Hershey’s identity security migration shows the limits of legacy IGA

At a glance

What this is: This is a case study of Hershey’s identity security migration from a 2004-era IGA platform to a more modern operating model after maintenance burden, manual queues, and deprovisioning gaps made the old approach unsustainable.

Why it matters: It matters because many identity programmes still treat IGA as a ticketing layer, when the real control problem is whether joiner-mover-leaver, provisioning, and HR data quality actually work at enterprise scale.

By the numbers:

• Hershey’s legacy IGA system was first implemented in 2004, which helps explain why it struggled to meet current requirements.
• The company had over 230 applications to support during the migration.
• Hershey’s three-person team received over 50 tickets daily and often faced backlogs of 400 to 600 tickets.

Context

Hershey’s migration is a straightforward example of what happens when identity governance outgrows the operating assumptions of a legacy platform. The issue was not just product age. It was the gap between a static IGA model and a business environment that now includes more than 45,000 users and non-human machine identities, 230 applications, and continual joiner-mover-leaver pressure.

In practical terms, the old model had become a manual exception engine. Weekly reboots, password synchronisation issues, deprovisioning problems, and growing ticket queues meant the control plane for identity was no longer reliable enough to support the business. That is the governance failure identity teams need to recognise before they start talking about migration tooling.

The article frames the migration as business-led, with HR and security working together to clean up source data, document processes, and redesign fulfillment. That is the right starting point because identity programmes break when process design, directory data, and lifecycle execution are managed as separate problems.

Key questions

Q: Why do legacy IGA platforms break down as identity estates grow?

A: Legacy IGA platforms usually fail when they depend on manual tickets, unstable connectors, and clean-up work that does not scale with the number of applications and identities. The result is slower deprovisioning, poor user experience, and a control layer that reacts after access problems appear instead of governing them proactively.

Q: What is the biggest governance risk when deprovisioning is slow?

A: Slow deprovisioning leaves access active after the business need has ended, which is one of the clearest ways lifecycle controls fail in practice. That extends the window for misuse, audit findings, and unnecessary privileged access, especially when HR data and application ownership are not tightly aligned.

Q: How can identity teams tell whether JML is actually working?

A: The best signal is whether joiner-mover-leaver events complete cleanly without repeated tickets, reboots, or manual follow-up. If access changes still need human chase-up to finish, the programme is not governing lifecycle events end to end and is relying on exception handling instead of control enforcement.

Q: What should teams do when identity processes depend on manual fulfillment?

A: Teams should standardise the underlying process first, then move fulfillment to directory groups or API-based connectors where possible. Manual fulfillment is usually a sign that application ownership, naming, or integration logic has not been disciplined enough to support reliable lifecycle governance.

Technical breakdown

Why legacy IGA becomes a control bottleneck

Legacy identity governance and administration systems often assume a slower application estate, more stable workflows, and a manageable number of manual exceptions. Once those assumptions fail, the platform stops acting as a control layer and starts behaving like an operational queue. In Hershey’s case, weekly reboots, password synchronisation issues, and deprovisioning failures show a system that could no longer execute lifecycle decisions cleanly. When ticket volume rises into the dozens per day, the identity team is no longer governing access proactively. It is processing exceptions after the fact.

Practical implication: treat backlog growth, sync failures, and reboot dependence as signals that the governance model, not just the tooling, has broken.

Joiner-mover-leaver and deprovisioning as the real test

Joiner-mover-leaver processes are the operational proof of whether identity governance is actually working. They depend on clean HR source data, reliable application connectors, and deterministic fulfillment paths. Hershey’s migration prioritised those workflows first, which is significant because deprovisioning is where stale access becomes business risk. If source data is inconsistent or application ownership is unclear, joiner-mover-leaver becomes a partially manual process. That reduces confidence in least privilege, slows offboarding, and forces teams to use tickets as the control mechanism instead of policy and automation.

Practical implication: validate joiner-mover-leaver accuracy before expanding access modelling or advanced governance features.

Why process redesign matters more than connector count

The article shows that modern identity security is not just a connector problem. Hershey needed process redesign flexibility, better source data quality, and more disciplined application onboarding, including the use of groups or APIs rather than CSV files or manual fulfillment. That points to a core IGA lesson: automation only scales when upstream processes are standardised. Without clean nomenclature, role modelling, and dependable integration patterns, the identity programme simply automates disorder. A modern platform can reduce friction, but it cannot compensate for ambiguous ownership or inconsistent provisioning logic.

Practical implication: standardise naming, data, and provisioning logic before expecting lifecycle automation to scale.

Breaches seen in the wild

• Microsoft Midnight Blizzard breach: Midnight Blizzard (APT29) exploited legacy test account without MFA to breach Microsoft.
• Dropbox Sign breach 2024: A compromised back-end service account gave attackers Dropbox Sign customer data, including API keys, OAuth tokens and MFA information.

