Topic starter
27/06/2026 1:29 pm
TL;DR: A state government IT agency modernized identity for more than 145,000 users by extending RSA into a cloud-first Microsoft environment, adding phishing-resistant authentication, self-service, and help desk verification controls, according to RSA Security. The case shows that zero trust programs at public-sector scale depend on hybrid coverage, not cloud-only identity assumptions.
Editorial analysis by NHI Mgmt Group, based on content published by RSA Security: “Modernizing Identity at Scale”.
By the numbers:
- The agency’s high-assurance use cases included FIPS 140-3 Level 3 certified hardware authenticators.
Key questions
Q: What breaks when state agencies modernise identity only in the cloud?
A: Cloud-only modernisation leaves legacy applications, RADIUS dependencies, help desk recovery and high-assurance environments outside the control plane.
Q: Why does verified identity matter so much in zero trust and IAM programmes?
A: Verified identity matters because access decisions are only as reliable as the identity bound to them.
Q: How should public-sector teams modernise identity without disrupting legacy users?
A: They should extend policy into the existing estate, preserve working authenticators where possible and layer modern methods on top rather than forcing a rip-and-replace.
Practitioner guidance
- Map the full hybrid authentication surface Inventory Microsoft, RADIUS, legacy application and air-gapped access paths together so identity policy is not split across disconnected consoles.
- Remove knowledge-based help desk verification Replace PINs, shared secrets and security questions with bi-directional identity verification for credential reset and recovery requests.
- Preserve and govern existing token estates Carry forward software and hardware tokens into the new control plane, but tie them to central lifecycle reporting and enforcement.
Bottom line: The article shows that identity modernisation is a governance problem, not just a tooling refresh, because cloud identity alone does not cover the full public-sector estate.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
27/06/2026 2:51 pm
Help desk verification is now an identity control, not a support detail. This article shows why service desk authentication sits inside the attack surface for large identity programmes. When reset and recovery flows are weak, attackers do not need to break primary authentication; they only need to impersonate the user at the support layer. Practitioners should treat support-channel assurance as part of access governance, because that is where phishing-resistant MFA is most often undermined.
A few things that frame the scale:
- 90% of IT leaders say properly managing NHIs is essential for a successful zero-trust implementation, according to the Ultimate Guide to NHIs.
A question worth separating out:
A: Passwordless authentication removes the password from the normal login flow, often replacing it with a stronger method such as a QR-based or passkey-based sign-in. Phishing-resistant step-up authentication is different because it is invoked when trust drops, for example on an unmanaged browser or risky device. One improves everyday access, while the other adds control only when conditions warrant it.
👉 Read our full editorial: Zero trust identity modernization in state government at scale