The challenge
The University of York embarked on a journey to transform its complete end-to-end digital identity capability, moving from a fragmented legacy environment toward a secure, unified service. The project was anchored by a strategic framework designed to align technical delivery with the University’s mission of academic excellence and operational security.
The project was underpinned by several core goals:
- To provide a high-quality, frictionless access experience for the entire university community (staff, students and contractors).
- To establish an IAM infrastructure that acts as a strategic enabler for university operations.
- Optimise front-end service accessibility and ease of use for all stakeholders.
- Strengthen the security posture through robust, verified access protocols.
- Ensure the architecture is future-proof and capable of evolving with technological shifts.
- To enable the use of identity data to inform and improve organisational governance and planning.
The University recognised that its existing Identity and Access Management capabilities were no longer fit for a modern, fast-growing, higher education institution. Years of organic growth had created a fragile ecosystem that presented significant operational and security risks.
The internal architecture was a mix of commercial off-the-shelf platforms and bespoke code, which presented several difficulties. Many of the commercial platforms were no longer supported or available, creating a high risk of systemic failure with no path for recovery. Whereas bespoke code written by former staff members meant no documentation or internal knowledge remained; these components had become “black boxes” that threatened operational continuity.
Manual processes were also common in this fragmented environment. As an example, creating identities for contractors (such as facilities staff) involved manual data entry and copying across multiple platforms, leading to frequent errors and inconsistent access rights. While technical teams were aware of individual faults, the organisation lacked a capability to manage identities in a unified way, or a clear understanding of the “art of the possible” regarding modern, strategic identity management.
The approach
Hippo partnered with the University of York to conduct an intensive, two-part discovery project: first, to assess the current architecture, tools, and process pain points, and second, to define a future operating model and migration roadmap.
To capture a holistic view and prevent siloed feedback, our project team – which included specialists in technology, user experience (UX), business analysis, and delivery management – brought 70 stakeholders together for two full-day workshops. These stakeholders represented diverse university functions, from student administration and clearing to human resources and facilities management.
This extended stakeholder engagement enabled the University identity team to move the discussion around digital identity from that of a background IT function into a true strategic enabler for user experience and institutional security.
Throughout the engagement, we focused heavily on collaboration and knowledge transfer:
- Upskilling was facilitated via best-practice sharing sessions at the start of the workshops to educate stakeholders on IAM concepts, successfully bridging the knowledge gap between the consultants and university staff.
- Stakeholder buy-in was achieved by explaining the rationale behind their exercises and giving every department a voice; the team won over initially resistant stakeholders, resulting in highly constructive engagement.
The discovery was delivered exactly on schedule within a non-negotiable three-month window (June–August). This window was critical, as it sat between the end of the May exam period and the start of the new academic year in September (the only time staff could be diverted from lecturing duties).
The outcome
The engagement concluded with a comprehensive 150-page report that provided:
- A thorough current-state assessment of the University’s identity processes, technology and governance model, identifying existing gaps and manual pain points.
- A detailed target operating model and “identity fabric” architecture outlining best practices for all elements of identity and access management capability in a higher-education environment.
- A step-by-step implementation roadmap designed to improve the end-user experience, dramatically reduce security risks, and support the university’s long-term strategic initiatives.
- A future-proof operating model that successfully aligned people, culture, and technology.
- A transition plan that now serves as the fundamental document underpinning the University’s current procurement.
- A streamlined framework for student, staff, and third-party customer journeys that established a single, consistent experience across the identity ecosystem.
By providing a rigorous, evidence-based direction, the project empowered the University of York to move from a state of constant tactical management of the platform into an active procurement and development for a modernised IAM ecosystem.
“Hippo helped us shift our thought process into that bigger strategic directional piece… They’ve helped people think about identity differently.” – Jason Collett, Senior Business Analyst, University of York