Read our 52 NHI Breaches Analysis report for a comprehensive view of breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Legacy IGA fails first as an operating model, not a feature set. Hershey’s experience shows that the real limit of older governance platforms is not one missing function but the accumulation of operational drag: reboots, ticket queues, password synchronisation failures, and manual deprovisioning. Those symptoms matter because they turn identity governance into exception handling. The implication for the field is that IGA must be judged on execution reliability, not on whether it still nominally covers joiner-mover-leaver.

Source-data quality is the hidden control plane for identity. Hershey’s migration hinged on HR and security getting the underlying processes documented correctly, especially across international offices and manufacturing environments. That is the critical governance lesson: access control is only as trustworthy as the data that feeds it. When identity records, naming, and lifecycle events are inconsistent, policy enforcement becomes probabilistic rather than authoritative. Practitioners should treat data quality as a first-class security control, not a back-office cleanup task.

Role modelling and application standardisation are governance enablers, not afterthoughts. The article’s mention of .CSV files, manual fulfillment, Active Directory groups, and connector APIs points to a deeper truth. If application owners are allowed to improvise provisioning methods, the identity programme fragments into local exceptions. A disciplined access model only scales when fulfilment paths are standardised and roles are explicit. That means identity teams need to govern application onboarding as tightly as access requests.

Business-led migration is the only sustainable path for identity modernisation. Hershey did not solve an identity problem by treating it as a tooling refresh. It aligned security and HR, phased the rollout, and prioritised the lifecycle processes with the highest operational impact first. That sequencing matters because identity modernisation fails when it is isolated inside the IAM team. The broader lesson is that governance, process design, and application ownership must move together if the programme is to remain credible.

Hershey’s case sharpens the concept of lifecycle execution debt. This is the accumulation of unresolved joiner-mover-leaver friction, source-data inconsistency, and manual fulfillment that makes an identity programme increasingly expensive to operate. The debt does not appear all at once. It shows up as ticket backlogs, delayed deprovisioning, and workarounds that become normalised. Practitioners should recognise lifecycle execution debt as a direct threat to the operating model of identity governance.

From our research library:

• NHIs outnumber human identities by 25x to 50x in modern enterprises, according to the Ultimate Guide to NHIs.
• Read next: Ultimate Guide to NHIs — Key Challenges and Risks

What this signals

Lifecycle execution debt: identity teams should treat repeated ticket queues, deprovisioning friction, and password sync failures as evidence that the programme is carrying unresolved operational debt. Once that debt grows, access governance becomes slower than the business it is meant to protect.

Modern IGA maturity is less about adding more workflow steps and more about removing the need for exception handling in the first place. That means tightening source data, stabilising fulfilment paths, and making sure the identity team is not compensating for upstream process design.

Hershey’s scale shows why this is not a niche problem: according to the Ultimate Guide to NHIs, NHIs outnumber human identities by 25x to 50x in modern enterprises. The more machine identities enter the estate, the more fragile manual governance becomes.

For practitioners

• Audit lifecycle execution debt Measure where joiner-mover-leaver tasks still depend on tickets, reboots, or manual intervention, then map those steps to the applications and teams creating the most delay.
• Clean source data before expanding automation Standardise identity nomenclature, correct HR source records, and define ownership for fields that drive provisioning and deprovisioning decisions.
• Replace CSV and manual fulfillment paths Use directory groups or API-based connectors for provisioning and deprovisioning so application owners are not maintaining bespoke identity workflows.
• Model roles around actual business access Build role models from how people and machine identities really use applications, then recertify those roles against current HR and application data.

Key takeaways

• Hershey’s migration shows that legacy IGA fails when it turns identity governance into ticket processing, reboot maintenance, and manual exception handling.
• The operational evidence was clear in the article: more than 50 daily tickets, 400 to 600 item backlogs, and a three-person team struggling to keep the platform running.
• The limiting control was lifecycle execution, especially deprovisioning and source-data quality, which had to be corrected before the new model could scale.

Key terms

• Identity Governance and Administration (IGA): A framework of policies, processes, and technology to manage and govern digital identities and their access rights. Increasingly extended to cover non-human identities alongside human users.
• Joiner Mover Leaver: Joiner Mover Leaver is the identity lifecycle process for creating, changing, and removing access as people enter, change roles, or leave an organization. It governs provisioning, modification, and deprovisioning across systems, ensuring access matches current job needs and reducing orphaned accounts, privilege creep, and residual access risk.
• Deprovisioning: Deprovisioning is the removal of access when a user changes roles or leaves an organisation. For security teams, it is the point where stale accounts, tokens, and permissions should disappear. Weak deprovisioning leaves residual access that can outlive the business need that created it.
• Role Modelling: Role modelling is the process of defining, validating, and maintaining access patterns so identities receive only the permissions needed for a job or function. In mature IAM programmes, it becomes a lifecycle discipline, not a one-time design task, because organisational change quickly turns static roles into privilege drift.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are building or maturing an IAM programme, it is worth exploring.