Understand the journeys
Separate workforce, partner and customer requirements. Map identity sources, registration, authentication, recovery and application access, including hybrid directory dependencies.
02 / WORKFORCE & CUSTOMER IDENTITY
Verify trust. Design better access.
Apply Zero Trust principles to workforce and customer journeys. Connect identity assurance, authentication and access policy so employees, partners and customers can reach the right services with proportionate protection.
Discuss your challengeStart with the context.
Workforce identity and customer identity solve different problems. Employees need secure access to applications and infrastructure; customers need dependable registration, sign-in and recovery journeys. Both depend on explicit trust decisions, reliable identity signals and careful integration.
CONTROL IN CONTEXT
Trust is evaluated at the point of access.
Identity assurance, device and session signals inform the decision. Workforce and customer journeys need controls designed for their context.
Zero TrustPasskeys & MFAFederation & SSO
HOW WE HELP
From direction to delivery.
Design the trust decisions
Use identity, device, session and risk context to shape access policy. Assess phishing-resistant MFA, passkeys using FIDO2/WebAuthn, passwordless authentication and Conditional Access where supported.
Connect the experience
Design SSO, federation and application integration using appropriate OIDC, OAuth 2.0 and SAML patterns. Plan migration, customer consent and adoption around real journeys.
THE CONTROL LANDSCAPE
Identity detail. Business context.
Workforce access
Active Directory and cloud identity, hybrid authentication, SSO and application access patterns.
Customer identity
Registration, identity verification where appropriate, consent, account recovery and customer-facing federation.
Zero Trust & assurance
Explicit verification, least privilege and risk-aware policy, including passkeys, phishing-resistant authentication and secure enrolment and recovery.
Federation & integration
OIDC, OAuth 2.0 and SAML trust boundaries, token handling and application onboarding.
FURTHER READING
Perspectives that inform the work.
MICROSOFT
99.9%+The foundations still matter.
Microsoft attributes blocking more than 99.9% of common identity-related attacks to multifactor authentication combined with blocking legacy authentication, based on its learnings.
Microsoft Entra security-defaults guidance · 21 July 2025 (opens in a new tab)OKTA
Passkeys change the authentication model.
Okta’s developer guidance explains FIDO2, WebAuthn and passkeys as part of the move towards public-key authentication. Enrolment, assurance and account recovery remain important design decisions.
We're Living in a Passwordless World · 30 August 2023 (opens in a new tab)TECHNOLOGY EXPERIENCE
Technology in context.
Architecture and implementation experience across established identity technologies.
Active Directory
Directory services
Microsoft Entra
Access, governance & privileged roles
Okta
Workforce & customer identity
Ping Identity
Access management & customer identity
1Kosmos
Identity verification & authentication
And more. Technology choices follow your requirements, existing estate and delivery priorities.
PRACTICAL OUTPUTS
What we work towards.
- A differentiated workforce and customer identity architecture
- Authentication, federation and risk-aware access policy designs
- A migration and adoption roadmap with assurance and experience measures
An engagement that fits.
Work can begin with a specific access challenge or a broader architecture review. The scope follows your identity domains and business priorities rather than assuming a platform replacement.
CONNECTED EXPERTISE