This Fortune 500 insurer spans multiple business units and regions, with thousands of employees who depend on timely access to Oracle ERP for productivity.. Okta handles identity and access management, while SailPoint handles identity administration and lifecycle management.
However, these tools operated in silos from an access governance perspective, creating gaps in consistency, visibility, and auditability. While SailPoint handled provisioning workflows and Okta managed authentication, neither provided the federated governance layer needed to orchestrate policies and decisions across systems in a consistent, auditable way.
Manager and organizational hierarchy data from Workday were manually extracted and uploaded into downstream tools, creating friction that slowed Oracle ERP access and increased operational effort. Without a federated governance layer coordinating the identity systems they had already invested in, the insurer was left managing stuck access requests, inconsistent role definitions, and limited ability to demonstrate that access decisions aligned with current risk appetite and regulatory expectations.
Pain Point:
Manager and hierarchy data existed in SailPoint, but it did not flow in real time into Oracle ERP provisioning workflows. Instead, approvals depended on periodically exported CSV files uploaded into downstream systems.
Business Impact:
Pain Point:
The access team relied on manual CSV exports and uploads to synchronize approval data across systems.
Business Impact:
Pain Point:
Managers frequently changed roles, left the company, or were reassigned due to reorganizations and backfills. Approval workflows frequently pointed to invalid or outdated managers.
Business Impact:
Pain Point:
Administrators had to manually intervene, reroute approvals, and open tickets just to unblock provisioning workflows.
Business Impact:
Pain Point:
Because approvals and policy checks relied on stale manager data, the organization could not fully implement a real-time, policy-driven provisioning model.
Business Impact:
Manual, file-based synchronization of organizational data caused approval workflows to operate on stale hierarchy information, resulting in stalled access requests, increased administrative burden, and weakened governance and compliance assurance.
A federated access governance model designed for zero-trust environments is intended to deliver:
The insurer upgraded its governance architecture by deploying SafePaaS as the federated control layer across Oracle ERP, SailPoint, and Okta. Segregation-of-duty rules and advanced access policies were modeled in SafePaaS and evaluated before changes were applied in Oracle ERP, ensuring consistent policy enforcement regardless of the request’s origin.
This shifted the model from detecting conflicts after provisioning to blocking risky combinations at the point of request, thereby improving both the risk posture and the user experience. Instead of relying on each tool to enforce its own siloed logic, SafePaaS orchestrated identity data, policies, and approvals across systems as a single, federated layer.
SafePaaS implemented APIs to pull manager and user data directly from SailPoint, eliminating weekly CSV exports and manual uploads. SailPoint remained the system of record for identity administration, while SafePaaS continuously consumed that data to ensure workflows always used the current approver information.
With pre-built connectors and flexible data ingestion, the integration required no custom API development, reducing implementation risk and time-to-value.
In the new model:
The insurer selected SafePaaS to gain a federated governance platform that could:
Because policies are modeled once in SafePaaS and enforced consistently, the insurer avoided the typical multi-month, spreadsheet-driven clean-up projects and ongoing firefighting around stuck requests. Identity lifecycle management became more timely and efficient, with overhead reduced across business and IT teams.
With API-driven synchronization, manual weekly uploads for manager data were eliminated. The access team no longer spends time extracting, validating, and uploading files or opening tickets to clear stuck requests caused by manager turnover.
Preventive access analysis now runs in SafePaaS against centrally defined controls before Oracle ERP access is provisioned. Because SafePaaS continuously ingests data from SailPoint and Workday, provisioning and risk checks remain aligned with the latest identity and manager data rather than outdated org charts.
This improves the organization’s ability to:
