlighting in red because it is too much test. Another white will be different and or difficult to manage. And the third thing is understood the need of your customer.

Okay, it is obvious but it makes sense. Second one, ensure security and compliance regulation. This provide less user experience. So something that many CM vendor has been emphasizing in order to retain the customer, to gain new customer, it is important to guarantee that the user experience is as best as possible. So is not that bad.

So, so, so far so good. What else is telling us maintain the data today? Well it is true for the si, it is true for the so well as well communicate effectively with this important not only in si I will say it's a little bit more than it is but well it is something that make sense a continually monitor and improve. Okay? So this is what GBT is providing. So you could take an idea and now what I'm going to do is to serve with all of you the four main lesson that I learned together to my team when we were rolling out this project.

Okay, just four because at the end there is 20 minutes and it is important to go to to the critical points and, and I would also like to demonstrate not just to explain but to demonstrate a little bit how we are addressing them. So first thing, configuration and platform to cover B2B scenarios. It's much more complex than B2C and I will explain why. So just after I will explain why it is not only necessary to be able to authenticate the user, to provide them with cell registration capability, progressing, profiling out this kind of stuff.

It is also necessary to being able to have a link between the master data that you have in the E r P system or whatever and the data that you may have in your digital application. And most likely you will need to use this data in the authentication and authorization process. Mainly authorization. What else?

The master data most likely will be used in authorization process, at least in a, in a building material company where we have quite important of digital application even it is not the business much more related with the technology but nowadays you know, everything is digital so most likely this master data will be necessary to be used in one way or another. The delegated admin should have the required permission so the user management interface should be able to support it. And I'm going to explain what kind of admin we have and you will have something similar.

And last but not less take care of the monitoring capabilities. So let us expand a little bit more on this for ideas or in this form lesser that willer when we roll it out the program. So here you have a comparion, it is, well it is something that you can find in, in, in internet in many other place. But this simple slide could somehow realize that B2B and B2C is not exactly the same. So for example, one of the important topic is the price. So for example in B2C it used to be a Pfizer price.

In the B2B is a price with the commercial areas on how adjust independent of the customer, which is very more and you have to be able to update in the platform that are using it. In the b2c it is also a bit more expected to be able to leverage social login and this kind of style not so common on b2b but on the other side in B2B it is expected that the people in the, in the business partner who are consuming your application will be able to manage their own user.

So if we have a company where we have 100 user for example in different store, it is normal to have two or three people within this company managing the user just for this company because they know much better than other if this person are still in the company or if they have moved to different things. Well customer relation, it is another topic which is different. So in B2B is maybe much more long term in b2c, not always is long term. So depend or barrier a little bit. So this is one thing that I understand.

It is something that we learned from the very beginning and and something what I hope you will take in consideration if you are in in similar case. Next thing, master data, as I mentioned before, most likely will be used in the authorization process. And if it will be used in the authorization pro process, you will need to identify how to make it available in your CM program. So it has to be always had today or have to be consumed online. So you have to be able to go to the ERP for example and see if the user has credit or not to place the order.

And if you have a new plan, link it to the customer, you will be, you have to be able to create order for this plan or if you have a new sales organization or distribution channel or division or whatever. So I'm going to explain you guys just in a quick video how we are doing it. So if you could play please. So as you can see here, this is our CN user management. So here we are creating a user. In this case we are selecting the, the company code. Based in the company code we are able to search all the business partner, all the organization that we have in our E R p.

In the right side you could see that we are doing API calls in order to fit this data directly from the E R P and once the data is there. So we are calling a number of APIs in order to create the user in in our CM platform. So it has been executed, it has been created, the user ready, so the user has been created. So I can see here the email. And the next thing that I'm going to do is just execute an authentication.

So this user is authenticating, is logging and as you can see here, I'm getting the organization name and I'm also getting company called sales organization distribution channel division, the c2 where we are able to deliver the material. And this is information that it is coming in, in the G in the reply that the user is getting at authenticate and information that our digital application are using in order to define what the user can see and what the user cannot see.

Okay, so next thing is related to the delegated administrator. I say before the user management or whatever you will use has to been enable to adapt to all the administrator type that you may have, okay? In our case we have four type of administrator. The third one is the full admin, is the CNN admin there. And they have not restriction in terms of the application that they can manage in terms of ACOP and in terms of business partners. So this is the, the higher level, the second level is the application admin. So they are restricted based on the application that they can manage.

So if you are the application admin for the digital application E you could do everything but only for the application. E, no, you will not be able to do thing for other application. But in the application B, you will be able to manage all the user, all the business partner and this stuff. The first level of admin that we have is the delegated admin. The delegated admin at dni, one of the person in commercial team or whatever in one of the countries where we are operating. So they are restricted based in a scope and they are restricted also based in the application.

So if I a sales guy who is managing the business in South Africa, most likely I will need, I will not need to manage the user or the business partner in Germany. At least this is the case in our company, we, we need to ensure this kind of of delegation on this business which are highly linked to the country. And then last one is the business partner admin. This is what I mentioned it before. So the customers has to been able to manage the account by themselves so they know much better than other who is still in the company and who live.

So my last thing is related to the monitoring capabilities. I have one last video explaining how we are doing the, the monitoring. If you can play please.

So as, as you can see, as you can see here, not sure if it is play. Yeah it is. Here we have all the APIs in points that we are consuming. So we can see the number of events. We also have the user key which allow us to identify the applica, the user invoking the APIs. We have the API keys related to the application.

We can easily see trends, intel events, intel, the what happened and, and basically what we are doing here is reading all the answer that we are getting in bulk into the IPIs collecting this data and including on, on, on some dashboard where we also have the possibility to search and and to see if we want to see more detail for for any, for any of the event. So this is all on my side, just on time. Also if there is time for question or not just in case I have list here a QR with my link again just in case any of you want to make me any additional question and whatever.

So happy to help if I can. Thanks very much Samuel. Just one quick question that we have on here. It looks like you could say the difference between B2B and B2C is that B2B is a lot more about relations and that B2C is a lot more about transactions. Would you agree that that this is your experience?

It is, it is definitely. So B2B is long-term relations is much more about relation. It is something that you are building with the time and that you are leveraging. So you need to offer the services in a slightly different manner. And B2C used to be more punal so the customer needs something go to the place where it is and consuming and so definitely. Well that's great. Thank you so much Phil. Perspective Samuel.