Zephon

ICAM

We make complex ICAM programs simpler to run.

Identity programs rarely fail all at once. They accumulate workarounds, redundant components, and custom code in the wrong places until the platform becomes something teams work around instead of rely on. We find what is actually causing failure, remove what doesn't belong, and modernize what remains, so the program is easier to operate, maintain, and upgrade.

Book a 30-minute ICAM Simplification Review

Signs an identity program needs simplifying

  • Manual workarounds to grant, change, or remove access
  • Recurring provisioning failures and avoidable helpdesk tickets
  • Access granted outside the ICAM program's visibility
  • Legacy identity components no one wants to touch
  • Vendor patches and upgrades that break customizations
  • Zero Trust milestones stalled by legacy identity infrastructure

How we work

  1. Diagnose

    Find what is actually causing failure, not just the symptom that generated the ticket.

  2. Simplify

    Remove, consolidate, or relocate what doesn't belong. Add only what improves reliability, visibility, or maintainability.

  3. Modernize

    Rebuild what remains on standards and supported patterns, so your team can run it without permanent dependence on us.

We don't add technology for its own sake. Often the fix uses something the organization already owns.

What simpler looks like

DoD agency: IGA modernization

Before

An identity governance platform built up over more than a decade carried heavy technical debt: a custom Oracle ADF interface, custom code running batch jobs from inside the database, a custom application writing directly to the IGA database, and customizations embedded in the vendor product that broke during patches and upgrades. Microsoft Identity Manager (MIM) synchronized two AD domains the IGA platform already provisioned. Oracle Access Manager and Oracle Unified Directory provided proprietary header-based authentication, even though the agency already ran Okta as its enterprise identity provider.

What we changed

  • Replaced the ADF interface with Spring Boot and Thymeleaf, a smaller stack that is easier to staff
  • Moved custom functionality outside the vendor product, so patches and upgrades no longer break it
  • Moved batch jobs and integrations out of the database into the IGA platform's own scheduler
  • Replaced direct database access with an API layer
  • Identified MIM as redundant and retired it
  • Began retiring OAM and OUD in favor of the agency's existing Okta, using SAML and OIDC

Result

MIM is retired. The application now runs through a proper DevSecOps pipeline. Vendor upgrades no longer touch custom functionality. OAM and OUD retirement is underway.

Federal civilian agency: provisioning simplification

Before

AD account provisioning ran on more than 20 rule combinations based on user type, department, organization, and status. Birthright provisioning failures were hard to trace, and the process ran synchronously. End users ran very large reports directly inside the enterprise IGA tool, pulling it away from identity management and governance.

What we changed

  • Consolidated the 20+ provisioning rules into 5 that everyone can understand and follow
  • Moved birthright provisioning to asynchronous AWS SQS queues with a status dashboard
  • Pointed the agency's existing reporting solution, in the same AWS GovCloud tenant, at a read-only database replica

Result

Provisioning rules that operators can read and troubleshoot. Each user's position in the birthright provisioning flow is visible. Heavy reporting no longer runs against the production IGA platform.

Higher education: license assignment

Before

A five-year-old PowerShell script on a local Windows server assigned Microsoft 365 licenses. It failed randomly, timed out, and could not resume gracefully, producing helpdesk tickets and manual fixes.

What we changed

Rather than keep patching the script, we moved the license logic into the identity governance platform that already held the user data and already provisioned to AD, using dynamic groups for license assignment. The process became near real-time and idempotent.

Result

The legacy script was retired.

More results

Measured outcomes from other engagements:

  • IRS IRS Identity Governance Modernization
  • Hofstra University Identity Governance Enhancement at Hofstra University
  • SEC Identity and Device Zero Trust Assessment at the SEC

Is your ICAM program harder to run than it should be?

In 30 minutes, tell us where the program is stuck. You'll talk to a senior practitioner, and you'll get a plain answer on what we'd look at first.

Book a 30-minute ICAM Simplification Review