Identity can support sustainability goals, but governance still matters

At a glance

What this is: This article argues that identity programmes can contribute to sustainability outcomes by improving digital adoption, reducing device churn and commuting, and lowering avoidable authentication activity, while governance determines whether those gains are credible.

Why it matters: For IAM practitioners, the point is that sustainability claims now intersect with access design, authentication experience, and platform architecture, so identity teams need measurable controls rather than broad environmental claims.

By the numbers:

• 71% of investors agree that companies should incorporate sustainability directly into their corporate strategy, according to PwC Global Investor Survey 2024 cited by Okta.
• Teleworking can result in 60% less CO2 emissions compared to commuting, according to Okta.

Context

Identity is increasingly being treated as part of enterprise sustainability strategy, not just a security layer. In this article, Okta argues that IAM choices can influence emissions through customer onboarding, workforce access, authentication volume, and the carbon profile of underlying infrastructure.

The governance problem is that these sustainability benefits only hold when access journeys are secure, usable, and measurable. If identity controls create abandonment, encourage shadow workarounds, or increase avoidable authentication events, the environmental argument weakens quickly.

For IAM and CIAM teams, the practical question is no longer whether identity has sustainability implications, but which metrics prove that the effect is real and not just aspirational.

Key questions

Q: How can IAM teams support sustainability goals without weakening security?

A: Start by reducing unnecessary identity events, such as repeated logins, redundant approvals, and paper-based onboarding. Then preserve assurance with adaptive MFA, risk-based access, and strong lifecycle controls. The goal is not fewer controls, but fewer wasteful control steps that add friction, overhead, and avoidable operational cost.

Q: What do teams need to measure before claiming identity reduces emissions?

A: Teams should measure onboarding completion, authentication challenge volume, digital adoption rates, and infrastructure efficiency before linking identity work to emissions reduction. Those signals show whether the environmental benefit is real or just a side effect of a feature deployment.

Q: Why do MFA prompts matter in a sustainability discussion?

A: MFA prompts matter because each authentication event consumes a small amount of energy, and attack traffic can multiply that cost at scale. If bot activity or credential stuffing drives repeated prompts, the sustainability claim is weakened unless those failures are detected and suppressed upstream.

Q: What is the difference between cloud-native and on-prem identity from a sustainability view?

A: Cloud-native identity typically concentrates workload on shared infrastructure, while on-prem identity often carries more server overhead, maintenance burden, and energy use. The difference matters because sustainability claims depend on where the identity workload runs and how efficiently it is operated.

Technical breakdown

How paperless billing depends on identity friction

Paperless billing only works at scale when customers can complete registration and sign-in without dropping out. In CIAM terms, the access journey is part of the sustainability outcome because abandonment suppresses digital adoption. Social login, progressive profiling, and self-service account creation reduce the effort required to move customers from paper to digital channels. The technical issue is not the billing format itself but whether identity orchestration removes enough friction to change customer behaviour. That makes onboarding design a business control, not just a UX choice.

Practical implication: measure registration abandonment and completion rates before claiming any sustainability gain from paperless billing.

Why MFA volume has a carbon cost

Every authentication event carries a small environmental cost, and unnecessary MFA prompts multiply that cost at scale. Malicious login attempts such as credential stuffing and bot activity can trigger avoidable challenge traffic, so the carbon issue is really an access-control issue. SSO reduces repeated prompts, while bot detection and brute-force protection suppress illegitimate traffic before it reaches the MFA layer. The security and sustainability goals align here because fewer failed or malicious attempts mean less wasted compute, less messaging, and less user friction.

Practical implication: use authentication telemetry to separate legitimate MFA demand from attack-driven noise.

Cloud identity architecture and the carbon profile of IAM

The infrastructure behind IAM matters because on-premises authentication stacks typically consume more energy than cloud-native services designed for scale. Okta links its cloud delivery model to AWS efficiency claims, showing that identity architecture can influence operational emissions as well as security posture. The relevant control question is whether identity services are provisioned and operated in a way that avoids redundant infrastructure and unmanaged server sprawl. Sustainability claims are strongest when the platform design is already aligned with operational efficiency and governance.

Practical implication: compare identity platform architecture against on-prem alternatives when evaluating emissions, resilience, and administrative overhead.

