Topic starter
06/06/2026 2:07 am
TL;DR: When identity providers go down, applications tied to them can go dark, creating continuity risk across Epic EHR, DDIL missions, and other high-dependency environments according to Strata Identity. The governance problem is not availability alone: access, verification, and resilience assumptions all collapse at once.
Editorial analysis by NHI Mgmt Group, based on content published by Strata Identity: “Identity Continuity”.
Key questions
Q: How should teams design identity continuity when the identity provider is unavailable?
A: Teams should define which applications can tolerate delayed identity verification and which must fail closed.
Q: Why does identity-provider failure create more than an authentication problem?
A: Because many applications treat the identity provider as a runtime dependency for session validation, access refresh, and policy enforcement.
Q: What are the signs that zero trust controls depend too heavily on live identity verification?
A: Common signs include applications that cannot reauthenticate users during an outage, workflows that stop immediately when the provider is slow, and no documented fallback for disconnected operations.
Practitioner guidance
- Map identity-provider dependencies across critical applications Identify which clinical, mission, and enterprise services cannot start, continue, or reauthenticate without live identity-provider calls.
- Define degraded-mode access rules before outages occur Specify which sessions, tokens, or cached assertions remain valid during identity-provider disruption and for how long.
- Separate authentication continuity from application uptime Review whether the application can continue safely if identity verification is delayed, intermittent, or offline.
Bottom line: Identity continuity is a core resilience issue because identity-provider failure can stop dependent applications from functioning, not just block logins.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
06/06/2026 3:37 am
Identity-provider resilience is now a control-plane requirement, not an uptime nicety. When downstream applications depend on live identity verification, identity-provider failure becomes a business interruption event. That changes continuity planning from infrastructure availability alone to access assurance under failure. Practitioners should treat the identity layer as part of the critical path, not a separate admin service.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
Q: How do continuity requirements differ for DDIL operations and normal enterprise access?
A: DDIL environments must preserve controlled access when connectivity is intermittent or absent, so the design has to accept bounded local trust and cached decisions. Normal enterprise access can assume more stable verification paths, but it still needs defined outage behaviour so resilience does not depend on best effort.
👉 Read our full editorial: Identity continuity and zero trust when identity providers fail