IAM migrations — how teams actually ship them.
Timeline, capability mapping, data migration, cutover, gotchas — for the IAM transitions enterprises actually run. Each playbook reflects engagements we’ve led, including the things teams find out the hard way.
Okta → Microsoft Entra ID
A 90-day phased migration from Okta to Entra ID — capability mapping, app re-federation, lifecycle re-wiring, and a coexistence cutover that keeps users signed in throughout.
Timeline: ~90 days for a 10K-50K user enterprise with 200-400 SaaS apps
SailPoint → Saviynt
A 9-12 month migration from SailPoint IGA to Saviynt — connector re-platforming, role re-mining, certification campaign rebuild, and a cohort-by-cohort cutover.
Timeline: 9-12 months for a 25K-100K user enterprise with 50-100 connected applications
ForgeRock self-managed → cloud
A 6-9 month migration from self-managed ForgeRock to Ping's ForgeRock Identity Cloud SaaS — config export, journey rebuild, and a controlled traffic-shift cutover.
Timeline: 6-9 months for a mid-enterprise CIAM workload (1M-10M users, 5-15 brands / tenants)
Auth0 → Microsoft External ID
A 4-6 month migration from Auth0 to Microsoft External ID — tenant setup, Action / Rule re-implementation, and traffic-shift cutover with password-hash migration.
Timeline: 4-6 months for a 1M-5M user CIAM workload with 5-15 customer-facing apps