The challenge
Customer sign-in that did not belong in the staff directory
The client is a Canadian manufacturer with multiple customer-facing applications used by external customers. Those users are not employees. Putting them in the corporate directory next to staff would mix two very different groups of people, with different risks, different lifecycles, and different rules for who gets in.
The platform had to be designed for thousands of external customer users. It needed one sign-in across the applications, accounts that appear when the business creates them rather than through a ticket queue, and security controls that fit a customer audience rather than a workforce.
Our approach
BITSUMMIT designed and delivered a customer identity (CIAM) platform on Microsoft Entra External ID through a planned phased delivery: design, build and security hardening, integration, and knowledge transfer.
A separate tenant for customer identities
The design placed external customer users in a separate, dedicated External ID tenant, kept apart from the corporate directory. Staff and customers would not share a directory, administrator roles, or sign-in policies.
One sign-in across multiple applications
Single sign-on was designed across multiple customer-facing applications using OAuth 2.0 and OpenID Connect, so each customer user would have one identity instead of a separate account in every application.
Accounts that follow the business
Account provisioning was designed to be automated and application-driven, so accounts created in business applications appear in the identity platform without manual steps. Self-service password reset was part of the design, so a forgotten password does not have to become a support call.
Security controls sized to the audience
The design set MFA and conditional access. The design kept access invitation-only instead of open self-registration. Audit logging to Log Analytics was part of the design, so the client's team would have a record of sign-ins and changes.
Handover to the client's IT team
At closeout, the client's IT team received administrator training and knowledge transfer, and the engagement closed with a handover to that team.
The outcome
- A dedicated customer identity tenant. External customer users were designed to sit in a separate External ID tenant, apart from the corporate directory.
- One identity across applications, by design. Single sign-on was designed across multiple customer-facing applications on OAuth 2.0 and OpenID Connect.
- Provisioning without manual steps. Automated, application-driven account provisioning was part of the design.
- Security designed for a customer audience. MFA, conditional access, invitation-only access, and audit logging to Log Analytics.
- A completed engagement and a trained team. The engagement was completed, with administrator training, knowledge transfer, and a handover to the client's IT team at closeout.
Customer identity is easy to bolt onto a staff directory and hard to pull out of it later. This design kept customers and staff apart from the start.
For more on how BITSUMMIT approaches identity, see how we automated dealer identity operations for another client, and our security and governance and cloud solutions practices.
Planning sign-in for customers or other external users? Book an identity review. We'll look at the tenant design, the applications, and how accounts should be created and secured.
