Zero trust identity modernization in state government at scale

At a glance

What this is: NHI Mgmt Group's analysis, drawing on RSA Security's blog post: A state government agency modernised identity for more than 145,000 users by extending MFA, self-service and help desk verification into a hybrid Microsoft environment.

Why it matters: It matters because public-sector IAM programmes often fail when they treat cloud identity as the whole control plane, leaving legacy, RADIUS and support-channel risks outside the zero trust design.

By the numbers:

• Identity-related requests were generating roughly 2,500 help desk calls per month.
• The agency’s high-assurance use cases included FIPS 140-3 Level 3 certified hardware authenticators.

Context

State government identity modernisation is the practice of extending access controls, authentication and lifecycle governance across cloud, on-premises and legacy systems without breaking existing operations. In this case, the primary issue was not a lack of identity tooling, but a mismatch between a cloud-first Microsoft estate and the higher-assurance, hybrid and support-channel requirements of public-sector operations.

The agency’s environment included law enforcement workloads with CJIS requirements, RADIUS-connected access, legacy applications and air-gapped systems that could not be governed by cloud identity alone. That combination makes the problem an IAM and NHI governance issue as much as an authentication issue, because the control plane has to cover user access, help desk verification and credential lifecycle at the same time.

At 145,000-user scale, the starting position is typical for large public-sector enterprises: modern identity goals are constrained by legacy dependencies, compliance obligations and operational load. The article is describing a common modernization pattern rather than an unusual edge case.

Key questions

Q: What breaks when state agencies modernise identity only in the cloud?

A: Cloud-only modernisation leaves legacy applications, RADIUS dependencies, help desk recovery and high-assurance environments outside the control plane. That creates inconsistent policy enforcement and weak points attackers can target even when the Microsoft environment is well governed. A zero trust programme is incomplete if it stops at the cloud boundary.

Q: Why does verified identity matter so much in zero trust and IAM programmes?

A: Verified identity matters because access decisions are only as reliable as the identity bound to them. If onboarding is weak, every later session inherits that risk. Strong identity proofing reduces fraud, improves trust in authentication, and helps teams apply least privilege and consent controls with more confidence across cloud, hybrid, and legacy environments.

Q: How should public-sector teams modernise identity without disrupting legacy users?

A: They should extend policy into the existing estate, preserve working authenticators where possible and layer modern methods on top rather than forcing a rip-and-replace. That approach reduces user friction while keeping authentication, audit and compliance controls aligned across old and new systems.

Q: What is the difference between passwordless authentication and phishing-resistant step-up authentication?

A: Passwordless authentication removes the password from the normal login flow, often replacing it with a stronger method such as a QR-based or passkey-based sign-in. Phishing-resistant step-up authentication is different because it is invoked when trust drops, for example on an unmanaged browser or risky device. One improves everyday access, while the other adds control only when conditions warrant it.

Technical breakdown

Hybrid identity control planes across Microsoft and legacy systems

A hybrid identity control plane extends authentication policy across cloud, on-premises and RADIUS-dependent environments without forcing a full replacement of the incumbent stack. The technical issue is federation and policy consistency: Microsoft Entra can govern Microsoft-native access, but it does not fully solve legacy token estates, high-assurance hardware requirements or air-gapped paths. In this model, SAML and OIDC carry policy into the cloud, while routers and integrations preserve existing authenticators and directory sources. That matters because modernisation succeeds when policy follows the user across environments, not when each platform is treated as a separate identity island.

Practical implication: Map every authentication path, including RADIUS and legacy apps, to one policy plane before declaring the environment zero trust ready.

Phishing-resistant MFA and passwordless assurance at enterprise scale

Phishing-resistant authentication replaces knowledge-based or OTP flows with methods that are materially harder to replay or socially engineer, such as FIDO2, biometrics, QR codes and hardware authenticators. In public-sector environments, the technical bar is higher because assurance must satisfy both user convenience and regulatory constraints. The important design detail is not just adding more factors, but preserving assurance across cloud and on-premises resources from one console. Passwordless is not a branding term here. It is a control change that reduces the number of credentials that can be phished, reused or coerced through support channels.

Practical implication: Prioritise phishing-resistant methods for high-risk populations and bind them to the same lifecycle and audit model as legacy tokens.

Help desk identity verification as a security control

Help desk workflows are often treated as a support function, but at scale they become an identity boundary. When users can reset credentials or recover access through social engineering, the support channel turns into a bypass for MFA and passwordless controls. Bi-directional verification changes the mechanism by requiring both the user and the support agent to prove identity without shared secrets or knowledge-based questions. That closes a common attack path because attackers frequently target service desks precisely where process gaps, urgency and trust overlap. In identity governance terms, the help desk is part of the authentication surface, not outside it.

Practical implication: Treat support authentication as part of privileged access governance and remove knowledge-based verification from recovery workflows.

Threat narrative

Attacker objective: The attacker aims to bypass normal authentication and gain trusted access through the support channel, then expand into regulated government systems.

1. Entry occurs through the help desk when an attacker socially engineers a support interaction and uses that channel as the initial access path.
2. Credential access follows when the attacker leverages weak verification to reset or recover identity material without needing the underlying account password.
3. Escalation happens if the compromised support process can reach authenticated systems, admin workflows or high-assurance user accounts.
4. Impact is broader account compromise, operational disruption and exposure of sensitive government or law-enforcement data and services.

