Automating Workforce Identity Across 5,000 Users
| Industry | Retail |
| Region | Singapore |
| Company Size | 5,000 Identities |
| Applications Integrated | Office 365, Kronos, SAP SuccessFactors + additional apps |
| Challenge | Manual AD provisioning, fragmented ADFS authentication, and credential sprawl across business-critical systems |
| Solution | Inspirit Vision — Greenfield Okta Workforce Identity Cloud Implementation |
| Implementation | Jan 2019 – May 2019 |
Executive Summary
A Singapore-based retail organisation managing 5,000 workforce identities was operating on a fragile combination of manual Active Directory provisioning and legacy ADFS authentication, a setup that created security gaps, consumed IT resources, and left employees juggling separate credentials across every business-critical application. Inspirit Vision delivered a greenfield implementation of the Okta Workforce Identity Cloud, introducing automated provisioning, enterprise SSO across Office 365, Kronos, and SAP SuccessFactors, and full user lifecycle management. The result: a modern Okta identity governance foundation that strengthened security posture, reduced operational overhead and positioned the organisation for scalable, cloud-first workforce growth.
The Situation
This Singapore retail organisation managed a workforce of 5,000 employees spread across multiple locations, all dependent on an on-premise Active Directory and ADFS environment that had served its purpose — but was no longer fit for the pace of a growing retail operation.
The business was at an inflection point. New cloud applications were being adopted across HR, workforce management, and productivity — yet the underlying identity infrastructure remained entirely manual and on-premise. Every new joiner required IT intervention to create an AD account. Every application required a separate set of credentials. Every departure carried the risk of access not being fully revoked.
The organisation recognised that sustaining business agility without compromising security required a fundamentally different approach to workforce identity. The decision was made to move to a cloud-native platform — and to do it right, from the ground up.
The Problem
Manual Processes Creating Operational Risk
User accounts were created entirely by hand on Active Directory, with no automation governing the process. New employee onboarding was slow, error-prone, and entirely dependent on IT bandwidth. Role assignments were inconsistently applied. Deprovisioning — the critical step of revoking access when employees left — had no systematic enforcement, leaving the organisation exposed to orphaned accounts and unnecessary access risk.
A Fragmented Authentication Environment
The legacy ADFS configuration had become a constraint. As the organisation adopted cloud applications, ADFS struggled to keep pace — requiring ongoing on-premise maintenance and offering no native path to modern authentication standards. Employees were required to maintain separate login credentials for Office 365, Kronos for workforce scheduling, and SAP SuccessFactors for HR processes. Password fatigue was real, and so was the security risk that came with it.
No Visibility, No Governance
With no centralised reporting across user access and authentication events, the IT team had limited ability to answer basic governance questions: who has access to what, when was it granted, and has it been reviewed? For a retail organisation handling employee data under Singapore’s PDPA framework, this visibility gap carried meaningful compliance risk.
The Solution
Inspirit Vision designed and delivered a greenfield Okta Workforce Identity Cloud implementation — replacing the fragmented AD/ADFS environment with a unified, cloud-native identity platform built around automated Okta lifecycle management and enterprise-wide SSO.
Phase 1: Discovery & Architecture
- Conducted a full audit of the existing Active Directory structure, user roles, group policies, and application access patterns across the 5,000-identity environment.
- Mapped legacy ADFS authentication flows and identified integration requirements for all target applications.
- Designed Okta tenant configuration aligned to the organisation’s role hierarchy, HR-driven joiner/mover/leaver triggers, and PDPA data handling requirements.
Phase 2: Automated Provisioning via Okta Active Directory Integration
- Deployed Okta’s Active Directory integration to automate user creation, attribute synchronisation, group membership, and account deactivation — eliminating manual IT intervention from the provisioning workflow entirely.
- Configured HR-driven lifecycle triggers so that new joiners, role changes, and leavers were processed automatically, with zero orphaned accounts and consistent access governance from day one.
Phase 3: SSO Rollout — Office 365, Kronos & SAP SuccessFactors
- Replaced ADFS as the primary identity provider for Office 365, including automated licence and role provisioning based on user attributes — eliminating manual licence management overhead.
- Extended SSO to Kronos (workforce management) and SAP SuccessFactors (HR), giving employees a single, secure credential to access every business-critical application.
- Onboarded additional applications to the Okta SSO framework, consolidating the entire application estate under centralised Okta identity governance.
Phase 4: Reporting, Training & Optimisation
- Configured Okta’s reporting and audit dashboards, giving the IT and security teams real-time visibility into authentication events, access anomalies, and licence utilisation.
- Delivered administrator enablement training to ensure the internal team could confidently manage, extend, and audit the platform independently post-go-live.
- As an Okta professional services delivery partner, Inspirit Vision provided full documentation and a structured handover to support long-term platform ownership.
The Results
Before vs. After
| Metric | Before Inspirit | After Inspirit | Improvement |
| User Provisioning | Manual, AD-only | Fully automated via Okta | 90% |
| Authentication | ADFS (on-premise) | Okta SSO (cloud-native) | Single credential, all apps |
| Apps with SSO | 0 | 5+ (O365, Kronos, SAP SF, others) | 100% |
| IT Admin Overhead | 96 hrs/month | 32 hrs/month | 67% |
| Orphaned Account Risk | Unmanaged | Zero, via lifecycle automation | 100% ↓ |
| Access Visibility | Minimal / manual | Real-time Okta dashboards | Full audit capability |
| PDPA Readiness | Partial | Centralised, auditable | Compliant |
Client Perspective
UX improved with SSO, creation of accounts using automation, increasing productivity
Why Inspirit Vision?
Implementing Okta successfully at enterprise scale requires more than licensing — it demands a partner with deep platform expertise, a structured delivery methodology, and the ability to navigate complex legacy environments.
Inspirit Vision brought all three to this engagement. Our team managed the full complexity of migrating from a deeply embedded ADFS environment to cloud-native identity without disrupting live retail operations. We integrated four distinct enterprise systems — Active Directory, Office 365, Kronos, and SAP SuccessFactors — within a single, coherent Okta Workforce Identity Cloud architecture, and delivered a governance framework the client’s IT team can maintain and extend independently.
For Singapore-based organisations navigating PDPA obligations and the transition to cloud-first operations, Inspirit Vision offers a proven, regional delivery capability that accelerates time-to-value and reduces implementation risk.