NHI Mgmt Group analysis

Identity now sits inside sustainability governance, not beside it: This article shows that IAM is no longer only a security control plane. When identity affects paperless billing adoption, remote work, authentication volume, and cloud infrastructure choices, it becomes part of the organisation’s environmental footprint. That broadens the governance surface for IAM and CIAM leaders, who now need to evidence outcomes as well as access control.

The sustainability case for identity fails if the user journey creates friction: The article’s own examples depend on completion, not just capability. If registration, login, or recovery steps create abandonment, the expected reduction in paper use, commute emissions, or support overhead never materialises. The implication is that identity teams have to treat journey completion, not feature availability, as the relevant measure.

Authentication noise is a governance signal, not just an operational nuisance: Malicious login traffic inflates MFA prompts and weakens any carbon-saving claim tied to digital access. That means bot suppression, SSO adoption, and challenge minimisation are doing double duty across security and sustainability. For practitioners, identity telemetry becomes evidence for both risk reduction and environmental reporting.

Cloud-native identity changes the sustainability baseline: The article positions platform architecture as part of the emissions story, which means the old assumption that IAM is infrastructure-neutral no longer holds. The choice between on-prem and cloud-delivered identity now affects administrative overhead, hardware churn, and energy consumption. Practitioners should therefore assess identity platforms as part of broader operational sustainability decisions.

Identity sustainability is a measurable discipline, not a brand claim: The strongest reading of this piece is that environmental benefit must be demonstrated through adoption, prompt volume, and infrastructure efficiency. That creates a new reporting requirement for IAM and CIAM teams because sustainability language without operational evidence will not survive scrutiny. The practitioner conclusion is to quantify the effect before treating identity as a sustainability lever.

What this signals

Identity sustainability depends on adoption, not intention: If customers abandon registration or employees bypass the intended flow, the environmental benefit never accumulates. The governance question is whether the identity journey measurably shifts behaviour toward digital channels without creating security shortcuts.

Authentication telemetry is now part of sustainability evidence: Bot suppression, SSO adoption, and reduced challenge volume are no longer just security metrics. They also help show whether identity operations are eliminating wasted authentication activity rather than merely relocating it.

Cloud identity architecture changes the emissions baseline: The more identity is delivered through consolidated cloud services rather than redundant on-prem systems, the stronger the operational efficiency argument becomes. Practitioners should treat architecture selection as part of sustainability reporting, not a separate technical detail.

For practitioners

• Measure onboarding abandonment against sustainability goals Track how many users start but do not complete paperless billing, registration, or account recovery flows, then compare those drop-off points with the volume of paper-based or assisted alternatives still in use.
• Separate legitimate MFA demand from attack-driven noise Review authentication telemetry for credential stuffing, bot activity, and repeated failed logins that generate unnecessary challenge prompts, then distinguish those events from genuine user friction.
• Evaluate identity platform architecture against on-prem alternatives Compare energy use, administrative overhead, and hardware dependence for cloud-hosted identity services versus locally operated authentication infrastructure before making sustainability claims.
• Link sustainability reporting to access metrics Use completion rates, login challenge volume, and digital adoption data as evidence for any identity-led emissions narrative so that the report reflects operational behaviour rather than assumption.

Key takeaways

• Identity can contribute to sustainability only when it changes user behaviour and infrastructure use in measurable ways.
• The strongest evidence in the article ties paperless billing, remote work, reduced MFA noise, and cloud efficiency to identity design.
• IAM teams should treat emissions claims as a governance problem and prove them with adoption, telemetry, and architecture metrics.

Key terms

• Paperless Billing Adoption: The rate at which customers choose electronic invoicing instead of paper statements. In identity programmes, this is influenced by registration friction, authentication design, and recovery flow quality because users abandon digital channels when access is cumbersome or unsafe.
• Authentication Noise: Unnecessary login and challenge activity that does not reflect a legitimate business need. In IAM and CIAM environments, noise can come from bots, repeated failed attempts, or poor journey design, and it distorts both security operations and sustainability reporting.
• Digital Adoption: Digital adoption is the organisational shift from manual or legacy methods to digital tools and processes. It is not just software use. It also includes changing how teams work so that efficiency, visibility, and consistency improve across departments and business functions.
• Cloud-Native Identity: Identity management approaches designed for cloud environments, including managed identities, workload identity federation, and ephemeral credentials, as opposed to traditional on-premises account models with static passwords.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.