Breaches seen in the wild

• Caesars Entertainment breach 2023: Social engineering of an IT support vendor let attackers copy Caesars loyalty database; about $15 million was reportedly paid.
• Co-op cyber attack 2025: Attackers linked to Scattered Spider tricked their way into a Co-op employee account and stole personal data of all 6.5 million members.

Read and download The State of NHI & AI Agent Breach Report 2026, covering 200+ breaches impacting Non-Human Identities including AI Agents.

NHI Mgmt Group analysis

Help desk verification is now an identity control, not a support detail. This article shows why service desk authentication sits inside the attack surface for large identity programmes. When reset and recovery flows are weak, attackers do not need to break primary authentication; they only need to impersonate the user at the support layer. Practitioners should treat support-channel assurance as part of access governance, because that is where phishing-resistant MFA is most often undermined.

Hybrid zero trust fails when the programme assumes the cloud is the whole estate. The state agency’s problem set included legacy applications, RADIUS, air-gapped environments and higher-assurance workloads that lived outside the Microsoft-native control plane. That means zero trust architecture has to govern the full access path, not just the modern front end. The implication is that identity modernisation is incomplete until policy, authentication and audit span both cloud and legacy domains.

Identity blast radius is driven by support workflows as much as by credential strength. A help desk that can issue or restore access without strong verification multiplies the consequences of every other control failure. In a public-sector environment, that creates a blast radius across multiple agencies, compliance regimes and user populations. The practitioner lesson is that operational identity paths can enlarge compromise scope even when core MFA is sound.

Lifecycle automation is the difference between administrative scale and governance at scale. Manual spreadsheets and ad hoc reporting do not survive environments with 145,000 users and multiple compliance regimes. The article reinforces a familiar governance truth: access reviews, reporting and credential status only become defensible when they are automated and tied to the live identity system. Teams that cannot observe lifecycle state in real time are managing identity reactively, not governing it.

Phishing-resistant authentication only works when the underlying assurance model is coherent across every identity type. The article combines user authentication, token lifecycle, help desk verification and hardware assurance into one operating model. That is the right direction for complex public-sector estates because weak links in one identity path undermine the whole zero trust story. Practitioners should evaluate their identity programme as a connected system, not as separate MFA, service desk and audit projects.

From our research library:

• 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
• Read next: Zero Trust Identity Guide

What this signals

Identity blast radius: public-sector zero trust programmes should measure how far a support-channel compromise can travel across agencies, compliance zones and legacy systems. If the help desk can still recover access with weak verification, the programme has moved MFA forward without moving the attacker boundary.

State agencies should expect modernisation to remain hybrid for longer than their cloud roadmaps suggest. The practical question is not whether to adopt Microsoft identity services, but how to make sure legacy applications, RADIUS and high-assurance endpoints are governed by the same lifecycle and audit model.

The strongest programmes will treat service desk verification, token lifecycle reporting and phishing-resistant authentication as one operating system rather than three separate projects.

For practitioners

• Map the full hybrid authentication surface Inventory Microsoft, RADIUS, legacy application and air-gapped access paths together so identity policy is not split across disconnected consoles.
• Remove knowledge-based help desk verification Replace PINs, shared secrets and security questions with bi-directional identity verification for credential reset and recovery requests.
• Preserve and govern existing token estates Carry forward software and hardware tokens into the new control plane, but tie them to central lifecycle reporting and enforcement.
• Automate audit and lifecycle reporting Expose token status, authentication events and user activity through real-time reporting so compliance evidence is generated from operations, not spreadsheets.
• Bind phishing-resistant methods to high-assurance use cases Reserve FIDO2 and certified hardware authenticators for regulated or high-risk populations where passwordless assurance and hardware provenance both matter.

Key takeaways

• The article shows that identity modernisation is a governance problem, not just a tooling refresh, because cloud identity alone does not cover the full public-sector estate.
• Scale matters because the agency’s 145,000-user environment included legacy, RADIUS and high-assurance workloads that could not be secured by Microsoft-native controls alone.
• The decisive control change is to bind help desk verification, lifecycle automation and phishing-resistant authentication into one hybrid identity model.

Key terms

• Phishing-Resistant Authentication: Phishing-resistant authentication proves identity without relying on a user to approve a prompt or reveal a reusable secret. It typically binds access to a device, key, or cryptographic proof that an attacker cannot easily reuse or coerce. This approach reduces reliance on human judgment at login time.
• Help Desk Identity Verification: A separate trust process used to confirm a person before support staff reset access, approve recovery, or authorise a sensitive change. It matters because attackers often target support workflows when primary authentication is already protected, so the verification method has to stand on its own.
• Hybrid Control Plane: A hybrid control plane is the management layer that coordinates identity, policy, and access decisions across both cloud and on-premises environments. It centralizes control while allowing enforcement to occur in multiple locations, often spanning applications, infrastructure, and security tools. In identity security, it helps unify governance without requiring all workloads to live in one environment.
• Authenticator Lifecycle Management: Authenticator lifecycle management is the governance of a credential from issuance to renewal, replacement, and retirement. For human identity programmes, it ensures that keys, smart cards, and certificates stay tied to the right user and are removed when the user, role, or device is no longer trusted.

Deepen your knowledge

NHI governance, agentic AI identity, and machine identity lifecycle are core topics in our NHI Foundation Level course, the industry's only accredited NHI security programme. If you are responsible for identity security strategy or NHI governance in your organisation, it is worth exploring.